apache / apache/polaris

Rest API to create a table using "STS AssumeRole with a Permanent Access Key Pair (No OIDC)" failed with exception on "VAST Data"

Open
#5,099 8 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
2.1k
Forks
522
Avg merge
2d 1h
Merged PRs (30d)
140

Description

### Describe the bug

I am receiving the following error when invoke create table using polaris RestAPI. I am using Sts in VAST (underlying S3 storage). I am using 1.5.0 release tag
{
"error": {
"message": "Failed to get subscoped credentials: A header you provided implies functionality that is not implemented. (Service: Sts, Status Code: 501, Request ID: 1eb1d101f4978f, Extended Request ID: 1eb1d101f4978f) (SDK Attempt Count: 1)",
"type": "UnprocessableEntityException",
"code": 422
}
}

### To Reproduce

1. Invoking the API https:///api/catalog/v1//namespaces//tables/ by enabling header "X-Iceberg-Access-Delegation"
2. Catalog information
{
"type": "INTERNAL",
"name": "scct_catalog_v3",
"properties": {
"s3.access-key-id": "xxxx",
"s3.secret-access-key": "xxx",
"default-base-location": "s3://purchase-order/warehouse-v2",
"s3.endpoint": "https://obj-centraldtq.storage.lowes.com:443"
},
"createTimestamp": 1784361133731,
"lastUpdateTimestamp": 1784361133731,
"entityVersion": 1,
"storageConfigInfo": {
"roleArn": "arn:vast:iam::xxx:role/control-tower-iamrole",
"externalId": "xxx",
"allowedKmsKeys": [],
"region": "us-east-1",
"endpoint": "https://xxx:443",
"stsEndpoint": "https://xxx",
"endpointInternal": "https://xxx:443",
"pathStyleAccess": true,
"kmsUnavailable": true,
"storageType": "S3",
"allowedLocations": [
"s3://purchase-order/warehouse-v2"
]
}
}

### Actual Behavior

_No response_

### Expected Behavior

_No response_

### Additional context

_No response_

### System information

OS: Linux
Objedt Storage: S3, VAST, us-east1

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the create-table request at the catalog REST endpoint with X-Iceberg-Access-Delegation enabled, using the 1.5.0 release and the supplied VAST STS configuration. Trace the failed subscoped-credentials operation and compare its STS request with VAST's supported behavior; done means the request succeeds or the incompatibility is clearly identified and covered by an appropriate regression check.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
api, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.