tion Token" and "IAM Role" authentication methods.It's not easy to showcase this without using some ZenML Python Client code, but here is an example that proves that the AWS client token issued to an S3 client can only access the S3 bucket resource it was issued for, even if the originating AWS Service Connector is able to access multiple S3 buckets with the corresponding long-lived credentials:

zenml service-connector register aws-federation-multi --type aws --auth-method=federation-token --auto-configure

Example Command Output

Successfully registered service connector `aws-federation-multi` with access to the following resources:

┏━━━━━━━━━━━━━━━━━━━━━━━┯━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓

┃     RESOURCE TYPE     │ RESOURCE NAMES                               ┃

┠───────────────────────┼──────────────────────────────────────────────┨

┃    🔶 aws-generic     │ us-east-1                                    ┃

┠───────────────────────┼──────────────────────────────────────────────┨

┃     📦 s3-bucket      │ s3://aws-ia-mwaa-715803424590                ┃

┃                       │ s3://zenfiles                                ┃

┃                       │ s3://zenml-demos                             ┃

┃                       │ s3://zenml-generative-chat                   ┃

┃                       │ s3://zenml-public-datasets                   ┃

┃                       │ s3://zenml-public-swagger-spec               ┃

┠───────────────────────┼──────────────────────────────────────────────┨

┃ 🌀 kubernetes-cluster │ zenhacks-cluster                             ┃

┠───────────────────────┼──────────────────────────────────────────────┨

┃  🐳 docker-registry   │ 715803424590.dkr.ecr.us-east-1.amazonaws.com ┃

┗━━━━━━━━━━━━━━━━━━━━━━━┷━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

The next part involves running some ZenML Python code to showcase that the downscoped credentials issued to a client are indeed restricted to the S3 bucket that the client asked to access:

from zenml.client import Client