apache / apache/fluss

[fs] s3.assumed.role.arn doesn't actually assume the role for S3 file I/O

Open
#3,761 1 comment 0 reactions 1 assignee Claimed by @qzyu999 View on GitHub
Dominant language
Java
Stars
2.2k
Forks
627
Avg merge
2d 20h
Merged PRs (30d)
119

Description

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

If you set s3.assumed.role.arn in server.yaml, you'd expect Fluss to do S3 I/O as that role. It doesn't. The plugin just logs "Using default AWS credential chain with AssumeRole" and returns, so S3A never gets an AssumedRoleCredentialProvider, so all remote.data.dir writes (remote log, KV snapshots, lake offsets) run with whatever ambient identity the default chain finds. `
The ARN is only used for delegation token generation.

We hit this while validating the Glue docs (#3424) on ECS Fargate, tiering wrote with the task's ambient credentials, not the configured role.

### Willingness to contribute

- [ ] I'm willing to submit a PR!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.