xxubai opened a new issue, #12270:
URL: https://github.com/apache/gravitino/issues/12270
### Version
main branch
### Describe what's wrong
When the optional `aws-access-key-id` and `aws-secret-access-key` properties
are present as empty strings, `GlueIcebergTableHelper` treats them as
configured static credentials.
This causes Iceberg metadata enrichment to fail instead of using the AWS
default credential chain. Gravitino then falls back to the Glue schema, losing
the accurate Iceberg schema, partition spec, and sort order.
### Error message and/or stacktrace
```text
Failed to load Iceberg metadata for table <database>.<table>
java.lang.IllegalStateException: Access key ID is not set
at
org.apache.gravitino.catalog.glue.GravitinoGlueCredentialsProvider.resolveCredentials(...)
```
### How to reproduce
1. Create a Glue catalog using an IAM role or another AWS default credential
provider.
2. Set the optional credential properties to empty strings:
```properties
aws-region=us-east-1
warehouse=s3://<bucket>/<path>
aws-access-key-id=
aws-secret-access-key=
```
3. Load an Iceberg table from the Glue catalog.
4. Observe that Iceberg metadata loading fails and Gravitino returns only
the Glue-derived metadata.
Expected behavior: blank credential properties should be treated as absent,
allowing Iceberg to use the AWS default credential chain.
### Additional context
`GlueIcebergTableHelper#createGlueCatalog` only checks whether the
credential values are non-null. It should require both values to be non-blank,
consistent with `GlueClientProvider`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
