You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "snazy (via GitHub)" <gi...@apache.org> on 2026/01/30 09:21:09 UTC
[PR] STS roleArn: enable 3rd party STS services [polaris]
snazy opened a new pull request, #3619:
URL: https://github.com/apache/polaris/pull/3619
Certain non-AWS STS service implementations use role ARNs that look quite different from AWS ones. This change shall enable those STS implementations.
Example role ARNs that currently fail:
* `urn:ecs:sts::s3:assumed-role/s3assumeRole/user1-105-temp`
* `urn:sgws:identity::12345:group/foo-bar-abcdef`
Related issue #2743
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] STS roleArn: enable 3rd party STS services [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy merged PR #3619:
URL: https://github.com/apache/polaris/pull/3619
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] STS roleArn: enable 3rd party STS services [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #3619:
URL: https://github.com/apache/polaris/pull/3619#issuecomment-3823424580
The AWS [pattern](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) does not appear to require even the `:` separators... It might be worth relaxing the check even more.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] STS roleArn: enable 3rd party STS services [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #3619:
URL: https://github.com/apache/polaris/pull/3619#issuecomment-3834698514
Add comment + moved AWS/KMS specific usage of 'account id' from an ARN to where it is used (only for KMS)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] STS roleArn: enable 3rd party STS services [polaris]
Posted by "adnanhemani (via GitHub)" <gi...@apache.org>.
adnanhemani commented on code in PR #3619:
URL: https://github.com/apache/polaris/pull/3619#discussion_r2753633469
##########
polaris-core/src/test/java/org/apache/polaris/core/storage/aws/AwsStorageConfigurationInfoTest.java:
##########
@@ -148,6 +154,15 @@ public void testRoleArnParsing() {
AwsStorageConfigurationInfo::getRoleARN,
AwsStorageConfigurationInfo::getAwsAccountId,
AwsStorageConfigurationInfo::getAwsPartition)
- .containsExactly("arn:aws:iam::012345678901:role/jdoe", "012345678901", "aws");
+ .containsExactly(roleArn, expectedAccountId, expectedPartition);
+ }
+
+ static Stream<Arguments> testRoleArnParsing() {
+ return Stream.of(
+ Arguments.of("arn:aws:iam::012345678901:role/jdoe", "012345678901", "aws"),
+ Arguments.of("arn:aws-us-gov:iam::012345678901:role/jdoe", "012345678901", "aws-us-gov"),
+ Arguments.of("arn:aws-cn:iam::012345678901:role/jdoe", "012345678901", "aws-cn"),
+ Arguments.of("urn:ecs:sts::s3:assumed-role/s3assumeRole/user1-105-temp", "s3", "ecs"),
Review Comment:
+1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] STS roleArn: enable 3rd party STS services [polaris]
Posted by "singhpk234 (via GitHub)" <gi...@apache.org>.
singhpk234 commented on code in PR #3619:
URL: https://github.com/apache/polaris/pull/3619#discussion_r2751796558
##########
polaris-core/src/test/java/org/apache/polaris/core/storage/aws/AwsStorageConfigurationInfoTest.java:
##########
@@ -148,6 +154,15 @@ public void testRoleArnParsing() {
AwsStorageConfigurationInfo::getRoleARN,
AwsStorageConfigurationInfo::getAwsAccountId,
AwsStorageConfigurationInfo::getAwsPartition)
- .containsExactly("arn:aws:iam::012345678901:role/jdoe", "012345678901", "aws");
+ .containsExactly(roleArn, expectedAccountId, expectedPartition);
+ }
+
+ static Stream<Arguments> testRoleArnParsing() {
+ return Stream.of(
+ Arguments.of("arn:aws:iam::012345678901:role/jdoe", "012345678901", "aws"),
+ Arguments.of("arn:aws-us-gov:iam::012345678901:role/jdoe", "012345678901", "aws-us-gov"),
+ Arguments.of("arn:aws-cn:iam::012345678901:role/jdoe", "012345678901", "aws-cn"),
+ Arguments.of("urn:ecs:sts::s3:assumed-role/s3assumeRole/user1-105-temp", "s3", "ecs"),
Review Comment:
I didn't fully understand this example, expected account id is `s3` ? can you please elaborate and add a code comment
##########
CHANGELOG.md:
##########
@@ -68,6 +68,8 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
### Fixes
+- Enable non-AWS STS role ARNs
Review Comment:
minor : worth mentioning ECS as an example
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] STS roleArn: enable 3rd party STS services [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #3619:
URL: https://github.com/apache/polaris/pull/3619#issuecomment-3836335655
@MonkeyCanCode : AssumeRole for MinIO is already covered by `RestCatalogMinIOSpecialIT` and `PolarisRestCatalogMinIOIT`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] STS roleArn: enable 3rd party STS services [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #3619:
URL: https://github.com/apache/polaris/pull/3619#issuecomment-3823518173
> The AWS [pattern](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) does not appear to require even the `:` separators... It might be worth relaxing the check even more.
Not strictly necessary in this change though. We have these partition + accountId extractions, which could yield `null` in odd cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] STS roleArn: enable 3rd party STS services [polaris]
Posted by "MonkeyCanCode (via GitHub)" <gi...@apache.org>.
MonkeyCanCode commented on PR #3619:
URL: https://github.com/apache/polaris/pull/3619#issuecomment-3825798606
This will help us to do assume role on rustfs/minio as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org