RPC GetFileSystemSecurityToken supports grant table-level STS token
- Dominant language
- Java
- Stars
- 2.1k
- Forks
- 625
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 97
Description
### Search before asking
- [x] I searched in the [issues](https://github.com/alibaba/fluss/issues) and found nothing similar.
### Motivation
Currently, RPC GetFileSystemSecurityToken is a cluster level operation that grand user a STS temporary token for all table files on remote storage. There is a big security risk on this. And we should support table-level STS token.
### Solution
Add `repeated PbTablePath tables = 1;` in `GetFileSystemSecurityTokenRequest`. For each given table, check its ACL to ensure that the requesting user has read permission. Only after the ACL check succeeds, grant STS permission for the corresponding paths on remote storage (see how to grant directory permission for OSS, [link](https://help.aliyun.com/zh/oss/developer-reference/use-temporary-access-credentials-provided-by-sts-to-access-oss?spm=a2c4g.11186623.help-menu-31815.d_5_4_0_1.46f32f07dXVRw3)).
### Anything else?
_No response_
### Willingness to contribute
- [ ] I'm willing to submit a PR!
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.