vigneshio commented on issue #4711: URL: https://github.com/apache/polaris/issues/4711#issuecomment-4729482522
I reviewed the code and the main concern seems valid. What I found: 1. `AwsIamServiceIdentityConfiguration.awsCredentialsProvider()` creates a new `DefaultCredentialsProvider` every time when static AWS credentials are not configured. 2. This provider is used through `asServiceIdentityCredential()`, which is called by `DefaultServiceIdentityProvider.getServiceIdentityCredential()`. 3. `SigV4ConnectionCredentialVendor` requests credentials on every `getConnectionCredentials()` call, and there is no caching in this path. 4. Since AWS SDK v2 caches WebIdentity credentials per provider instance, creating a new provider each time can trigger a fresh `AssumeRoleWithWebIdentity` call before the downstream `AssumeRole`. This matches the different `aws-sdk-java-<timestamp>` session names seen in CloudTrail. One thing worth noting: the storage credential path also creates a new `DefaultCredentialsProvider` through `stsCredentials()`. However, `AwsCredentialsStorageIntegration` caches the assumed-role credentials in `StorageCredentialCache`, so the base identity is not resolved for every request. The SigV4 connection credential path does not have similar caching, which is likely why the repeated WebIdentity calls are showing up there. From what I can see, this behavior still exists on the current `main` branch. A possible fix would be to create a single long-lived base credentials provider and reuse it instead of creating a new one for every credential resolution. Does that sound like the right approach @dimas-b @adutra ?? or is there any other way... WDYT? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
