parthchandra commented on PR #6025: URL: https://github.com/apache/datafusion-comet/pull/6025#issuecomment-5837199722
@sunchao Addressed your latest comments by preserving the endpoint rather than deferring. `build_provider` now selects the STS endpoint to match the default chain: `AWS_STS_REGIONAL_ENDPOINTS=regional` uses the regional endpoint, and `legacy` or unset uses the global `sts.amazonaws.com` (signed as us-east-1, or the China equivalent). So both the unset and explicit-legacy cases you flagged keep hitting the global endpoint, and a global-only egress path is no longer broken by the take-over. FIPS takes strict precedence over all of this: when `AWS_USE_FIPS_ENDPOINT` is set we always use the regional FIPS endpoint, because there is no global FIPS STS endpoint. If `legacy` is set alongside FIPS, it's incompatible, so we ignore it and log a one-time warning rather than silently downgrading a FIPS-mandated environment to a non-FIPS endpoint. Tests through `build_provider` assert the resolved endpoint host: unset -> `sts.amazonaws.com`, `regional` -> `sts.us-east-1.amazonaws.com`, and FIPS+legacy -> `sts-fips.us-east-1.amazonaws.com`. Both the user guide and the design doc describe the selection and the FIPS-wins rule. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
