[I] [fs] s3.assumed.role.arn doesn't actually assume the role for S3 file I/O [fluss]

["fresh-borzoni (via GitHub)" <gi...@apache.org>]

fresh-borzoni opened a new issue, #3761:
URL: https://github.com/apache/fluss/issues/3761

   ### Search before asking
   
   - [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.
   
   
   ### Description
   
   If you set s3.assumed.role.arn in server.yaml, you'd expect Fluss to do S3 I/O as that role. It doesn't. The plugin just logs "Using default AWS credential chain with AssumeRole" and returns, so S3A never gets an AssumedRoleCredentialProvider, so all remote.data.dir writes (remote log, KV snapshots, lake offsets) run with whatever ambient identity the default chain finds. `
   The ARN is only used for delegation token generation.
   
   We hit this while validating the Glue docs (#3424) on ECS Fargate, tiering wrote with the task's ambient credentials, not the configured role.
   
   ### Willingness to contribute
   
   - [x] I'm willing to submit a PR!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [fs] s3.assumed.role.arn doesn't actually assume the role for S3 file I/O [fluss]

["qzyu999 (via GitHub)" <gi...@apache.org>]

qzyu999 commented on issue #3761:
URL: https://github.com/apache/fluss/issues/3761#issuecomment-5084056996

   Take


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org