fmorg-git opened a new pull request, #11030: URL: https://github.com/apache/ozone/pull/11030
Please describe your PR in detail: * Previously, the key for the STS revocation table was the sessionToken. It was noted that sessionToken is not audited, so it's difficult to determine what it is from logs without turning on trace logs to log all headers. Therefore, the revocation key is being updated to a concatenation of the temporaryAccessKeyId (which already was being audited) and the originalAccessKeyId (which will be added to the audit log as part of the PR). * As a side effect of testing this change (via `TestAuditUtils`), it was noticed certain inputs could cause the token parsing to fail that were not already covered, so this PR addresses that as well. ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-16110 ## How was this patch tested? 1) smoke tests and unit tests 2) manually checking keys in revocation table and then lowering the cleanup threshold to ensure they were still being cleaned up: ``` bash-5.1$ OZONE_OPTS= ozone debug ldb scan --db=/data/metadata/om.db --column-family=s3RevokedStsTokenTable --with-keys --limit=100 { "ASIA2QG9LEIN3Z02YY8KB17S|svc-iceberg-rest-catalog/[email protected]": 1786922690084 , "ASIABBSLHGE2UVFQAQWBTKT5|svc-iceberg-rest-catalog/[email protected]": 1786922683068 , "ASIAJDZTUVSR7QXI72CXIWW1|svc-iceberg-rest-catalog/[email protected]": 1786922693689 , "ASIAN92LMK2RK15CIUOUZJQL|svc-iceberg-rest-catalog/[email protected]": 1786922686527 } bash-5.1$ OZONE_OPTS= ozone debug ldb scan --db=/data/metadata/om.db --column-family=s3RevokedStsTokenTable --with-keys --limit=100 { } ``` 3) manually checking S3g audit log to ensure originalAccessKeyId was added: ``` 2026-08-16 23:30:41,877 | INFO | S3GAudit | user=ASIAZJ3C5CP5QAQJ85V8C0MZ | ip=172.25.0.120 | op=CREATE_BUCKET {"bucket":"[sts-bucket-aqievbhi]","originalAccessKeyId":"svc-iceberg-rest-catalog/[email protected]","x-amz-request-id":"d756b407-431e-482b-baba-133946ee4757","x-amz-id-2":"5wC4dfBH"} | ret=SUCCESS | perf={} | ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
