cube-js / cube-js/cube

Allow dynamic assumeRoleArn in Athena driver config

Open
#10,128 1 comment 1 reaction 0 assignees View on GitHub
driver:athena help wanted
Dominant language
Rust
Stars
20.8k
Forks
2.1k
Avg merge
1d 2h
Merged PRs (30d)
181

Description

Apologies if there is another way to do this, but I tried multiple approaches with no results..

**Is your feature request related to a problem? Please describe.**
The Athena driver only reads assumeRoleArn from environment variables. In multi-tenant setups, it is not possible to pass a tenant-specific assume-role ARN via the driver config.

**Describe the solution you'd like**
Allow the driver to accept assumeRoleArn (and optionally assumeRoleExternalId) from the driver config, prioritizing it over the environment variable. Example:

```
@config("driver_factory")
def driver_factory(context):
return {
type: 'athena',
database: '...',
assumeRoleArn: 'arn:aws:iam::123456789012:role/cube-tenant-XYZ',
assumeRoleExternalId: 'optional-external-id',
accessKeyId: '...',
secretAccessKey: '...',
region: 'us-east-1',
S3OutputLocation: 's3://...',
}
```

**Describe alternatives you've considered**
I tried to generate the credentials externally and pass it to the driver but this is also not supported.

**Additional context**
This change would simplify multi-tenant deployments where each tenant uses a unique Athena role.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.