I found a useful pattern today for automating more complex AWS processes as pastable command line snippets, using Boto3.
\nThe trick is to take advantage of the fact that python3 -c '...' lets you pass in a multi-line Python string which will be executed directly.
I used that to create a new IAM role by running the following:
\npython3 -c '\nimport boto3, json\n\niam = boto3.client(\"iam\")\ncreate_role_response = iam.create_role(\n Description=(\"Description of my role\"),\n RoleName=\"my-new-role\",\n AssumeRolePolicyDocument=json.dumps(\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::462092780466:user/s3.read-write.my-previously-created-user\"\n },\n \"Action\": \"sts:AssumeRole\",\n }\n ],\n }\n ),\n MaxSessionDuration=12 * 60 * 60,\n)\n# Attach AmazonS3FullAccess to it - note that even though we use full access\n# on the role itself any time we call sts.assume_role() we attach an additional\n# policy to ensure reduced access for the temporary credentials\niam.attach_role_policy(\n RoleName=\"my-new-role\",\n PolicyArn=\"arn:aws:iam::aws:policy/AmazonS3FullAccess\",\n)\nprint(create_role_response[\"Role\"][\"Arn\"])\n'