Direct DAAC S3 Bucket Access (BETA)

Authors: Alex Mandel (Development Seed), Brian Freitag (NASA MSFC), Jamison French (Development Seed)

Updated: October 16, 2025

Description: In this tutorial, we demonstrate how to assume the MAAP data reader role to access specific DAAC buckets.

This tutorial demonstrates an experimental feature to allow access to DAACs without using EarthDataLogin.

This method currently works for a select number of DAACs and their EarthDataCloud datasets which are stored in AWS S3:

Run This Notebook

To access and run this tutorial within MAAP’s Algorithm Development Environment (ADE), please refer to the “Getting started with the MAAP” section of our documentation.

Disclaimer: this tutorial must be run within MAAP’s ADE to assume the necessary permissions. This tutorial was tested using the Pangeo workspace image. If you encounter issues with the installs, ensure you have the latest version of pip installed.

Additional Resources

Importing Packages

If the packages below are not installed already, uncomment the following cell.

[1]:

import boto3
import fsspec
import xarray
import rioxarray
import matplotlib.pyplot as plt
import rasterio
from rasterio.session import AWSSession

Access The Data

We’ll create a couple helper functions to setup the assumed role session and view the data.

[2]:

def assume_role_credentials(ssm_parameter_name):
    # Create a session using your current credentials
    session = boto3.Session()

    # Retrieve the SSM parameter
    ssm = session.client('ssm', "us-west-2")
    parameter = ssm.get_parameter(
        Name=ssm_parameter_name,
        WithDecryption=True
    )
    parameter_value = parameter['Parameter']['Value']

    # Assume the DAAC access role
    sts = session.client('sts')
    assumed_role_object = sts.assume_role(
        RoleArn=parameter_value,
        RoleSessionName='TutorialSession'
    )

    # From the response that contains the assumed role, get the temporary
    # credentials that can be used to make subsequent API calls
    credentials = assumed_role_object['Credentials']

    return credentials

# We can pass assumed role credentials into fsspec
def fsspec_access(credentials, requester_pays=False):
    return fsspec.filesystem(
        "s3",
        key=credentials['AccessKeyId'],
        secret=credentials['SecretAccessKey'],
        token=credentials['SessionToken'],
        requester_pays=requester_pays
    )

# We can also pass assumed role credentials into rasterio AWSSession
def rasterio_access(credentials, requester_pays=False):
    aws_session = AWSSession(
        aws_access_key_id=credentials['AccessKeyId'],
        aws_secret_access_key=credentials['SecretAccessKey'],
        aws_session_token=credentials['SessionToken'],
        requester_pays=requester_pays

    )
    return rasterio.Env(aws_session)

Direct DAAC S3 Bucket Access (BETA)

Run This Notebook

Additional Resources

Importing Packages

Access The Data

Accessing GES DISC, LP DAAC and NSIDC Requester Pays Buckets

LP DAAC Access

GES DISC Access

NSIDC DAAC Access

Accessing Standard DAAC Buckets

ORNL DAAC Access

PO DAAC Access