[
https://issues.apache.org/jira/browse/ARROW-10675?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17529847#comment-17529847
]
Tobias Ullrich commented on ARROW-10675:
----------------------------------------
Hi [~apitrou],
we just tried to use this (as we need it in a k8s setup) and it does not work
in pyarrow. Looking at the code and both PRs, it seems like PR #10088 is
actually not adding the capabilities in Python. PR #8977 seems to would have
added this.
Please let me know if I am missing something here.
Thank you.
-Tobias
> [C++][Python] Support AWS S3 Web identity credentials
> -----------------------------------------------------
>
> Key: ARROW-10675
> URL: https://issues.apache.org/jira/browse/ARROW-10675
> Project: Apache Arrow
> Issue Type: Improvement
> Components: C++, Python
> Affects Versions: 1.0.1, 2.0.0
> Reporter: Paul Balanca
> Assignee: Sahil Gupta
> Priority: Major
> Labels: pull-request-available
> Fix For: 5.0.0
>
> Time Spent: 6h 40m
> Remaining Estimate: 0h
>
> It seems to me that Arrow only supports at the moment the "AssumeRole" AWS
> STS API, but not the other options offered:
> *
> [https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison]
> *
> [https://sdk.amazonaws.com/cpp/api/LATEST/class_aws_1_1_auth_1_1_s_t_s_assume_role_web_identity_credentials_provider.html]
> I am clearly no security/infra expert, but it seems that the configuration
> "AssumeRoleWithWebIdentity" is used commonly in Kubernetes setups, and I
> believe it would be beneficial for Arrow C++ & Python library to support.
> At the moment, a workaround is to call directly `aws sts` to generate a
> temporary session, but it is a fairly painful solution as the session
> expires, all PyArrow objects with an S3 filesystem (datasets, ...) need to be
> re-built with new credentials.
--
This message was sent by Atlassian Jira
(v8.20.7#820007)
