apache / apache/kyuubi

[FEATURE] Support aws iam for authentication / authorization

Open
#4,118 3 comments 0 reactions 0 assignees View on GitHub
kind:feature priority:major
Dominant language
Scala
Stars
2.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the feature

Provide a way for users to :
- get access to data based on their users IAM roles
- login thought access token, id/secret or other IAM stuff

### Motivation

currently AFAIK, only user/password and kerberos are provided

### Describe the solution

kyuubi itself could have a role which could assume other role. For a given user, kyuubi could check if the role it provided as jdbc parameter can be assumed and passed to the engine (spark supports IAM roles)

### Additional context

_No response_

### Are you willing to submit PR?

- [X] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve.
- [ ] No. I cannot submit a PR at this time.

Contributor guide

Open the contributing guide

Research direction

The issue names no files, tests, or entry points. Start by reviewing Kyuubi's existing user/password and Kerberos authentication paths, then compare them with Spark's IAM role support. Done would require a defined approach for IAM login or role assumption and passing the resulting access to the engine.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, spark
Domain
authentication, authorization, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.