GitHub user mengw15 added a comment to the discussion: Design: storage credential for per-user warehouses — assumed IAM role instead of a stored key
**Rollout plan** We split the implementation into three phases. Phase 1 delivers the model end-to-end; Phases 2–3 harden it. (local/MinIO keeps the static-key path). 1. **Assume the user's role** — build the assumed-role model on Lakekeeper (already supports assume-role + external-id + vending): the system identity assumes each user's IAM role → short-lived credentials → vend. Removes the per-user stored secret. 2. **Authenticate the Computing Unit** — hardens the CU ↔ Lakekeeper step from Phase 1: the CU authenticates (OIDC) so vended credentials reach only the right execution. Required for multi-tenant safety. 3. **Deploy** — provision the per-deployment system identity keyless (IRSA / instance profile) and wire it into the Kubernetes deployment via Terraform. GitHub link: https://github.com/apache/texera/discussions/6040#discussioncomment-17599745 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
