litiliu commented on code in PR #3540:
URL: https://github.com/apache/fluss/pull/3540#discussion_r3526751256
##########
fluss-filesystems/fluss-fs-s3/src/main/java/org/apache/fluss/fs/s3/token/S3DelegationTokenProvider.java:
##########
@@ -63,21 +73,31 @@ public class S3DelegationTokenProvider {
@Nullable private final String secretKey;
@Nullable private final String roleArn;
@Nullable private final String stsEndpoint;
+ @Nullable private final AWSCredentialProviderList credentialProviderList;
private final Map<String, String> additionInfos;
- public S3DelegationTokenProvider(String scheme, Configuration conf) {
+ public S3DelegationTokenProvider(String scheme, Configuration conf) throws
IOException {
this.scheme = scheme;
this.region = conf.get(REGION_KEY);
checkArgument(region != null, "Region is not set.");
this.accessKey = conf.get(ACCESS_KEY_ID);
this.secretKey = conf.get(ACCESS_KEY_SECRET);
this.roleArn = conf.get(ROLE_ARN_KEY);
this.stsEndpoint = conf.get(STS_ENDPOINT_KEY);
+ boolean hasCredentialProvider =
+ conf.getBoolean(CREDENTIAL_PROVIDER_EXPLICITLY_CONFIGURED,
false)
+ &&
StringUtils.isNotBlank(conf.getTrimmed(AWS_CREDENTIALS_PROVIDER));
checkArgument(
(accessKey == null) == (secretKey == null),
"S3 access key and secret key must both be set or both be
unset.");
- if (accessKey == null) {
+ if (hasCredentialProvider && roleArn != null) {
Review Comment:
Thanks for the suggestion. S3DelegationTokenProvider itself is lazily
constructed during the first obtainSecurityToken() call, so resolving
credentials in the constructor would not move the failure to server startup; it
would only perform the validation earlier within the same request. Since the
credentials are already validated before calling STS and this is non-blocking,
I'd prefer to keep the resolution lazy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
