import.py

import boto3

def generate_credentials(event):
   tenant_id = extract_tenant_from_auth_header(event)
   dynamic_policy = generate_dynamodb_policy(tenant_id)
   sts_client = boto3.client("sts")
   assumed_role = sts_client.assume_role(
       RoleArn="arn:aws:iam::<account-id>:role/DynamodbRoleToAssume",
       RoleSessionName="<name-to-identify-the-assumed-role-session>",
       Policy=dynamic_policy,
   )
   credentials = assumed_role["Credentials"]
   return {
       "aws_access_key_id": credentials["AccessKeyId"],
       "aws_secret_access_key": credentials["SecretAccessKey"],
       "aws_session_token": credentials["SessionToken"],
   }