[
https://issues.apache.org/jira/browse/CAMEL-24191?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097087#comment-18097087
]
Andrea Cosentino commented on CAMEL-24191:
------------------------------------------
Fixed on main (#24835), camel-4.18.x (#24848) and camel-4.14.x (#24849).
_Claude Code on behalf of Andrea Cosentino_
> camel-aws2-kinesis: KCL consumer ignores session credentials and mishandles
> checkpoint/error handling
> -----------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24191
> URL: https://issues.apache.org/jira/browse/CAMEL-24191
> Project: Camel
> Issue Type: Bug
> Components: camel-aws2-kinesis
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.14.9, 4.18.4, 4.22.0
>
>
> Split out of CAMEL-24156 (deep review of the AWS components). Two defects in
> the KCL-based Kinesis consumer (KclKinesis2Consumer):
> 1. *Session credentials are silently ignored.* In both the DynamoDB and
> CloudWatch async-client builders the branch order tests {{accessKey &&
> secretKey}} before {{accessKey && secretKey && sessionToken}}. The first
> branch always matches when access/secret keys are set, so the session-token
> branch is unreachable and the DynamoDB/CloudWatch clients never use STS
> temporary credentials — they fail when only session credentials are valid.
> Code: KclKinesis2Consumer.java ~lines 94-133.
> 2. *Checkpoint/error handling loses or reprocesses data.* processRecords
> wraps the per-record processing in {{catch (Throwable t)}} that logs a
> message *without* the exception (no stack trace) and does not rethrow; the
> scheduler then proceeds and later checkpoints at shard end / shutdown, so
> records that failed to process are checkpointed past (data loss). There is no
> checkpoint after successful processing, so a crash reprocesses the whole
> lease. Code: KclKinesis2Consumer.java ~lines 193-232.
> Fix direction: reorder the credential branches so the session-token branch is
> reachable (both builders); log the processing exception with its stack trace
> and stop swallowing it; checkpoint after a batch is processed successfully
> and avoid checkpointing past a failed batch.
> Present on camel-4.18.x and camel-4.14.x; backport to both.
> Found during an agent-assisted audit of the AWS components; verified against
> the cited code.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
