apache / apache/beam

[Bug]: Validate AWS credentials provider if provided programmatically

Open
#23,260 0 comments 0 reactions 0 assignees View on GitHub
aws bug improvement io java P3
Dominant language
Java
Stars
8.7k
Forks
4.7k
Avg merge
1d 20h
Merged PRs (30d)
196

Description

### What would you like to happen?

Users can programmatically set credential providers for AWS via options. However, only a limited subset of providers and configurations is supported. During serialization unsupported configurations are silently dropped causing confusing issues at runtime. The actual root cause is difficult to discover then.

Instead, usage of unsupported configurations should be detected and fail with an appropriate message during serialization.
Related to https://github.com/apache/beam/issues/23206

These providers rely on the system's environment to follow AWS conventions, there's no further configuration supported:

- [DefaultCredentialsProvider](https://static.javadoc.io/software.amazon.awssdk/auth/2.17.127/software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.html?is-external=true)
- [EnvironmentVariableCredentialsProvider](https://static.javadoc.io/software.amazon.awssdk/auth/2.17.127/software/amazon/awssdk/auth/credentials/EnvironmentVariableCredentialsProvider.html?is-external=true)
- [SystemPropertyCredentialsProvider](https://static.javadoc.io/software.amazon.awssdk/auth/2.17.127/software/amazon/awssdk/auth/credentials/SystemPropertyCredentialsProvider.html?is-external=true)
- [ProfileCredentialsProvider](https://static.javadoc.io/software.amazon.awssdk/auth/2.17.127/software/amazon/awssdk/auth/credentials/ProfileCredentialsProvider.html?is-external=true)
- [ContainerCredentialsProvider](https://static.javadoc.io/software.amazon.awssdk/auth/2.17.127/software/amazon/awssdk/auth/credentials/ContainerCredentialsProvider.html?is-external=true)
Example:
```
--awsCredentialsProvider={"@type": "ProfileCredentialsProvider"}
```

Some other providers require additional configuration:

- [StaticCredentialsProvider](https://static.javadoc.io/software.amazon.awssdk/auth/2.17.127/software/amazon/awssdk/auth/credentials/StaticCredentialsProvider.html?is-external=true)
- [StsAssumeRoleCredentialsProvider](https://static.javadoc.io/software.amazon.awssdk/sts/2.17.127/software/amazon/awssdk/services/sts/auth/StsAssumeRoleCredentialsProvider.html?is-external=true)
Examples:
```
--awsCredentialsProvider={
"@type": "StaticCredentialsProvider",
"awsAccessKeyId": "key_id_value",
"awsSecretKey": "secret_value"
}
```
```
--awsCredentialsProvider={
"@type": "StaticCredentialsProvider",
"awsAccessKeyId": "key_id_value",
"awsSecretKey": "secret_value",
"sessionToken": "token_value"
}
```
```
--awsCredentialsProvider={
"@type": "StsAssumeRoleCredentialsProvider",
"roleArn": "role_arn_Value",
"roleSessionName": "session_name_value",
"policy": "policy_value",
"durationSeconds": 3600
}
```

### Issue Priority

Priority: 2

### Issue Component

Component: io-java-aws

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.