You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by GitBox <gi...@apache.org> on 2022/05/24 15:35:00 UTC
[GitHub] [iceberg] jackye1995 opened a new pull request, #4855: Infra: add AWS CI workflow configuration
jackye1995 opened a new pull request, #4855:
URL: https://github.com/apache/iceberg/pull/4855
@rdblue @amogh-jahagirdar @xiaoxuandev @rajarshisarkar @singhpk234
Adding the AWS CI workflow to connect to an AWS account for running AWS module integration tests. Sorry I promised this almost a year ago and finally I am able to make it.
I did some research and there are 2 ways to do this:
1. using https://github.com/aws-actions/configure-aws-credentials action, which I have not been able to make it work yet in the GitHub OIDC mode, still trying
2. using Github secrets as stated by ASF infra page: https://infra.apache.org/github-actions-secrets.html
I will reach out to ASF infra team to see what's the best way to go with this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] Infra: add AWS CI workflow configuration [iceberg]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#issuecomment-2278899989
This pull request has been marked as stale due to 30 days of inactivity. It will be closed in 1 week if no further activity occurs. If you think that’s incorrect or this pull request requires a review, please simply write any comment. If closed, you can revive the PR at any time and @mention a reviewer or discuss it on the dev@iceberg.apache.org list. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on a diff in pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on code in PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#discussion_r885093702
##########
aws/src/integration/README.md:
##########
@@ -0,0 +1,197 @@
+<!--
+ - Licensed to the Apache Software Foundation (ASF) under one
+ - or more contributor license agreements. See the NOTICE file
+ - distributed with this work for additional information
+ - regarding copyright ownership. The ASF licenses this file
+ - to you under the Apache License, Version 2.0 (the
+ - "License"); you may not use this file except in compliance
+ - with the License. You may obtain a copy of the License at
+ -
+ - http://www.apache.org/licenses/LICENSE-2.0
+ -
+ - Unless required by applicable law or agreed to in writing,
+ - software distributed under the License is distributed on an
+ - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ - KIND, either express or implied. See the License for the
+ - specific language governing permissions and limitations
+ - under the License.
+ -->
+
+# AWS Integration Tests
+
+The AWS integration test suite runs tests against an AWS account to verify behaviors in a real AWS cloud environment.
+
+## Setup
+
+The test suite uses the [default AWS credential chain](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html) to detect the credentials used to run tests.
+For example, the AWS Tests CI workflow uses the credentials set in environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
+
+In addition, the test suite requires setting the following environment variables:
+- `AWS_REGION`: AWS region to run tests, e.g. `us-east-1`
+- `AWS_CROSS_REGION`: AWS region to run any cross-region operations, e.g. `us-west-2`
+- `AWS_TEST_ACCOUNT_ID`: AWS account ID to run tests, e.g. `123456789012`
+- `AWS_TEST_BUCKET`: S3 bucket to run tests, e.g. `my-bucket`
+- `AWS_TEST_CROSS_REGION_BUCKET`: S3 bucket to run any cross-region operations, e.g. `my-cross-region-bucket`
+
+Here is an example script to execute integration tests in terminal:
+
+```shell
+# set environment variables
+export AWS_ACCESS_KEY_ID=ABCDEFG1234567890
+export AWS_SECRET_ACCESS_KEY=qwertyuiopasdfghjklzxcvbnm
+export AWS_REGION=us-east-1
+export AWS_CROSS_REGION=us-west-2
+export AWS_TEST_ACCOUNT_ID=123456789012
+export AWS_TEST_BUCKET=my-bucket
+export AWS_TEST_CROSS_REGION_BUCKET=my-cross-region-bucket
+
+# run all tests
+./gradlew :iceberg-aws:integrationTest
+
+# run a single test suite
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration"
+
+# run a single test
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration.testServerSideKmsEncryption"
+```
+
+## Permissions
+
+The following JSON payload describes the minimum set of permissions required to execute tests.
+Developers interested in running the test suite against a personal AWS account can use this for reference.
+The AWS Tests CI workflow uses the same set of permissions.
+To add new permissions in CI, please contact [dev@iceberg.apache.org](mailto:dev@iceberg.apache.org).
+
+```json
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Sid": "S3BucketPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:GetAccessPoint",
+ "s3:CreateAccessPoint",
+ "s3:DeleteAccessPoint",
+ "s3:ListAccessPoints",
+ "s3:ListBucket"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2"
+ ]
+ },
+ {
+ "Sid": "S3ObjectPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:PutObject",
+ "s3:GetObjectAcl",
+ "s3:GetObject",
+ "s3:DeleteObject",
+ "s3:AbortMultipartUpload"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1/*",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2/*"
+ ]
+ },
+ {
+ "Sid": "GluePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "glue:UpdateDatabase",
+ "glue:DeleteDatabase",
+ "glue:CreateTable",
+ "glue:GetTables",
+ "glue:GetTableVersions",
+ "glue:UpdateTable",
+ "glue:DeleteTable",
+ "glue:GetDatabases",
+ "glue:GetTable",
+ "glue:GetDatabase",
+ "glue:GetTableVersion",
+ "glue:CreateDatabase"
+ ],
+ "Resource": [
+ "arn:aws:glue:us-east-1:220427471354:catalog",
+ "arn:aws:glue:us-east-1:220427471354:database/iceberg_aws_ci_*",
+ "arn:aws:glue:us-east-1:220427471354:table/iceberg_aws_ci_*/*",
+ "arn:aws:glue:us-east-1:220427471354:userDefinedFunction/iceberg_aws_ci_*/*"
+ ]
+ },
+ {
+ "Sid": "STSPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "sts:TagSession",
+ "sts:AssumeRole"
+ ],
+ "Resource": [
+ "arn:aws:iam::220427471354:role/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyCreationPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:CreateKey"
+ ],
+ "Resource": "*"
+ },
+ {
+ "Sid": "KMSAliasPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:CreateAlias"
+ ],
+ "Resource": [
+ "arn:aws:kms:us-east-1:220427471354:key/*",
+ "arn:aws:kms:us-east-1:220427471354:alias/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyUsagePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:Decrypt",
+ "kms:Encrypt",
+ "kms:GenerateDataKey",
+ "kms:ScheduleKeyDeletion"
+ ],
+ "Resource": "arn:aws:kms:us-east-1:220427471354:key/*",
+ "Condition": {
+ "ForAnyValue:StringLike": {
+ "kms:ResourceAliases": "alias/iceberg-aws-ci-*"
+ }
+ }
+ },
+ {
+ "Sid": "IAMPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "iam:CreateRole",
Review Comment:
#4909
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on a diff in pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on code in PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#discussion_r885089650
##########
aws/src/integration/README.md:
##########
@@ -0,0 +1,197 @@
+<!--
+ - Licensed to the Apache Software Foundation (ASF) under one
+ - or more contributor license agreements. See the NOTICE file
+ - distributed with this work for additional information
+ - regarding copyright ownership. The ASF licenses this file
+ - to you under the Apache License, Version 2.0 (the
+ - "License"); you may not use this file except in compliance
+ - with the License. You may obtain a copy of the License at
+ -
+ - http://www.apache.org/licenses/LICENSE-2.0
+ -
+ - Unless required by applicable law or agreed to in writing,
+ - software distributed under the License is distributed on an
+ - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ - KIND, either express or implied. See the License for the
+ - specific language governing permissions and limitations
+ - under the License.
+ -->
+
+# AWS Integration Tests
+
+The AWS integration test suite runs tests against an AWS account to verify behaviors in a real AWS cloud environment.
+
+## Setup
+
+The test suite uses the [default AWS credential chain](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html) to detect the credentials used to run tests.
+For example, the AWS Tests CI workflow uses the credentials set in environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
+
+In addition, the test suite requires setting the following environment variables:
+- `AWS_REGION`: AWS region to run tests, e.g. `us-east-1`
+- `AWS_CROSS_REGION`: AWS region to run any cross-region operations, e.g. `us-west-2`
+- `AWS_TEST_ACCOUNT_ID`: AWS account ID to run tests, e.g. `123456789012`
+- `AWS_TEST_BUCKET`: S3 bucket to run tests, e.g. `my-bucket`
+- `AWS_TEST_CROSS_REGION_BUCKET`: S3 bucket to run any cross-region operations, e.g. `my-cross-region-bucket`
+
+Here is an example script to execute integration tests in terminal:
+
+```shell
+# set environment variables
+export AWS_ACCESS_KEY_ID=ABCDEFG1234567890
+export AWS_SECRET_ACCESS_KEY=qwertyuiopasdfghjklzxcvbnm
+export AWS_REGION=us-east-1
+export AWS_CROSS_REGION=us-west-2
+export AWS_TEST_ACCOUNT_ID=123456789012
+export AWS_TEST_BUCKET=my-bucket
+export AWS_TEST_CROSS_REGION_BUCKET=my-cross-region-bucket
+
+# run all tests
+./gradlew :iceberg-aws:integrationTest
+
+# run a single test suite
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration"
+
+# run a single test
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration.testServerSideKmsEncryption"
+```
+
+## Permissions
+
+The following JSON payload describes the minimum set of permissions required to execute tests.
+Developers interested in running the test suite against a personal AWS account can use this for reference.
+The AWS Tests CI workflow uses the same set of permissions.
+To add new permissions in CI, please contact [dev@iceberg.apache.org](mailto:dev@iceberg.apache.org).
+
+```json
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Sid": "S3BucketPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:GetAccessPoint",
+ "s3:CreateAccessPoint",
+ "s3:DeleteAccessPoint",
+ "s3:ListAccessPoints",
+ "s3:ListBucket"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2"
+ ]
+ },
+ {
+ "Sid": "S3ObjectPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:PutObject",
+ "s3:GetObjectAcl",
+ "s3:GetObject",
+ "s3:DeleteObject",
+ "s3:AbortMultipartUpload"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1/*",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2/*"
+ ]
+ },
+ {
+ "Sid": "GluePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "glue:UpdateDatabase",
+ "glue:DeleteDatabase",
+ "glue:CreateTable",
+ "glue:GetTables",
+ "glue:GetTableVersions",
+ "glue:UpdateTable",
+ "glue:DeleteTable",
+ "glue:GetDatabases",
+ "glue:GetTable",
+ "glue:GetDatabase",
+ "glue:GetTableVersion",
+ "glue:CreateDatabase"
+ ],
+ "Resource": [
+ "arn:aws:glue:us-east-1:220427471354:catalog",
+ "arn:aws:glue:us-east-1:220427471354:database/iceberg_aws_ci_*",
+ "arn:aws:glue:us-east-1:220427471354:table/iceberg_aws_ci_*/*",
+ "arn:aws:glue:us-east-1:220427471354:userDefinedFunction/iceberg_aws_ci_*/*"
+ ]
+ },
+ {
+ "Sid": "STSPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "sts:TagSession",
+ "sts:AssumeRole"
+ ],
+ "Resource": [
+ "arn:aws:iam::220427471354:role/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyCreationPermissions",
Review Comment:
It is also unsafe to have KMS key creation permission exposed. If credential is exposed, a caller can start to create keys and use them to perform any operation. Similar to the assume role case, we should pre-create a KMS key to be used across tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] singhpk234 commented on a diff in pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
singhpk234 commented on code in PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#discussion_r885211402
##########
aws/src/integration/java/org/apache/iceberg/aws/dynamodb/TestDynamoDbCatalog.java:
##########
@@ -296,6 +296,6 @@ public void testDropNamespace() {
}
private static String genRandomName() {
- return UUID.randomUUID().toString().replace("-", "");
+ return "IcebergAwsCI_" + UUID.randomUUID().toString().replace("-", "");
Review Comment:
Nit : for consistency across
```suggestion
return "iceberg_aws_ci_" + UUID.randomUUID().toString().replace("-", "");
```
##########
aws/src/integration/java/org/apache/iceberg/aws/s3/TestS3FileIOIntegration.java:
##########
@@ -80,26 +82,32 @@ public class TestS3FileIOIntegration {
private static byte[] contentBytes;
private static String content;
private static String kmsKeyArn;
+ private static String kmsKeyAlias;
private static int deletionBatchSize;
private String objectKey;
private String objectUri;
@BeforeClass
public static void beforeClass() {
- clientFactory = AwsClientFactories.defaultFactory();
+ clientFactory = AwsClientFactories.from(
+ ImmutableMap.of(AwsProperties.HTTP_CLIENT_TYPE, AwsProperties.HTTP_CLIENT_TYPE_APACHE));
s3 = clientFactory.s3();
kms = clientFactory.kms();
s3Control = AwsIntegTestUtil.createS3ControlClient(AwsIntegTestUtil.testRegion());
crossRegionS3Control = AwsIntegTestUtil.createS3ControlClient(AwsIntegTestUtil.testCrossRegion());
bucketName = AwsIntegTestUtil.testBucketName();
crossRegionBucketName = AwsIntegTestUtil.testCrossRegionBucketName();
- accessPointName = UUID.randomUUID().toString();
- crossRegionAccessPointName = UUID.randomUUID().toString();
+ accessPointName = "icebergawsci-" + UUID.randomUUID();
+ crossRegionAccessPointName = "icebergawsci-" + UUID.randomUUID();
prefix = UUID.randomUUID().toString();
contentBytes = new byte[1024 * 1024 * 10];
deletionBatchSize = 3;
content = new String(contentBytes, StandardCharsets.UTF_8);
kmsKeyArn = kms.createKey().keyMetadata().arn();
+ kms.createAlias(CreateAliasRequest.builder()
+ .targetKeyId(kmsKeyArn)
+ .aliasName("alias/iceberg-aws-ci-" + UUID.randomUUID())
+ .build());
Review Comment:
is it required ? I see kmsKeyAlias declared above as well but it neither assigned this value nor used
##########
aws/src/integration/java/org/apache/iceberg/aws/s3/TestS3FileIOIntegration.java:
##########
@@ -80,26 +82,32 @@ public class TestS3FileIOIntegration {
private static byte[] contentBytes;
private static String content;
private static String kmsKeyArn;
+ private static String kmsKeyAlias;
private static int deletionBatchSize;
private String objectKey;
private String objectUri;
@BeforeClass
public static void beforeClass() {
- clientFactory = AwsClientFactories.defaultFactory();
+ clientFactory = AwsClientFactories.from(
+ ImmutableMap.of(AwsProperties.HTTP_CLIENT_TYPE, AwsProperties.HTTP_CLIENT_TYPE_APACHE));
s3 = clientFactory.s3();
kms = clientFactory.kms();
s3Control = AwsIntegTestUtil.createS3ControlClient(AwsIntegTestUtil.testRegion());
crossRegionS3Control = AwsIntegTestUtil.createS3ControlClient(AwsIntegTestUtil.testCrossRegion());
bucketName = AwsIntegTestUtil.testBucketName();
crossRegionBucketName = AwsIntegTestUtil.testCrossRegionBucketName();
- accessPointName = UUID.randomUUID().toString();
- crossRegionAccessPointName = UUID.randomUUID().toString();
+ accessPointName = "icebergawsci-" + UUID.randomUUID();
+ crossRegionAccessPointName = "icebergawsci-" + UUID.randomUUID();
Review Comment:
Nit : better to have it in a const, and used across
```suggestion
accessPointName = "iceberg-aws-ci-" + UUID.randomUUID();
crossRegionAccessPointName = "iceberg-aws-ci-" + UUID.randomUUID();
```
##########
aws/src/integration/java/org/apache/iceberg/aws/s3/TestS3FileIOIntegration.java:
##########
@@ -171,6 +179,7 @@ public void testNewOutputStream() throws Exception {
@Test
public void testNewOutputStreamWithAccessPoint() throws Exception {
+ waitForIamConsistency();
Review Comment:
[question] why do we require to sleep here ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] Infra: add AWS CI workflow configuration [iceberg]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #4855: Infra: add AWS CI workflow configuration
URL: https://github.com/apache/iceberg/pull/4855
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] nastra commented on pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
nastra commented on PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#issuecomment-1310414693
@jackye1995 any updates on this? I think it would be great to get this in
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on a diff in pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on code in PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#discussion_r885085350
##########
aws/src/integration/README.md:
##########
@@ -0,0 +1,197 @@
+<!--
+ - Licensed to the Apache Software Foundation (ASF) under one
+ - or more contributor license agreements. See the NOTICE file
+ - distributed with this work for additional information
+ - regarding copyright ownership. The ASF licenses this file
+ - to you under the Apache License, Version 2.0 (the
+ - "License"); you may not use this file except in compliance
+ - with the License. You may obtain a copy of the License at
+ -
+ - http://www.apache.org/licenses/LICENSE-2.0
+ -
+ - Unless required by applicable law or agreed to in writing,
+ - software distributed under the License is distributed on an
+ - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ - KIND, either express or implied. See the License for the
+ - specific language governing permissions and limitations
+ - under the License.
+ -->
+
+# AWS Integration Tests
+
+The AWS integration test suite runs tests against an AWS account to verify behaviors in a real AWS cloud environment.
+
+## Setup
+
+The test suite uses the [default AWS credential chain](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html) to detect the credentials used to run tests.
+For example, the AWS Tests CI workflow uses the credentials set in environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
+
+In addition, the test suite requires setting the following environment variables:
+- `AWS_REGION`: AWS region to run tests, e.g. `us-east-1`
+- `AWS_CROSS_REGION`: AWS region to run any cross-region operations, e.g. `us-west-2`
+- `AWS_TEST_ACCOUNT_ID`: AWS account ID to run tests, e.g. `123456789012`
+- `AWS_TEST_BUCKET`: S3 bucket to run tests, e.g. `my-bucket`
+- `AWS_TEST_CROSS_REGION_BUCKET`: S3 bucket to run any cross-region operations, e.g. `my-cross-region-bucket`
+
+Here is an example script to execute integration tests in terminal:
+
+```shell
+# set environment variables
+export AWS_ACCESS_KEY_ID=ABCDEFG1234567890
+export AWS_SECRET_ACCESS_KEY=qwertyuiopasdfghjklzxcvbnm
+export AWS_REGION=us-east-1
+export AWS_CROSS_REGION=us-west-2
+export AWS_TEST_ACCOUNT_ID=123456789012
+export AWS_TEST_BUCKET=my-bucket
+export AWS_TEST_CROSS_REGION_BUCKET=my-cross-region-bucket
+
+# run all tests
+./gradlew :iceberg-aws:integrationTest
+
+# run a single test suite
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration"
+
+# run a single test
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration.testServerSideKmsEncryption"
+```
+
+## Permissions
+
+The following JSON payload describes the minimum set of permissions required to execute tests.
+Developers interested in running the test suite against a personal AWS account can use this for reference.
+The AWS Tests CI workflow uses the same set of permissions.
+To add new permissions in CI, please contact [dev@iceberg.apache.org](mailto:dev@iceberg.apache.org).
+
+```json
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Sid": "S3BucketPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:GetAccessPoint",
+ "s3:CreateAccessPoint",
+ "s3:DeleteAccessPoint",
+ "s3:ListAccessPoints",
+ "s3:ListBucket"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2"
+ ]
+ },
+ {
+ "Sid": "S3ObjectPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:PutObject",
+ "s3:GetObjectAcl",
+ "s3:GetObject",
+ "s3:DeleteObject",
+ "s3:AbortMultipartUpload"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1/*",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2/*"
+ ]
+ },
+ {
+ "Sid": "GluePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "glue:UpdateDatabase",
+ "glue:DeleteDatabase",
+ "glue:CreateTable",
+ "glue:GetTables",
+ "glue:GetTableVersions",
+ "glue:UpdateTable",
+ "glue:DeleteTable",
+ "glue:GetDatabases",
+ "glue:GetTable",
+ "glue:GetDatabase",
+ "glue:GetTableVersion",
+ "glue:CreateDatabase"
+ ],
+ "Resource": [
+ "arn:aws:glue:us-east-1:220427471354:catalog",
+ "arn:aws:glue:us-east-1:220427471354:database/iceberg_aws_ci_*",
+ "arn:aws:glue:us-east-1:220427471354:table/iceberg_aws_ci_*/*",
+ "arn:aws:glue:us-east-1:220427471354:userDefinedFunction/iceberg_aws_ci_*/*"
+ ]
+ },
+ {
+ "Sid": "STSPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "sts:TagSession",
+ "sts:AssumeRole"
+ ],
+ "Resource": [
+ "arn:aws:iam::220427471354:role/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyCreationPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:CreateKey"
+ ],
+ "Resource": "*"
+ },
+ {
+ "Sid": "KMSAliasPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:CreateAlias"
+ ],
+ "Resource": [
+ "arn:aws:kms:us-east-1:220427471354:key/*",
+ "arn:aws:kms:us-east-1:220427471354:alias/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyUsagePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:Decrypt",
+ "kms:Encrypt",
+ "kms:GenerateDataKey",
+ "kms:ScheduleKeyDeletion"
+ ],
+ "Resource": "arn:aws:kms:us-east-1:220427471354:key/*",
+ "Condition": {
+ "ForAnyValue:StringLike": {
+ "kms:ResourceAliases": "alias/iceberg-aws-ci-*"
+ }
+ }
+ },
+ {
+ "Sid": "IAMPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "iam:CreateRole",
Review Comment:
looking at the policy here, we allow create role, put role policy and then assume role. This is not good because if the credential is leaked the caller will be able to create any role with any policy and then assume the role, which basically grants admin access to the account. My current thought is that we should exclude AssumeRole related tests from integration test execution and restrict access to IAM and STS. Any thoughts? @amogh-jahagirdar @rajarshisarkar @singhpk234 @xiaoxuandev
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#issuecomment-1141483714
Verified locally the credential permission works and all tests pass using IAM user `arn:aws:iam::220427471354:user/apache`:
```
yzhaoqin$ ./gradlew :iceberg-aws:integrationTest
> Task :iceberg-aws:compileIntegrationJava
> Task :iceberg-aws:integrationTest
BUILD SUCCESSFUL in 32m 4s
14 actionable tasks: 2 executed, 12 up-to-date
```
Currently CI is not able to pick up the secrets, as shown in CI result:
```
env:
JAVA_HOME_8.0.332_x64: /opt/hostedtoolcache/jdk/8.0.332/x64
JAVA_HOME: /opt/hostedtoolcache/jdk/8.0.332/x64
JAVA_HOME_8_0_332_X64: /opt/hostedtoolcache/jdk/8.0.332/x64
AWS_ACCESS_KEY_ID:
AWS_SECRET_ACCESS_KEY:
AWS_REGION: us-east-1
AWS_CROSS_REGION: us-west-2
AWS_TEST_ACCOUNT_ID: 220427471354
AWS_TEST_BUCKET: iceberg-aws-ci-220427471354-us-east-1
AWS_TEST_CROSS_REGION_BUCKET: iceberg-aws-ci-220427471354-us-west-2
```
Contacting Infra team to take a look.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on a diff in pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on code in PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#discussion_r885085350
##########
aws/src/integration/README.md:
##########
@@ -0,0 +1,197 @@
+<!--
+ - Licensed to the Apache Software Foundation (ASF) under one
+ - or more contributor license agreements. See the NOTICE file
+ - distributed with this work for additional information
+ - regarding copyright ownership. The ASF licenses this file
+ - to you under the Apache License, Version 2.0 (the
+ - "License"); you may not use this file except in compliance
+ - with the License. You may obtain a copy of the License at
+ -
+ - http://www.apache.org/licenses/LICENSE-2.0
+ -
+ - Unless required by applicable law or agreed to in writing,
+ - software distributed under the License is distributed on an
+ - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ - KIND, either express or implied. See the License for the
+ - specific language governing permissions and limitations
+ - under the License.
+ -->
+
+# AWS Integration Tests
+
+The AWS integration test suite runs tests against an AWS account to verify behaviors in a real AWS cloud environment.
+
+## Setup
+
+The test suite uses the [default AWS credential chain](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html) to detect the credentials used to run tests.
+For example, the AWS Tests CI workflow uses the credentials set in environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
+
+In addition, the test suite requires setting the following environment variables:
+- `AWS_REGION`: AWS region to run tests, e.g. `us-east-1`
+- `AWS_CROSS_REGION`: AWS region to run any cross-region operations, e.g. `us-west-2`
+- `AWS_TEST_ACCOUNT_ID`: AWS account ID to run tests, e.g. `123456789012`
+- `AWS_TEST_BUCKET`: S3 bucket to run tests, e.g. `my-bucket`
+- `AWS_TEST_CROSS_REGION_BUCKET`: S3 bucket to run any cross-region operations, e.g. `my-cross-region-bucket`
+
+Here is an example script to execute integration tests in terminal:
+
+```shell
+# set environment variables
+export AWS_ACCESS_KEY_ID=ABCDEFG1234567890
+export AWS_SECRET_ACCESS_KEY=qwertyuiopasdfghjklzxcvbnm
+export AWS_REGION=us-east-1
+export AWS_CROSS_REGION=us-west-2
+export AWS_TEST_ACCOUNT_ID=123456789012
+export AWS_TEST_BUCKET=my-bucket
+export AWS_TEST_CROSS_REGION_BUCKET=my-cross-region-bucket
+
+# run all tests
+./gradlew :iceberg-aws:integrationTest
+
+# run a single test suite
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration"
+
+# run a single test
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration.testServerSideKmsEncryption"
+```
+
+## Permissions
+
+The following JSON payload describes the minimum set of permissions required to execute tests.
+Developers interested in running the test suite against a personal AWS account can use this for reference.
+The AWS Tests CI workflow uses the same set of permissions.
+To add new permissions in CI, please contact [dev@iceberg.apache.org](mailto:dev@iceberg.apache.org).
+
+```json
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Sid": "S3BucketPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:GetAccessPoint",
+ "s3:CreateAccessPoint",
+ "s3:DeleteAccessPoint",
+ "s3:ListAccessPoints",
+ "s3:ListBucket"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2"
+ ]
+ },
+ {
+ "Sid": "S3ObjectPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:PutObject",
+ "s3:GetObjectAcl",
+ "s3:GetObject",
+ "s3:DeleteObject",
+ "s3:AbortMultipartUpload"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1/*",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2/*"
+ ]
+ },
+ {
+ "Sid": "GluePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "glue:UpdateDatabase",
+ "glue:DeleteDatabase",
+ "glue:CreateTable",
+ "glue:GetTables",
+ "glue:GetTableVersions",
+ "glue:UpdateTable",
+ "glue:DeleteTable",
+ "glue:GetDatabases",
+ "glue:GetTable",
+ "glue:GetDatabase",
+ "glue:GetTableVersion",
+ "glue:CreateDatabase"
+ ],
+ "Resource": [
+ "arn:aws:glue:us-east-1:220427471354:catalog",
+ "arn:aws:glue:us-east-1:220427471354:database/iceberg_aws_ci_*",
+ "arn:aws:glue:us-east-1:220427471354:table/iceberg_aws_ci_*/*",
+ "arn:aws:glue:us-east-1:220427471354:userDefinedFunction/iceberg_aws_ci_*/*"
+ ]
+ },
+ {
+ "Sid": "STSPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "sts:TagSession",
+ "sts:AssumeRole"
+ ],
+ "Resource": [
+ "arn:aws:iam::220427471354:role/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyCreationPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:CreateKey"
+ ],
+ "Resource": "*"
+ },
+ {
+ "Sid": "KMSAliasPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:CreateAlias"
+ ],
+ "Resource": [
+ "arn:aws:kms:us-east-1:220427471354:key/*",
+ "arn:aws:kms:us-east-1:220427471354:alias/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyUsagePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:Decrypt",
+ "kms:Encrypt",
+ "kms:GenerateDataKey",
+ "kms:ScheduleKeyDeletion"
+ ],
+ "Resource": "arn:aws:kms:us-east-1:220427471354:key/*",
+ "Condition": {
+ "ForAnyValue:StringLike": {
+ "kms:ResourceAliases": "alias/iceberg-aws-ci-*"
+ }
+ }
+ },
+ {
+ "Sid": "IAMPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "iam:CreateRole",
Review Comment:
looking at the policy here, we allow create role, put role policy and then assume role. This is not good because if the credential is leaked the caller will be able to create any role with any policy and then assume the role, which basically grants admin access to the account. My current thought is that we should exclude AssumeRole related tests from integration test execution. Any thoughts? @amogh-jahagirdar @rajarshisarkar @singhpk234 @xiaoxuandev
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on a diff in pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on code in PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#discussion_r885086573
##########
aws/src/integration/README.md:
##########
@@ -0,0 +1,197 @@
+<!--
+ - Licensed to the Apache Software Foundation (ASF) under one
+ - or more contributor license agreements. See the NOTICE file
+ - distributed with this work for additional information
+ - regarding copyright ownership. The ASF licenses this file
+ - to you under the Apache License, Version 2.0 (the
+ - "License"); you may not use this file except in compliance
+ - with the License. You may obtain a copy of the License at
+ -
+ - http://www.apache.org/licenses/LICENSE-2.0
+ -
+ - Unless required by applicable law or agreed to in writing,
+ - software distributed under the License is distributed on an
+ - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ - KIND, either express or implied. See the License for the
+ - specific language governing permissions and limitations
+ - under the License.
+ -->
+
+# AWS Integration Tests
+
+The AWS integration test suite runs tests against an AWS account to verify behaviors in a real AWS cloud environment.
+
+## Setup
+
+The test suite uses the [default AWS credential chain](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html) to detect the credentials used to run tests.
+For example, the AWS Tests CI workflow uses the credentials set in environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
+
+In addition, the test suite requires setting the following environment variables:
+- `AWS_REGION`: AWS region to run tests, e.g. `us-east-1`
+- `AWS_CROSS_REGION`: AWS region to run any cross-region operations, e.g. `us-west-2`
+- `AWS_TEST_ACCOUNT_ID`: AWS account ID to run tests, e.g. `123456789012`
+- `AWS_TEST_BUCKET`: S3 bucket to run tests, e.g. `my-bucket`
+- `AWS_TEST_CROSS_REGION_BUCKET`: S3 bucket to run any cross-region operations, e.g. `my-cross-region-bucket`
+
+Here is an example script to execute integration tests in terminal:
+
+```shell
+# set environment variables
+export AWS_ACCESS_KEY_ID=ABCDEFG1234567890
+export AWS_SECRET_ACCESS_KEY=qwertyuiopasdfghjklzxcvbnm
+export AWS_REGION=us-east-1
+export AWS_CROSS_REGION=us-west-2
+export AWS_TEST_ACCOUNT_ID=123456789012
+export AWS_TEST_BUCKET=my-bucket
+export AWS_TEST_CROSS_REGION_BUCKET=my-cross-region-bucket
+
+# run all tests
+./gradlew :iceberg-aws:integrationTest
+
+# run a single test suite
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration"
+
+# run a single test
+./gradlew :iceberg-aws:integrationTest --tests "org.apache.iceberg.aws.s3.TestS3FileIOIntegration.testServerSideKmsEncryption"
+```
+
+## Permissions
+
+The following JSON payload describes the minimum set of permissions required to execute tests.
+Developers interested in running the test suite against a personal AWS account can use this for reference.
+The AWS Tests CI workflow uses the same set of permissions.
+To add new permissions in CI, please contact [dev@iceberg.apache.org](mailto:dev@iceberg.apache.org).
+
+```json
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Sid": "S3BucketPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:GetAccessPoint",
+ "s3:CreateAccessPoint",
+ "s3:DeleteAccessPoint",
+ "s3:ListAccessPoints",
+ "s3:ListBucket"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2"
+ ]
+ },
+ {
+ "Sid": "S3ObjectPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "s3:PutObject",
+ "s3:GetObjectAcl",
+ "s3:GetObject",
+ "s3:DeleteObject",
+ "s3:AbortMultipartUpload"
+ ],
+ "Resource": [
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-east-1/*",
+ "arn:aws:s3:::iceberg-aws-ci-220427471354-us-west-2/*"
+ ]
+ },
+ {
+ "Sid": "GluePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "glue:UpdateDatabase",
+ "glue:DeleteDatabase",
+ "glue:CreateTable",
+ "glue:GetTables",
+ "glue:GetTableVersions",
+ "glue:UpdateTable",
+ "glue:DeleteTable",
+ "glue:GetDatabases",
+ "glue:GetTable",
+ "glue:GetDatabase",
+ "glue:GetTableVersion",
+ "glue:CreateDatabase"
+ ],
+ "Resource": [
+ "arn:aws:glue:us-east-1:220427471354:catalog",
+ "arn:aws:glue:us-east-1:220427471354:database/iceberg_aws_ci_*",
+ "arn:aws:glue:us-east-1:220427471354:table/iceberg_aws_ci_*/*",
+ "arn:aws:glue:us-east-1:220427471354:userDefinedFunction/iceberg_aws_ci_*/*"
+ ]
+ },
+ {
+ "Sid": "STSPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "sts:TagSession",
+ "sts:AssumeRole"
+ ],
+ "Resource": [
+ "arn:aws:iam::220427471354:role/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyCreationPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:CreateKey"
+ ],
+ "Resource": "*"
+ },
+ {
+ "Sid": "KMSAliasPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:CreateAlias"
+ ],
+ "Resource": [
+ "arn:aws:kms:us-east-1:220427471354:key/*",
+ "arn:aws:kms:us-east-1:220427471354:alias/iceberg-aws-ci-*"
+ ]
+ },
+ {
+ "Sid": "KMSKeyUsagePermissions",
+ "Effect": "Allow",
+ "Action": [
+ "kms:Decrypt",
+ "kms:Encrypt",
+ "kms:GenerateDataKey",
+ "kms:ScheduleKeyDeletion"
+ ],
+ "Resource": "arn:aws:kms:us-east-1:220427471354:key/*",
+ "Condition": {
+ "ForAnyValue:StringLike": {
+ "kms:ResourceAliases": "alias/iceberg-aws-ci-*"
+ }
+ }
+ },
+ {
+ "Sid": "IAMPermissions",
+ "Effect": "Allow",
+ "Action": [
+ "iam:CreateRole",
Review Comment:
Actually, we can pre-create an IAM role with the same set of access policies, and the CI IAM user just have one more permission of assume the created role, without permission to touch any role policy. This also avoids the need to wait for IAM consistency, so it's likely a better way.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on a diff in pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on code in PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#discussion_r880669542
##########
aws/src/integration/java/org/apache/iceberg/aws/AwsIntegTestUtil.java:
##########
@@ -89,6 +89,7 @@ public static String testAccountId() {
}
public static void cleanS3Bucket(S3Client s3, String bucketName, String prefix) {
+ // random change
Review Comment:
dummy change to trigger CI, will remove afterwards
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#issuecomment-1141343311
Added related secrets by ASF infra team: https://issues.apache.org/jira/browse/INFRA-23300
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jackye1995 commented on pull request #4855: Infra: add AWS CI workflow configuration
Posted by GitBox <gi...@apache.org>.
jackye1995 commented on PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#issuecomment-1141497977
Overall, in order to safely use the role, it seems better to start convert resources we create on the fly to be resources that are pre-created. The creation of those resources could be done through a CDK stack that is published for people to easily bootstrap necessary AWS resources and run the tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] Infra: add AWS CI workflow configuration [iceberg]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #4855:
URL: https://github.com/apache/iceberg/pull/4855#issuecomment-2295037840
This pull request has been closed due to lack of activity. This is not a judgement on the merit of the PR in any way. It is just a way of keeping the PR queue manageable. If you think that is incorrect, or the pull request requires review, you can revive the PR at any time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org