You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "Flogue (via GitHub)" <gi...@apache.org> on 2025/10/23 12:47:54 UTC
[I] REST catalog, S3tables with botocore session [iceberg-python]
Flogue opened a new issue, #2657:
URL: https://github.com/apache/iceberg-python/issues/2657
### Apache Iceberg version
None
### Please describe the bug 🐞
Since 0.10.0, it is now possible to use a [botocore session](https://github.com/apache/iceberg-python/pull/2071) for a rest catalog, so:
```
import io
import os
import pandas as pd
import pyarrow as pa
from boto3 import Session
from pyiceberg.catalog import load_catalog
boto3_session = Session(profile_name='a_profile', region_name='us-east-1')
catalog = load_catalog(
"catalog",
type="rest",
botocore_session=boto3_session._session,
warehouse="arn:aws:s3tables:us-east-1:XXXXXXXXXXX:bucket/a_bucket",
uri=f"https://s3tables.us-east-1.amazonaws.com/iceberg",
**{
"rest.sigv4-enabled": "true",
"rest.signing-name": "s3tables",
"rest.signing-region": "us-east-1"
})
table = catalog.load_table("namespace.a_table")
json_string = "[{\"data\":\"000000000000\", ...}]"
df = pd.read_json(io.StringIO(json_string), orient='records')
arrow_table = pa.Table.from_pandas(df=df, schema=table.schema().as_arrow())
table.overwrite(arrow_table)
```
It works until we overwrite:
> OSError: When reading information for key 'metadata/snap-6778585584222594295-0-3ae9518f-fd1c-488f-b3d2-4ca1724317a1.avro' in bucket '2c8e7acb-67a1-4dc9-8ym9eg38966b8bazzfjn487w5o9wruse1b--table-s3': AWS Error UNKNOWN (HTTP status 400) during HeadObject operation: No response body.
To "fix" it, we can do:
```
boto3_session = Session(profile_name='a_profile', region_name='us-east-1')
catalog = load_catalog(
"catalog",
type="rest",
botocore_session=boto3_session._session,
warehouse="arn:aws:s3tables:us-east-1:XXXXXXXXXXX:bucket/a_bucket",
uri=f"https://s3tables.us-east-1.amazonaws.com/iceberg",
**{
"rest.sigv4-enabled": "true",
"rest.signing-name": "s3tables",
"rest.signing-region": "us-east-1"
})
table = catalog.load_table("namespace.a_table")
json_string = "[{\"data\":\"000000000000\", ...}]"
df = pd.read_json(io.StringIO(json_string), orient='records')
arrow_table = pa.Table.from_pandas(df=df, schema=table.schema().as_arrow())
credentials = boto3_session.get_credentials().get_frozen_credentials()
os.environ["AWS_ACCESS_KEY_ID"] = credentials.access_key
os.environ["AWS_SECRET_ACCESS_KEY"] = credentials.secret_key
if credentials.token:
os.environ["AWS_SESSION_TOKEN"] = credentials.token
table.overwrite(arrow_table)
```
which works but defeats the purpose.
We can access .schema() and such. So it seems the overwrite method is not using the proper SigV4Adapter (pyiceberg/catalog/rest/__init__.py).
### Willingness to contribute
- [ ] I can contribute a fix for this bug independently
- [ ] I would be willing to contribute a fix for this bug with guidance from the Iceberg community
- [ ] I cannot contribute a fix for this bug at this time
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] REST catalog, S3tables with botocore session [iceberg-python]
Posted by "David-Banquet (via GitHub)" <gi...@apache.org>.
David-Banquet commented on issue #2657:
URL: https://github.com/apache/iceberg-python/issues/2657#issuecomment-6146064385
Still reproducible on main (b32392dc) against S3 Tables, with a single account. I build the `botocore_session` from a valid profile and set bogus `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` in the environment. `create_namespace` and `create_table` go through the REST signer and succeed, then `append` fails in `CreateMultipartUpload` with `INVALID_ACCESS_KEY_ID`: the FileIO used the environment credentials.
`botocore_session` ends up in `table.io.properties`, but neither `PyArrowFileIO` (`_initialize_s3_fs`) nor `FsspecFileIO` (`_s3`) reads it. They only build credentials from the string properties (`s3.*`, `client.*`) or the default chain. That's the same for the Glue and DynamoDB catalogs, where the session is only passed to the boto3 client. #2071 added it for SigV4 signing, and the docs don't mention it.
Two ways I can see to fix it:
1. When `botocore_session` is set and no `s3.access-key-id` is given, have the FileIO take the session's credentials. The catch is that pyarrow's `S3FileSystem` only takes static keys, so the credentials would be frozen at FileIO creation and expire for SSO or assumed-role sessions in long-running processes.
2. Document that `botocore_session` only applies to the catalog client, and that the FileIO needs `client.*`/`s3.*` credentials or the default chain.
Is 1 something you'd accept, given the expiry? I can open a PR for either one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] REST catalog, S3tables with botocore session [iceberg-python]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #2657:
URL: https://github.com/apache/iceberg-python/issues/2657#issuecomment-4292757264
This issue has been automatically marked as stale because it has been open for 180 days with no activity. It will be closed in next 14 days if no further activity occurs. To permanently prevent this issue from being considered stale, add the label 'not-stale', but commenting on the issue is preferred when possible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org