NathanCYee commented on code in PR #16794:
URL: https://github.com/apache/iceberg/pull/16794#discussion_r3560945616
##########
aws/src/main/java/org/apache/iceberg/aws/AwsProperties.java:
##########
@@ -493,10 +510,55 @@ private AwsCredentialsProvider credentialsProvider(
return credentialsProvider(this.clientCredentialsProvider);
}
+ // When a role is configured to be assumed (e.g. via
AssumeRoleAwsClientFactory), sign requests
+ // with the assumed-role credentials so that they do not diverge from the
credentials used for
+ // S3, Glue, KMS and DynamoDB. See
https://github.com/apache/iceberg/issues/16667.
+ if (!Strings.isNullOrEmpty(this.clientAssumeRoleArn)) {
+ if (!Strings.isNullOrEmpty(this.clientAssumeRoleRegion)) {
+ return assumeRoleCredentialsProvider();
+ }
+
+ LOG.warn(
+ "Cannot assume role {} to sign REST requests because {} is not set; "
+ + "falling back to the default credentials provider.",
+ this.clientAssumeRoleArn,
+ CLIENT_ASSUME_ROLE_REGION);
+ }
+
// Create a new credential provider for each client
return DefaultCredentialsProvider.builder().build();
}
+ StsAssumeRoleCredentialsProvider assumeRoleCredentialsProvider() {
+ Preconditions.checkNotNull(
+ this.clientAssumeRoleRegion,
+ "Cannot create StsAssumeRoleCredentialsProvider with null region");
+ return StsAssumeRoleCredentialsProvider.builder()
+ .stsClient(
+ StsClient.builder()
+
.applyMutation(httpClientProperties::applyHttpClientConfigurations)
+ .region(Region.of(this.clientAssumeRoleRegion))
Review Comment:
You're right this is a behavioral change.
There was a [documented update that the STS
service](https://aws.amazon.com/blogs/security/announcing-upcoming-changes-to-the-aws-security-token-service-global-endpoint/)
changed from only being served out of `us-east-1` to becoming regional by
default for non opt-in regions.
> April 18, 2025: AWS has made changes to the AWS Security Token Service
(AWS STS) global endpoint (sts.amazonaws.com) in Regions [enabled by
default](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-regions.html)
to enhance its resiliency and performance. AWS STS requests to the global
endpoint are automatically served in the same AWS Region as your workloads.
These changes will not be deployed to opt-in Regions. We recommend that you use
the appropriate AWS STS regional endpoints. For more information, see [AWS STS
global endpoint
changes](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_region-endpoints.html#reference_sts_global_endpoint_changes)
in the IAM User Guide.
The old behavior to use the global endpoint is now considered
[legacy](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html)
in the SDK.
> All new SDK major versions releasing after July 2022 will default to
regional. New SDK major versions might remove this setting and use regional
behavior. To reduce future impact regarding this change, we recommend you start
using regional in your application when possible.
According to the same documentation according to documentation the AWS 2.x
SDK already defaults to regional except for AssumeRole which routes to global.
> If no Region is configured, the AssumeRole and AssumeRoleWithWebIdentity
will use the global STS endpoint.
If we are getting ahead of future service disruption, using regional STS
would be the forward looking approach but it may temporarily break
compatibility for some users in [opt-in
regions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_region-endpoints.html#reference_sts_global_endpoint_changes)
who have not turned on the STS regional endpoint.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
