You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@polaris.apache.org by di...@apache.org on 2026/10/20 14:14:25 UTC
(polaris) branch main updated: fix:dynamodb default credentials (#5760)
This is an automated email from the ASF dual-hosted git repository.
dimas-b pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git
The following commit(s) were added to refs/heads/main by this push:
new 3e928b4215 fix:dynamodb default credentials (#5760)
3e928b4215 is described below
commit 3e928b42157af6dc426bbd34f66fe18cb52092d1
Author: iting0321 <13...@users.noreply.github.com>
AuthorDate: Tue Oct 20 22:14:21 2026 +0800
fix:dynamodb default credentials (#5760)
---
.../nosql/persistence/db/dynamodb/README.md | 15 +++++-
.../nosql/persistence/db/dynamodb/build.gradle.kts | 7 +++
.../nosql/dynamodb/DynamoDbBackendFactory.java | 10 ++--
.../nosql/dynamodb/DynamoDbBackendFactoryTest.java | 53 ++++++++++++++++++++++
4 files changed, 77 insertions(+), 8 deletions(-)
diff --git a/persistence/nosql/persistence/db/dynamodb/README.md b/persistence/nosql/persistence/db/dynamodb/README.md
index db68233f00..5e6973eb49 100644
--- a/persistence/nosql/persistence/db/dynamodb/README.md
+++ b/persistence/nosql/persistence/db/dynamodb/README.md
@@ -31,8 +31,21 @@ extension. Configure the client—region, credentials, endpoint override, and HT
the `quarkus.dynamodb.*` properties. Polaris-specific settings, such as `table-prefix`, use the
`polaris.persistence.nosql.dynamodb.*` prefix.
+The programmatic factory resolves credentials with the AWS SDK default credentials provider chain,
+independently of whether an endpoint override is configured. When using a local DynamoDB emulator,
+provide dummy credentials through a supported source, for example:
+
+```bash
+export AWS_ACCESS_KEY_ID=xxx
+export AWS_SECRET_ACCESS_KEY=xxx
+```
+
+Custom AWS endpoints, proxies, and VPC endpoints can therefore use valid credentials from the same
+default provider chain. Configuring an endpoint override alone does not select dummy credentials.
+
The service smoke test starts the Floci AWS emulator and verifies that the Quarkus-managed client
-can bootstrap and use the backend. Module integration tests use the same emulator:
+can bootstrap and use the backend. Module integration tests use the same emulator and configure
+their own dummy credentials:
```bash
./gradlew :polaris-persistence-nosql-dynamodb:intTest
diff --git a/persistence/nosql/persistence/db/dynamodb/build.gradle.kts b/persistence/nosql/persistence/db/dynamodb/build.gradle.kts
index 772ba7809f..aa75a42b73 100644
--- a/persistence/nosql/persistence/db/dynamodb/build.gradle.kts
+++ b/persistence/nosql/persistence/db/dynamodb/build.gradle.kts
@@ -146,6 +146,13 @@ testing {
runtimeOnly("org.testcontainers:testcontainers")
runtimeOnly(libs.docker.java.api)
}
+
+ targets.configureEach {
+ testTask.configure {
+ environment("AWS_ACCESS_KEY_ID", "xxx")
+ environment("AWS_SECRET_ACCESS_KEY", "xxx")
+ }
+ }
}
}
}
diff --git a/persistence/nosql/persistence/db/dynamodb/src/main/java/org/apache/polaris/persistence/nosql/dynamodb/DynamoDbBackendFactory.java b/persistence/nosql/persistence/db/dynamodb/src/main/java/org/apache/polaris/persistence/nosql/dynamodb/DynamoDbBackendFactory.java
index 2a67fc1512..e1430b9d22 100644
--- a/persistence/nosql/persistence/db/dynamodb/src/main/java/org/apache/polaris/persistence/nosql/dynamodb/DynamoDbBackendFactory.java
+++ b/persistence/nosql/persistence/db/dynamodb/src/main/java/org/apache/polaris/persistence/nosql/dynamodb/DynamoDbBackendFactory.java
@@ -22,8 +22,7 @@ import jakarta.annotation.Nonnull;
import java.net.URI;
import org.apache.polaris.persistence.nosql.api.backend.Backend;
import org.apache.polaris.persistence.nosql.api.backend.BackendFactory;
-import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
-import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider;
import software.amazon.awssdk.http.apache5.Apache5HttpClient;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.dynamodb.DynamoDbClient;
@@ -43,11 +42,8 @@ public class DynamoDbBackendFactory
var clientBuilder =
DynamoDbClient.builder()
.httpClientBuilder(Apache5HttpClient.builder())
- .region(Region.of(config.region().orElse("us-east-1")));
-
- // TODO credentials !
- clientBuilder.credentialsProvider(
- StaticCredentialsProvider.create(AwsBasicCredentials.create("xxx", "xxx")));
+ .region(Region.of(config.region().orElse("us-east-1")))
+ .credentialsProvider(DefaultCredentialsProvider.builder().build());
config.endpointURI().ifPresent(uri -> clientBuilder.endpointOverride(URI.create(uri)));
diff --git a/persistence/nosql/persistence/db/dynamodb/src/test/java/org/apache/polaris/persistence/nosql/dynamodb/DynamoDbBackendFactoryTest.java b/persistence/nosql/persistence/db/dynamodb/src/test/java/org/apache/polaris/persistence/nosql/dynamodb/DynamoDbBackendFactoryTest.java
new file mode 100644
index 0000000000..287d1d96cf
--- /dev/null
+++ b/persistence/nosql/persistence/db/dynamodb/src/test/java/org/apache/polaris/persistence/nosql/dynamodb/DynamoDbBackendFactoryTest.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.polaris.persistence.nosql.dynamodb;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.net.URI;
+import org.junit.jupiter.api.Test;
+import software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider;
+
+class DynamoDbBackendFactoryTest {
+
+ @Test
+ void awsEndpointUsesDefaultCredentialsProvider() {
+ var config = ImmutableBuildableDynamoDbConfiguration.builder().build();
+
+ try (var client = new DynamoDbBackendFactory().buildConfiguration(config).client()) {
+ assertThat(client.serviceClientConfiguration().credentialsProvider())
+ .isInstanceOf(DefaultCredentialsProvider.class);
+ }
+ }
+
+ @Test
+ void endpointOverrideUsesDefaultCredentialsProvider() {
+ var config =
+ ImmutableBuildableDynamoDbConfiguration.builder()
+ .endpointURI("http://localhost:8000")
+ .build();
+
+ try (var client = new DynamoDbBackendFactory().buildConfiguration(config).client()) {
+ assertThat(client.serviceClientConfiguration().endpointOverride())
+ .contains(URI.create("http://localhost:8000"));
+ assertThat(client.serviceClientConfiguration().credentialsProvider())
+ .isInstanceOf(DefaultCredentialsProvider.class);
+ }
+ }
+}