[I] [filesystem] S3 credential delegation requires static keys, blocking IRSA/IAM role usage [fluss]

["fresh-borzoni (via GitHub)" <gi...@apache.org>]

fresh-borzoni opened a new issue, #3066:
URL: https://github.com/apache/fluss/issues/3066

   ### Search before asking
   
   - [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.
   
   
   ### Motivation
   
   Currently `S3DelegationTokenProvider` hardcodes `AWSStaticCredentialsProvider` when building the STS client, requiring `s3.access-key` / `s3.secret-key` in config. This prevents using the AWS default credential chain (IRSA, instance profiles, environment variables).                                                                                                                                                                                                                            
      
   Additionally, `S3FileSystemPlugin` uses the presence of `access.key` to distinguish server from client. Without static keys, the server is misdetected as a client and fails with `NoAwsCredentialsException`.                                     
   This blocks running Fluss on EKS with IRSA, which is the standard way to manage credentials on AWS.
   
   ### Solution
   
   Fix: fall back to `DefaultAWSCredentialsProviderChain` when no static keys are provided, and require `fs.s3a.assumed.role.arn` in that case (since `GetSessionToken` does not work with temporary credentials). 
   Use `roleArn` presence as an additional server-mode indicator in the plugin.  
   
   ### Anything else?
   
   Related: #2662, #2989 
   
   ### Willingness to contribute
   
   - [x] I'm willing to submit a PR!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [filesystem] S3 credential delegation requires static keys, blocking IRSA/IAM role usage [fluss]

["polyzos (via GitHub)" <gi...@apache.org>]

polyzos closed issue #3066: [filesystem] S3 credential delegation requires static keys, blocking IRSA/IAM role usage
URL: https://github.com/apache/fluss/issues/3066


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org