apache / apache/fluss

RPC GetFileSystemSecurityToken supports grant table-level STS token

Open
#752 1 comment 0 reactions 1 assignee Claimed by @luoyuxia View on GitHub
Dominant language
Java
Stars
2.1k
Forks
625
Avg merge
3d 14h
Merged PRs (30d)
97

Description

### Search before asking

- [x] I searched in the [issues](https://github.com/alibaba/fluss/issues) and found nothing similar.

### Motivation

Currently, RPC GetFileSystemSecurityToken is a cluster level operation that grand user a STS temporary token for all table files on remote storage. There is a big security risk on this. And we should support table-level STS token.

### Solution

Add `repeated PbTablePath tables = 1;` in `GetFileSystemSecurityTokenRequest`. For each given table, check its ACL to ensure that the requesting user has read permission. Only after the ACL check succeeds, grant STS permission for the corresponding paths on remote storage (see how to grant directory permission for OSS, [link](https://help.aliyun.com/zh/oss/developer-reference/use-temporary-access-credentials-provided-by-sts-to-access-oss?spm=a2c4g.11186623.help-menu-31815.d_5_4_0_1.46f32f07dXVRw3)).

### Anything else?

_No response_

### Willingness to contribute

- [ ] I'm willing to submit a PR!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.