[Python] parameratized SQL queries for queries to s3 buckets

I have a CSV file in an s3 bucket and I'm accessing it using the boto3 library. I'm using the select_object_content function to query the file with SQL language.

This is my code:

resp = self.s3_client.select_object_content(
Bucket=S3_BUCKET_MAPPING,
Key=S3_BUCKET_MAPPING_KEY,
ExpressionType="SQL",
Expression=f"SELECT * from s3object s where s.field = 'value'",
InputSerialization={
"CSV": {"FileHeaderInfo": "Use"},
"CompressionType": "GZIP",
},
OutputSerialization={"JSON": {}},
)


My questions are about the expression: f"SELECT * from s3object s where s.field = 'value'"

1. Is SQL injection a concern for this type of data fetch when the data store is in S3 and not actually a SQL database?
2. If SQL injection is a concern, is there a way to parameratize this expression the way you would if you were writing code that accesses a SQL database? I haven't been able to find anything so far to help.

Continue reading...