v1.0.6

infrastructure/global/stacksets/inf-org-crossaccount/test-cross-org.py

@@ -2,6 +2,7 @@
 import argparse
 import os
 import sys
+import logging
 from botocore.exceptions import ClientError, ProfileNotFound
 
 def get_args():
@@ -19,15 +20,26 @@ def get_args():
     parser.add_argument("--role-name", 
                         required=True, 
                         help="The IAM role name to assume in member accounts")
+
+    parser.add_argument("--debug",
+                        action="store_true",
+                        help="Enable verbose Boto3/Botocore HTTP wire-trace logging")
 
     return parser.parse_args()
 
 def test_connectivity(args):
+    # 1. Handle Debug Logging immediately
+    if args.debug:
+        # This is the 'canonical' way to debug Boto3; 
+        # it logs everything (headers, payloads, etc.) to stdout.
+        boto3.set_stream_logger(name='botocore', level=logging.DEBUG)
+        print("!!! DEBUG LOGGING ENABLED (Botocore wire-trace) !!!\n")
+
     try:
         # Initialize the base session
         session = boto3.Session(profile_name=args.profile, region_name=args.region)
 
-        # 1. Print Pre-flight Check (The "Where am I?" info)
+        # 2. Print Configuration Summary
         current_profile = args.profile or "Default/Environment"
         current_region = session.region_name
 
@@ -36,14 +48,15 @@ def test_connectivity(args):
         print(f"  Profile:      {current_profile}")
         print(f"  Base Region:  {current_region}")
         print(f"  Target Role:  {args.role_name}")
+        print(f"  Debug Mode:   {'ON' if args.debug else 'OFF'}")
         print("-" * 60)
 
-        # 2. Get Management Account Identity
+        # 3. Get Management Account Identity
         sts_client = session.client('sts')
         caller = sts_client.get_caller_identity()
         print(f"Sourcing identity from: {caller['Arn']}\n")
 
-        # 3. Start Organization loop
+        # 4. Start Organization loop
         org_client = session.client('organizations')
         print(f"{'Account Name':<25} | {'Account ID':<15} | {'Status'}")
         print("-" * 60)
@@ -65,7 +78,7 @@ def test_connectivity(args):
                         RoleSessionName="ConnectivityTest"
                     )
 
-                    # Prove success by verifying identity inside the member account
+                    # Verify identity inside the member account
                     creds = assumed['Credentials']
                     member_sts = boto3.client(
                         'sts',
@@ -75,7 +88,6 @@ def test_connectivity(args):
                         region_name=current_region
                     )
 
-                    # If this succeeds, connectivity is confirmed
                     member_sts.get_caller_identity()
                     print(f"{acc_name[:25]:<25} | {acc_id:<15} | ✅ Success")