litiliu commented on code in PR #3540:
URL: https://github.com/apache/fluss/pull/3540#discussion_r3526666987
##########
fluss-filesystems/fluss-fs-s3/src/main/java/org/apache/fluss/fs/s3/token/S3DelegationTokenProvider.java:
##########
@@ -63,21 +73,31 @@ public class S3DelegationTokenProvider {
@Nullable private final String secretKey;
@Nullable private final String roleArn;
@Nullable private final String stsEndpoint;
+ @Nullable private final AWSCredentialProviderList credentialProviderList;
private final Map<String, String> additionInfos;
- public S3DelegationTokenProvider(String scheme, Configuration conf) {
+ public S3DelegationTokenProvider(String scheme, Configuration conf) throws
IOException {
this.scheme = scheme;
this.region = conf.get(REGION_KEY);
checkArgument(region != null, "Region is not set.");
this.accessKey = conf.get(ACCESS_KEY_ID);
this.secretKey = conf.get(ACCESS_KEY_SECRET);
this.roleArn = conf.get(ROLE_ARN_KEY);
this.stsEndpoint = conf.get(STS_ENDPOINT_KEY);
+ boolean hasCredentialProvider =
+ conf.getBoolean(CREDENTIAL_PROVIDER_EXPLICITLY_CONFIGURED,
false)
+ &&
StringUtils.isNotBlank(conf.getTrimmed(AWS_CREDENTIALS_PROVIDER));
checkArgument(
(accessKey == null) == (secretKey == null),
"S3 access key and secret key must both be set or both be
unset.");
- if (accessKey == null) {
+ if (hasCredentialProvider && roleArn != null) {
+ throw new IllegalArgumentException(
+ "AssumeRole and a custom AWS credentials provider cannot
be configured together.");
+ }
+ this.credentialProviderList =
Review Comment:
Good catch. DynamicTemporaryAWSCredentialsProvider is an internal provider
used for client-side delegated credentials and is not intended to be configured
manually as a server-side credential source. However, since the configuration
accepts arbitrary provider class names, I've added an explicit check to reject
it before constructing the S3A provider list, along with a regression test. It
now fails with a clear configuration error instead of failing on the first
credential request. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
