Kurtiscwright commented on code in PR #2396:
URL: https://github.com/apache/iceberg-rust/pull/2396#discussion_r3319739046
##########
crates/catalog/glue/Cargo.toml:
##########
@@ -33,10 +33,14 @@ anyhow = { workspace = true }
async-trait = { workspace = true }
aws-config = { workspace = true }
aws-sdk-glue = { workspace = true }
+aws-sdk-sts = { workspace = true }
Review Comment:
Since STS is being added in this PR would it be possible to create a utils
that Glue & S3Tables can reuse?
##########
crates/catalog/glue/Cargo.toml:
##########
@@ -33,10 +33,14 @@ anyhow = { workspace = true }
async-trait = { workspace = true }
aws-config = { workspace = true }
aws-sdk-glue = { workspace = true }
+aws-sdk-sts = { workspace = true }
iceberg = { workspace = true }
iceberg-storage-opendal = { workspace = true, features = ["opendal-s3"] }
serde_json = { workspace = true }
tokio = { workspace = true }
+[package.metadata.cargo-machete]
+ignored = ["aws-sdk-sts"]
Review Comment:
I don't see machete in this project. Was it causing issues during build?
##########
crates/catalog/glue/src/utils.rs:
##########
@@ -87,6 +102,39 @@ pub(crate) async fn create_sdk_config(
config = config.region(region);
}
+ // If a role ARN is provided, assume that role via STS and use the
+ // resulting temporary credentials for all AWS SDK calls.
+ if let Some(role_arn) = properties.get(AWS_ASSUME_ROLE_ARN) {
+ let base_config = config.load().await;
+
+ let session_name = properties
+ .get(AWS_ASSUME_ROLE_SESSION_NAME)
+ .cloned()
+ .unwrap_or_else(|| "iceberg-glue-catalog".to_string());
+
+ let mut assume_role_builder =
+ AssumeRoleProvider::builder(role_arn).session_name(session_name);
+
+ if let Some(external_id) = properties.get(AWS_ASSUME_ROLE_EXTERNAL_ID)
{
+ assume_role_builder = assume_role_builder.external_id(external_id);
+ }
+
+ let assume_role_provider = assume_role_builder
+ .build_from_provider(
+ base_config
+ .credentials_provider()
+ .expect("base credentials provider must be set for STS
assume role"),
+ )
+ .await;
Review Comment:
I think these should move to an STS utils otherwise the S3Tables catalog
will need to duplicate these lines.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
