A credential is authentication information that identifies an authorized user or service account and allows an application or command-line tool to access a service. Examples include an AWS access key ID with a secret access key, or a Google Cloud service-account key containing BigQuery access details. section 7.7.2 section 12.3.6
Handle credentials as sensitive configuration:
- Create a service account and grant it the required project role, such as Viewer, before generating its key. section 7.7.2
- Generate a JSON service-account key when the application needs to connect to BigQuery. section 7.7.2
- Keep credential files secret; the BigQuery key can allow anyone possessing it to read the data. section 7.7.2
- Store Streamlit credentials in .streamlit/secrets.toml and access them through st.secrets rather than exposing the original JSON file. section 7.7.2
Authenticating an Elastic Beanstalk setup
When the EB CLI asks for authentication, enter the AWS access key ID and secret access key belonging to the IAM user. These credentials let the CLI act on that user's behalf during setup. section 12.3.6
>>> import json
>>> import toml
>>> with open('sia-service-account.json') as json_file:
... config = json.load(json_file)
...
>>> obj_to_write = {'bigquery': config}
>>> with open('.streamlit/secrets.toml', 'a') as toml_file:
... toml.dump(obj_to_write, toml_file)
...
'[bigquery]\ntype = "service_account"\nproject_id = "dauntless-...'
<Rest excluded for brevity>
Convert the downloaded Google Cloud JSON credential into a TOML section named bigquery, then place it in .streamlit/secrets.toml. section 7.7.2
