common.smk: Conditionally include --no-sign-request option

Conditionally include `--no-sign-request` option for download rules
if the `s3_src` config param is pointing to the public Nextstrain S3
bucket (s3://nextstrain-data/).

This means AWS credentials are no longer necessary for the public
h5n1-cattle-outbreak genome build.

README.md

@@ -69,12 +69,9 @@ Specifically, the files needed are `ingest/results/metadata.tsv` and `ingest/res
 Run full genome builds with the following command.
 
 ``` bash
-nextstrain build \
-    --env AWS_ACCESS_KEY_ID \
-    --env AWS_SECRET_ACCESS_KEY \
-    . \
-        --snakefile Snakefile.genome \
-        --config s3_src=s3://nextstrain-data/files/workflows/avian-flu/h5n1
+nextstrain build . \
+    --snakefile Snakefile.genome \
+    --config s3_src=s3://nextstrain-data/files/workflows/avian-flu/h5n1
 ```
 
 Currently this is only set up for the "h5n1-cattle-outbreak" build using NCBI data,

rules/common.smk

@@ -12,6 +12,18 @@ def subtypes_by_subtype_wildcard(wildcards):
     }
     return(db[wildcards.subtype])
 
+
+def no_sign_request(_wildcards):
+    """
+    Returns the `--no-sign-request` option for AWS CLI if
+    the requested `S3_SRC` poins to the NEXTSTRAIN_PUBLIC_BUCKET.
+    """
+    NEXTSTRAIN_PUBLIC_BUCKET = "s3://nextstrain-data/"
+    if S3_SRC.startswith(NEXTSTRAIN_PUBLIC_BUCKET):
+        return "--no-sign-request"
+    return ""
+
+
 if LOCAL_INGEST:
     rule copy_sequences_from_ingest:
         output:
@@ -39,19 +51,25 @@ else:
             sequences = "data/{segment}/sequences.fasta",
         params:
             s3_src=S3_SRC,
+            no_sign_request=no_sign_request,
         shell:
             """
-            aws s3 cp {params.s3_src:q}/{wildcards.segment}/sequences.fasta.zst - | zstd -d > {output.sequences}
+            aws s3 cp {params.no_sign_request} \
+                {params.s3_src:q}/{wildcards.segment}/sequences.fasta.zst - \
+                | zstd -d > {output.sequences}
             """
 
     rule download_metadata:
         output:
             metadata = "data/metadata.tsv",
         params:
             s3_src=S3_SRC,
+            no_sign_request=no_sign_request,
         shell:
             """
-            aws s3 cp {params.s3_src:q}/metadata.tsv.zst - | zstd -d > {output.metadata}
+            aws s3 cp {params.no_sign_request} \
+                {params.s3_src:q}/metadata.tsv.zst - \
+                | zstd -d > {output.metadata}
             """
 
 rule filter_sequences_by_subtype: