Use the default AWS Credentials Provider [DBZ-3753]
- Dominant language
- HTML
- Stars
- 6
- Forks
- 8
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 1
Description
Migrated from [DBZ-3753](https://issues.redhat.com/browse/DBZ-3753)
Per [https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html,] when no credentials provider is configured, the SDK will iterate through several providers to to find the appropriate credentials.
If this line, [https://github.com/debezium/debezium/blob/5b757372d82f79d314f0392b516cf63245fc72a9/debezium-server/debezium-server-kinesis/src/main/java/io/debezium/server/kinesis/KinesisChangeConsumer.java#L82,] is removed, then the SDK will use this user-friendly, and flexible, method to fetch credentials, vs requiring users to create a config file. As it is, this does not work with IRSA (IAM Roles for Service Accounts), even with a custom client in the classpath, and so we are forced to create users with credentials vs using role assumption.
Contributor guide
Research direction
Start in debezium-server/debezium-server-kinesis/src/main/java/io/debezium/server/kinesis/KinesisChangeConsumer.java at the linked credentials-provider configuration line. Read the AWS SDK default credentials-provider documentation and verify that removing the explicit provider enables the documented provider chain, including IRSA; done means Kinesis credentials can be resolved without requiring a config file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100