Re: [PR] Narrow SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION scope [polaris]

["tsukubatexas (via GitHub)" <gi...@apache.org>]

tsukubatexas commented on PR #4284:
URL: https://github.com/apache/polaris/pull/4284#issuecomment-4957237888

   Hi all,
   
   there is a broader use case that might be worth considering for a future, more general feature, especially in cloud environments where security policy restricts certain credential types.
   
   Some environments enforce a strict rule to avoid SAS or other vended storage credentials in production, and instead require all data access to go directly through the cloud provider’s native identity and IAM/RBAC model (for example, using Managed Identities and RBAC on Azure, or equivalent mechanisms elsewhere). In such setups, the desired pattern is:
   
   Polaris acts as the Iceberg catalog and authorization layer.
   Storage access is performed directly by clients using their own identity, not via credentials minted by Polaris.
   Polaris does not issue SAS (or similar credentials); storage authorization is governed entirely by the cloud IAM/RBAC configuration.
   From that perspective, it could be useful to consider a separate, clearly named mode that:
   
   Explicitly disables credential vending (no SAS or equivalent returned to clients),
   Assumes clients use their own cloud identities for storage access,
   Clearly documents the security model and trade‑offs, in particular:
   Storage permissions are controlled solely by the cloud IAM/RBAC layer,
   Polaris controls catalog‑level permissions and Iceberg commits,
   Some defense‑in‑depth is intentionally traded for a “clients manage their own storage credentials” model.
   The intent here would not be to reuse or “promote” the existing SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION flag, but rather to acknowledge that a well‑documented, first‑class configuration for “no vended credentials” operation could be valuable in environments where issuing SAS or similar tokens is constrained by policy.
   
   cheers


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org