jackye1995 commented on code in PR #4695:
URL: https://github.com/apache/iceberg/pull/4695#discussion_r881209950
##########
aws/src/main/java/org/apache/iceberg/aws/lakeformation/LakeFormationAwsClientFactory.java:
##########
@@ -132,27 +145,90 @@ private LakeFormationClient lakeFormation() {
.build();
}
+ static class LakeFormationTemporaryCredentials {
+
+ private final AwsCredentials credentials;
+ private final Instant sessionCredentialsExpiration;
+
+ LakeFormationTemporaryCredentials(AwsCredentials credentials, Instant
expiration) {
+ this.credentials = credentials;
+ this.sessionCredentialsExpiration = expiration;
+ }
+
+ AwsCredentials credentials() {
+ return credentials;
+ }
+
+ Instant sessionCredentialsExpiration() {
+ return sessionCredentialsExpiration;
+ }
+ }
+
static class LakeFormationCredentialsProvider implements
AwsCredentialsProvider {
private LakeFormationClient client;
private String tableArn;
+ private final long expiryLeadTimeForRefreshInSecs;
+
+ private LakeFormationTemporaryCredentials cachedCredentials;
+ private final Cache<String, LakeFormationTemporaryCredentials> cache;
- LakeFormationCredentialsProvider(LakeFormationClient lakeFormationClient,
String tableArn) {
+ LakeFormationCredentialsProvider(LakeFormationClient lakeFormationClient,
+ String tableArn, long expiryLeadTimeForRefreshInSecs) {
this.client = lakeFormationClient;
this.tableArn = tableArn;
+ this.expiryLeadTimeForRefreshInSecs = expiryLeadTimeForRefreshInSecs;
+ this.cache = Caffeine.newBuilder()
+ .expireAfter(new Expiry<String, LakeFormationTemporaryCredentials>()
{
+ @Override
+ public long expireAfterCreate(@NonNull String key,
+ @NonNull LakeFormationTemporaryCredentials value, long
currentTime) {
+ return getExpiryDuration(value);
+ }
+
+ @Override
+ public long expireAfterUpdate(@NonNull String key, @NonNull
LakeFormationTemporaryCredentials value,
+ long currentTime, @NonNegative long currentDuration) {
+ return getExpiryDuration(value);
+ }
+
+ @Override
+ public long expireAfterRead(@NonNull String key, @NonNull
LakeFormationTemporaryCredentials value,
+ long currentTime, @NonNegative long currentDuration) {
+ return currentDuration;
+ }
+ })
+ .initialCapacity(1)
+ .build();
}
@Override
public AwsCredentials resolveCredentials() {
- GetTemporaryGlueTableCredentialsRequest
getTemporaryGlueTableCredentialsRequest =
- GetTemporaryGlueTableCredentialsRequest.builder()
- .tableArn(tableArn)
- // Now only two permission types (COLUMN_PERMISSION and
CELL_FILTER_PERMISSION) are supported
- // and Iceberg only supports COLUMN_PERMISSION at this time
- .supportedPermissionTypes(PermissionType.COLUMN_PERMISSION)
- .build();
- GetTemporaryGlueTableCredentialsResponse response =
-
client.getTemporaryGlueTableCredentials(getTemporaryGlueTableCredentialsRequest);
- return AwsSessionCredentials.create(response.accessKeyId(),
response.secretAccessKey(), response.sessionToken());
+ LakeFormationTemporaryCredentials credentials = cache.get(tableArn, key
-> {
Review Comment:
nit: can we make the `key -> { ... }` a helper method?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
