ericyangliu opened a new issue, #4711:
URL: https://github.com/apache/polaris/issues/4711
### Describe the bug
We're running Polaris on EKS with IRSA, using the Kubernetes service account
role as the Polaris AWS identity.
While investigating STS usage, we noticed Polaris is making a lot of
`AssumeRoleWithWebIdentity` calls for its own IRSA role. The calls are coming
from the Java AWS SDK user agent and each call has a new
`aws-sdk-java-<timestamp>` session name.
The volume looks higher than expected for normal AWS SDK credential refresh
behavior, so it seems like the WebIdentity credential provider/cache may not be
getting reused across Polaris requests.
### To Reproduce
1. Run Polaris on EKS with IRSA.
2. Do not configure static AWS credentials for Polaris.
3. Send normal catalog traffic to an S3-backed catalog.
4. Query CloudTrail for `AssumeRoleWithWebIdentity` events on the Polaris
service account role.
I don't have a small local reproducer yet; the observations below are from
two EKS deployments.
### Actual Behavior
In one deployment, CloudTrail showed this pattern for the Polaris IRSA role:
```text
Polaris version: 1.3.0-incubating
Window: 2026-06-11T18:19:00Z to 2026-06-11T18:20:00Z
Event: AssumeRoleWithWebIdentity
Total events for the Polaris role: 1,261
By user agent:
- aws-sdk-java/2.39.2 ... api/STS#2.39.x ... lang/java#21.0.9: 1,259
- aws-sdk-go-v2 ... app/external-secrets: 2
```
A sanitized event looks like:
```json
{
"eventTime": "2026-06-11T18:19:00Z",
"eventName": "AssumeRoleWithWebIdentity",
"userAgent": "aws-sdk-java/2.39.2 ... api/STS#2.39.x ... lang/java#21.0.9",
"roleArn": "arn:aws:iam::<account-id>:role/<polaris-irsa-role>",
"roleSessionName": "aws-sdk-java-<timestamp>",
"sourceIPAddress": "<redacted>"
}
```
A second deployment showed the same shape at lower volume:
```text
Window: 2026-06-11T18:10:00Z to 2026-06-11T18:20:00Z
Total events for the Polaris role: 434
By user agent:
- aws-sdk-java/2.39.2 ... api/STS#2.39.x ... lang/java#21.0.9: 412
- aws-sdk-go/...: 22
```
### Expected Behavior
Polaris should reuse AWS WebIdentity credentials according to the normal AWS
SDK refresh behavior.
I would not expect ordinary catalog traffic to produce hundreds or thousands
of `AssumeRoleWithWebIdentity` calls for the Polaris pod role in a short window.
### Additional context
One possible area to check is the service identity path. In
1.3.0-incubating, `AwsIamServiceIdentityConfiguration.awsCredentialsProvider()`
builds a `DefaultCredentialsProvider` when static credentials are not
configured. If that path runs per request, the AWS SDK's WebIdentity credential
cache may not be reused as intended.
### System information
OS: Linux on EKS
Java: 21
Polaris version: 1.3.0-incubating
AWS SDK user agent observed: aws-sdk-java/2.39.2
Storage: AWS S3
Auth setup: EKS IRSA, no static AWS access keys configured for Polaris
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
