[fs] s3.assumed.role.arn doesn't actually assume the role for S3 file I/O
- Dominant language
- Java
- Stars
- 2.2k
- Forks
- 627
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 119
Description
### Search before asking
- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.
### Description
If you set s3.assumed.role.arn in server.yaml, you'd expect Fluss to do S3 I/O as that role. It doesn't. The plugin just logs "Using default AWS credential chain with AssumeRole" and returns, so S3A never gets an AssumedRoleCredentialProvider, so all remote.data.dir writes (remote log, KV snapshots, lake offsets) run with whatever ambient identity the default chain finds. `
The ARN is only used for delegation token generation.
We hit this while validating the Glue docs (#3424) on ECS Fargate, tiering wrote with the task's ambient credentials, not the configured role.
### Willingness to contribute
- [ ] I'm willing to submit a PR!
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.