aritragster opened a new pull request, #4052:
URL: https://github.com/apache/polaris/pull/4052
## Summary
When Polaris federates to an S3 Tables Iceberg REST endpoint, the credential
vending flow must generate S3 Tables IAM policies (using `s3tables:` actions
and table-level ARNs) instead of standard S3 policies.
This is a draft PR to socialize the approach with the community. Feedback on
the design is welcome.
Related to #577
## Problem
S3 Tables uses a different IAM action namespace (`s3tables:`) and ARN format
(`arn:aws:s3tables:REGION:ACCOUNT:bucket/BUCKET/table/TABLE_ID`) compared to
standard S3. When Polaris federates to an S3 Tables Iceberg REST endpoint, the
existing credential vending flow generates S3 policies that don't work for S3
Tables data access.
## Approach
- Detect S3 Tables catalogs via the `signingName` property (`"s3tables"`)
from the remote endpoint's connection configuration, persisted on the catalog
entity
- Capture the `tableId` returned in `loadTable` responses from the remote
endpoint using a `ConfigCapturingHTTPClient` wrapper and request-scoped
`CapturedConfigHolder`
- Construct proper S3 Tables ARNs from the catalog's base location and
captured `tableId`
- Generate per-table scoped session policies with granular read/write
actions:
- Read: `s3tables:GetTableData`, `s3tables:GetTableMetadataLocation`
- Write (additional): `s3tables:UpdateTableMetadataLocation`,
`s3tables:PutTableData`
- Validate at catalog creation time that `signingName: "s3tables"` catalogs
use ARN-based `default-base-location` (not `s3://` paths)
## Files Changed (15 files, ~570 lines)
- `AwsCredentialsStorageIntegration` — S3 Tables policy generation,
branching on `signingName`
- `CredentialVendingContext` — added `resourceArns` and `signingName` fields
- `AwsStorageConfigurationInfo` — added `signingName` getter
- `CatalogEntity` — `setSigningNameFromConnectionConfig()` + validation
- `CapturedConfigHolder` / `ConfigCapturingHTTPClient` — new classes to
capture `tableId` from remote responses
- `IcebergCatalogHandler` — ARN construction from captured config
- `StorageAccessConfigProvider` — pass `resourceArns` through to credential
vending
- `IcebergRESTExternalCatalogFactory` — wire in config capture
- `PolarisAdminService` — persist `signingName` at catalog creation
- Test: 3 new unit tests for S3 Tables policy generation (read-only,
read-write, fallback)
## AI Disclosure
This implementation was developed with AI assistance (Kiro).
## Checklist
- [ ] 🛡️ Don't disclose security issues! (contact [email protected])
- [x] 🔗 Clearly explained why the changes are needed, or linked related
issues: Related to #577
- [x] 🧪 Added/updated tests with good coverage, or manually tested (and
explained how)
- [x] 💡 Added comments for complex logic
- [ ] 🧾 Updated `CHANGELOG.md` (if needed)
- [ ] 📚 Updated documentation in `site/content/in-dev/unreleased` (if needed)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
