Team & Onboarding Basics

9 examples to get a new AWS SDK specialist through their first week - 6 basic and 3 intermediate.

Prerequisites

• A manager or team lead who can request AWS IAM Identity Center (SSO) access to a sandbox account for the new hire.
• AWS CLI v2 installed locally (see AWS CLI Setup Basics).
• Python 3.10+ with pip install boto3, or Node.js 18+ with npm install @aws-sdk/client-sts, depending on which SDK the team uses.
• Access to this site's own docs, since the reading list below points back into it.

Basic Examples

1. Request Sandbox Account Access

The first ticket in onboarding should request a role in a sandbox account, not production credentials.

• Ask for access through IAM Identity Center (SSO) rather than a static access key, so the credential is temporary and centrally revocable.
• The requested role should be scoped to a small, specific set of actions, not AdministratorAccess.
• See Sandbox Accounts & Safe Experimentation for what this account should look like.

Related: Onboarding an AWS SDK Specialist - why sandbox-first access matters.

2. Configure the CLI Against the Sandbox Profile

Once access is granted, configure a named profile so every later command and SDK call points at the sandbox account.

aws configure sso --profile sandbox
# SSO session name, start URL, region, and account/role selection

• Using --profile sandbox keeps this identity separate from any other profile on the machine.
• aws sso login --profile sandbox refreshes the session when it expires.
• See AWS SSO / IAM Identity Center CLI Login for the full flow.

3. Verify the Profile Resolves

Before writing any code, confirm the CLI can authenticate as the sandbox identity.

aws sts get-caller-identity --profile sandbox
# { "Account": "111122223333", "Arn": "arn:aws:sts::...:assumed-role/..." }

• The returned account id should match the sandbox account, not a production account id.
• If this fails, the SSO session has expired or the profile is misconfigured - fix it here before moving on.

4. Read the Fundamentals, in Order

Three short sections on this site cover everything needed before writing SDK code.

• Start with sdk-fundamentals: what an SDK call actually does and how it becomes a signed request.
• Then aws-cli-setup: how the CLI and both SDKs share the same credential chain.
• Then iam-basics: how IAM controls what a call is allowed to do.

Related: these three sections are generic reading, not specific pages - browse each section's basics page first.

5. Make the First Read-Only Call

Confirm the whole chain works end to end with a single, safe call.

# --- Python (boto3) ---
import boto3
 
session = boto3.Session(profile_name="sandbox")
sts = session.client("sts")
identity = sts.get_caller_identity()  # read-only, safe in any account
print(identity["Account"])

// --- TypeScript (AWS SDK v3) ---
import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts";
import { fromSSO } from "@aws-sdk/credential-providers";
 
const sts = new STSClient({ credentials: fromSSO({ profile: "sandbox" }) });
const identity = await sts.send(new GetCallerIdentityCommand({}));
console.log(identity.Account);

• This is the same identity check used to verify CLI setup, now run through the SDK instead.
• A successful response confirms credentials, profile resolution, and SDK installation together.

6. Learn the Team's Review Conventions

Access and setup are only half of week one. The other half is understanding how this team reviews AWS-facing code.

• Find out who reviews IAM policy changes and SDK integration PRs specifically - it is often a smaller group than general code review.
• Ask whether the team requires a specific error-handling or retry pattern (see this site's sdk-rules section for the general rules).
• Confirm where sandbox resources get cleaned up, and whether there is a budget alarm to watch.

Intermediate Examples

7. Make One Small, Reviewed Change

The first real PR should be small, read-only or low-impact, and reviewed by someone senior on the team.

• A good first PR reads a resource (a bucket's tags, a table's item count) and logs or returns it - it does not create or delete anything yet.
• Getting this PR reviewed and merged teaches the team's conventions faster than any document.

8. Confirm Both SDKs if the Team Uses Both

Some teams run Python services and a Node.js/TypeScript frontend or Lambda layer side by side.

• Verify boto3 and the AWS SDK for JavaScript v3 both read the same sandbox profile without duplicating credentials.
• This matters because a misconfigured second SDK is a common source of "works on my machine" bugs later.

9. Set a Personal Cleanup Habit Early

Sandbox accounts stay useful only if they stay clean.

• Get in the habit of deleting anything created during experimentation before ending the day.
• If the sandbox has a budget alarm, know what it is set to and check it during the first week rather than after it fires.

Related: Sandbox Accounts & Safe Experimentation - the account model this habit protects.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).