adarshsanjeev commented on code in PR #20540:
URL: https://github.com/apache/druid/pull/20540#discussion_r4267098414
##########
extensions-core/s3-extensions/src/main/java/org/apache/druid/storage/s3/ServerSideEncryptingAmazonS3.java:
##########
@@ -411,6 +412,13 @@ public static ServerSideEncryptingAmazonS3.Builder builder(
// Apply assume role if configured
if (!Strings.isNullOrEmpty(assumeRoleArn)) {
+ credentialsProvider = maybeAssumeIntermediateRole(
Review Comment:
The new `intermediateAssumeRoleArn` is only used as to assume the configured
role of `assumeRoleArn`. Is there a reason that `intermediateAssumeRoleArn`
causes `AccessDenied` but `assumeRoleArn` doesn't? Otherwise, it would be a
behaviour change to only use `assumeRoleArn` if the credentials are not
provided.
##########
docs/development/extensions-core/s3.md:
##########
@@ -127,6 +129,7 @@ For example, to set the region to 'us-east-1' through
system properties:
|`druid.s3.accessKey`|S3 access key. See [S3 authentication
methods](#s3-authentication-methods) for more details|Can be omitted according
to authentication methods chosen.|
|`druid.s3.secretKey`|S3 secret key. See [S3 authentication
methods](#s3-authentication-methods) for more details|Can be omitted according
to authentication methods chosen.|
|`druid.s3.fileSessionCredentials`|Path to properties file containing
`sessionToken`, `accessKey` and `secretKey` value. One key/value pair per line
(format `key=value`). See [S3 authentication
methods](#s3-authentication-methods) for more details |Can be omitted according
to authentication methods chosen.|
+|`druid.s3.intermediateAssumeRoleArn`|AWS ARN of a role to assume before
assuming the `assumeRoleArn` given by an ingestion spec or export destination.
Lets a bucket owner's trust policy name one fixed ARN instead of a different
principal for every Druid cluster. See [S3 authentication
methods](#s3-authentication-methods) for more details.|None|
Review Comment:
Modified docs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
