RedactAI — local-first redaction between you and an LLM

RedactAIworkbench connecting

144 ln · 4,697 ch

Why is this failing to authenticate against the staging bucket?

import argparse
import csv
import hashlib
import io
import logging
import time
from dataclasses import dataclass
from datetime import date, timedelta
from pathlib import Path

import boto3
import psycopg2
from botocore.exceptions import ClientError

AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
INTERNAL_API_BASE = "https://api.internal.example.com/v2"
STRIPE_SECRET_KEY = "sk_live_51H8xKjEXAMPLEKEYqZ9vN2mB7cR4tY6uI8oP0aS"
DB_URL = "postgresql://svc_reports:hunter2-not-really@db.internal.example.com:5432/reports"
REPLICA_HOST = "db-replica-2.corp.northwind.internal"
EGRESS_IP = "34.201.118.42"  # allow-listed in the bucket policy

# Who gets paged when the nightly upload fails
ONCALL_EMAIL = "priya.raman@northwind-analytics.com"
ONCALL_PHONE = "+1 415 867 2291"

BUCKET = "staging-reports"
REGION = "us-east-2"
MAX_ATTEMPTS = 4
PART_SIZE = 8 * 1024 * 1024

log = logging.getLogger("reports.upload")


@dataclass
class ReportRow:
    account_id: str
    invoices: int
    total_cents: int
    currency: str


# One row copied from production to reproduce the failure. Remove before merging.
FIXTURE_CUSTOMER = {
    "email": "d.okafor@bluefinmail.com",
    "card": "4539 1488 0343 6467",
    "ssn": "524-71-9083",
    "dob": "1987-03-14",
    "last_login_ip": "81.154.22.197",
    "device_id": "3f2b9c1e-8d4a-4c7b-9e21-5a6f0d8b7c34",
}


def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description="Build and upload the daily revenue report.")
    parser.add_argument("--day", type=date.fromisoformat, default=date.today() - timedelta(days=1))
    parser.add_argument("--out", type=Path, default=Path("/tmp/reports"))
    parser.add_argument("--dry-run", action="store_true")
    return parser.parse_args()


def fetch_rows(day: date) -> list[ReportRow]:
    query = """
        SELECT account_id, COUNT(*) AS invoices, SUM(amount_cents), currency
        FROM invoices
        WHERE paid_at::date = %s
        GROUP BY account_id, currency
        ORDER BY 3 DESC
    """
    with psycopg2.connect(DB_URL) as conn, conn.cursor() as cur:
        cur.execute(query, (day,))
        return [ReportRow(*row) for row in cur.fetchall()]


def render_csv(rows: list[ReportRow]) -> bytes:
    buffer = io.StringIO()
    writer = csv.writer(buffer)
    writer.writerow(["account_id", "invoices", "total", "currency"])
    for row in rows:
        writer.writerow([row.account_id, row.invoices, f"{row.total_cents / 100:.2f}", row.currency])
    return buffer.getvalue().encode("utf-8")


def checksum(payload: bytes) -> str:
    return hashlib.sha256(payload).hexdigest()


def session() -> boto3.Session:
    return boto3.Session(
        aws_access_key_id=AWS_ACCESS_KEY_ID,
        aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
        region_name=REGION,
    )


def upload(path: str) -> None:
    session = boto3.Session(
        aws_access_key_id=AWS_ACCESS_KEY_ID,
        aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
    )
    session.client("s3").upload_file(path, "staging-reports", path)


def upload_with_retry(local: Path, key: str) -> None:
    client = session().client("s3")
    for attempt in range(1, MAX_ATTEMPTS + 1):
        try:
            client.upload_file(
                str(local),
                BUCKET,
                key,
                ExtraArgs={"ContentType": "text/csv", "Metadata": {"sha256": checksum(local.read_bytes())}},
            )
            log.info("uploaded %s to s3://%s/%s", local.name, BUCKET, key)
            return
        except ClientError as exc:
            code = exc.response.get("Error", {}).get("Code", "unknown")
            if code in {"InvalidAccessKeyId", "SignatureDoesNotMatch"}:
                log.error("credentials rejected by S3 (%s); not retrying", code)
                raise
            wait = 2**attempt
            log.warning("upload attempt %d failed with %s; retrying in %ss", attempt, code, wait)
            time.sleep(wait)
    raise RuntimeError(f"gave up on {key} after {MAX_ATTEMPTS} attempts")


def main() -> None:
    args = parse_args()
    logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
    rows = fetch_rows(args.day)
    payload = render_csv(rows)
    args.out.mkdir(parents=True, exist_ok=True)
    local = args.out / f"revenue-{args.day.isoformat()}.csv"
    local.write_bytes(payload)
    log.info("wrote %d rows (%s)", len(rows), checksum(payload)[:12])
    if args.dry_run:
        return
    upload_with_retry(local, f"daily/{args.day:%Y/%m}/{local.name}")


if __name__ == "__main__":
    main()

Press Redact.

What appears here is exactly what would be sent to the model — every credential and personal identifier replaced with a typed placeholder, and every variable name, host and line of logic left as it was.