jlambatl commented on code in PR #2396:
URL: https://github.com/apache/iceberg-rust/pull/2396#discussion_r3331222424
##########
crates/catalog/glue/src/utils.rs:
##########
@@ -87,6 +102,39 @@ pub(crate) async fn create_sdk_config(
config = config.region(region);
}
+ // If a role ARN is provided, assume that role via STS and use the
+ // resulting temporary credentials for all AWS SDK calls.
+ if let Some(role_arn) = properties.get(AWS_ASSUME_ROLE_ARN) {
+ let base_config = config.load().await;
+
+ let session_name = properties
+ .get(AWS_ASSUME_ROLE_SESSION_NAME)
+ .cloned()
+ .unwrap_or_else(|| "iceberg-glue-catalog".to_string());
+
+ let mut assume_role_builder =
+ AssumeRoleProvider::builder(role_arn).session_name(session_name);
+
+ if let Some(external_id) = properties.get(AWS_ASSUME_ROLE_EXTERNAL_ID)
{
+ assume_role_builder = assume_role_builder.external_id(external_id);
+ }
+
+ let assume_role_provider = assume_role_builder
+ .build_from_provider(
+ base_config
+ .credentials_provider()
+ .expect("base credentials provider must be set for STS
assume role"),
+ )
+ .await;
Review Comment:
@Kurtiscwright Thanks for responding and providing feedback.
I've had a look at the existing project structure, and it wasn't clear where
a utils package would fit, so that we can avoid the duplicate code between
S3Tables and Glue. I am happy to extract it; I just need guidance so I can
start implementing the required changes.
--- UPDATE ---
I found RFC 0001, and it seems that an `iceberg-aws` crate in
`crates/integrations` would be appropriate. I'll start working on that. The
crate name can change. I considered calling it `aws-auth`; however, it might be
more generic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
