amogh-jahagirdar commented on code in PR #4695:
URL: https://github.com/apache/iceberg/pull/4695#discussion_r870640744
##########
aws/src/main/java/org/apache/iceberg/aws/lakeformation/LakeFormationAwsClientFactory.java:
##########
@@ -132,27 +145,90 @@ private LakeFormationClient lakeFormation() {
.build();
}
+ static class LakeFormationTemporaryCredentials {
+
+ private final AwsCredentials credentials;
+ private final Instant sessionCredentialsExpiration;
+
+ LakeFormationTemporaryCredentials(AwsCredentials credentials, Instant
expiration) {
+ this.credentials = credentials;
+ this.sessionCredentialsExpiration = expiration;
+ }
+
+ AwsCredentials credentials() {
+ return credentials;
+ }
+
+ Instant sessionCredentialsExpiration() {
+ return sessionCredentialsExpiration;
+ }
+ }
+
static class LakeFormationCredentialsProvider implements
AwsCredentialsProvider {
private LakeFormationClient client;
private String tableArn;
+ private final long expiryLeadTimeForRefreshInSecs;
+
+ private LakeFormationTemporaryCredentials cachedCredentials;
+ private final Cache<String, LakeFormationTemporaryCredentials> cache;
- LakeFormationCredentialsProvider(LakeFormationClient lakeFormationClient,
String tableArn) {
+ LakeFormationCredentialsProvider(LakeFormationClient lakeFormationClient,
+ String tableArn, long expiryLeadTimeForRefreshInSecs) {
this.client = lakeFormationClient;
this.tableArn = tableArn;
+ this.expiryLeadTimeForRefreshInSecs = expiryLeadTimeForRefreshInSecs;
+ this.cache = Caffeine.newBuilder()
+ .expireAfter(new Expiry<String, LakeFormationTemporaryCredentials>()
{
+ @Override
+ public long expireAfterCreate(@NonNull String key,
+ @NonNull LakeFormationTemporaryCredentials value, long
currentTime) {
+ return getExpiryDuration(value);
+ }
+
+ @Override
+ public long expireAfterUpdate(@NonNull String key, @NonNull
LakeFormationTemporaryCredentials value,
+ long currentTime, @NonNegative long currentDuration) {
+ return getExpiryDuration(value);
+ }
+
+ @Override
+ public long expireAfterRead(@NonNull String key, @NonNull
LakeFormationTemporaryCredentials value,
+ long currentTime, @NonNegative long currentDuration) {
+ return currentDuration;
+ }
+ })
+ .initialCapacity(1)
+ .build();
}
@Override
public AwsCredentials resolveCredentials() {
- GetTemporaryGlueTableCredentialsRequest
getTemporaryGlueTableCredentialsRequest =
- GetTemporaryGlueTableCredentialsRequest.builder()
- .tableArn(tableArn)
- // Now only two permission types (COLUMN_PERMISSION and
CELL_FILTER_PERMISSION) are supported
- // and Iceberg only supports COLUMN_PERMISSION at this time
- .supportedPermissionTypes(PermissionType.COLUMN_PERMISSION)
- .build();
- GetTemporaryGlueTableCredentialsResponse response =
-
client.getTemporaryGlueTableCredentials(getTemporaryGlueTableCredentialsRequest);
- return AwsSessionCredentials.create(response.accessKeyId(),
response.secretAccessKey(), response.sessionToken());
+ LakeFormationTemporaryCredentials credentials = cache.get(tableArn, key
-> {
+ GetTemporaryGlueTableCredentialsRequest
getTemporaryGlueTableCredentialsRequest =
+ GetTemporaryGlueTableCredentialsRequest.builder()
+ .tableArn(key)
+ // Now only two permission types (COLUMN_PERMISSION and
CELL_FILTER_PERMISSION) are supported
+ // and Iceberg only supports COLUMN_PERMISSION at this time
+ .supportedPermissionTypes(PermissionType.COLUMN_PERMISSION)
+ .build();
+ GetTemporaryGlueTableCredentialsResponse response =
+
client.getTemporaryGlueTableCredentials(getTemporaryGlueTableCredentialsRequest);
+
+ AwsSessionCredentials awsSessionCredentials = AwsSessionCredentials
+ .create(response.accessKeyId(), response.secretAccessKey(),
response.sessionToken());
+
+ cachedCredentials = new
LakeFormationTemporaryCredentials(awsSessionCredentials, response.expiration());
+ return cachedCredentials;
+ });
+
+ return credentials.credentials();
+ }
+
+ private long getExpiryDuration(LakeFormationTemporaryCredentials value) {
Review Comment:
In Iceberg, please avoid using getter style
https://github.com/apache/iceberg/blob/master/CONTRIBUTING.md#style. I think
the method name should also reflect the time unit in this case (nanos).
For this, expiryDurationNanos(LakeFormationTemporaryCredentials credentials)
should be clear enough IMO, let me know what you think!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
