mengw15 opened a new issue, #6935:
URL: https://github.com/apache/texera/issues/6935
### Task Summary
Part of #6870. The backend for the AWS path, where the user grants an IAM
**role** instead of
handing over long-lived access keys.
- **Reserve an identity up front** — a `POST /warehouse/reserve-identity`
endpoint: the web service
mints a per-warehouse, server-generated `external_id` (a random UUID;
reuses the existing pending
one if present) and returns it with the deployment's platform principal
ARN, so the user can wire
their IAM role's trust policy in one step, before the warehouse exists.
- **Assume-role create** — creating an AWS-flavor warehouse binds the
reserved external ID and, via
`LakekeeperClient`, registers a Lakekeeper warehouse whose **storage
profile** carries
`assume-role-arn` + `sts-enabled`, and whose **storage credential** is
`aws-system-identity` with
the `external-id`. Lakekeeper validates by **actually assuming the role
and test-writing to S3**,
so a wrong role ARN or external ID fails at create time (HTTP 502), before
anything is saved.
- **Platform identity config** — a `platform-role-arn` setting
(`StorageConfig` / `storage.conf`):
the deployment's AWS identity ARN, shown to users so they know whom to
trust in their role;
empty when the deployment has no AWS identity.
### Task Type
- [x] Other (feature implementation)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
