debezium / debezium/dbz

Use the default AWS Credentials Provider [DBZ-3753]

Open
#487 0 comments 0 reactions 0 assignees View on GitHub
component/debezium-server migrated-from-jira type/enhancement
Dominant language
HTML
Stars
6
Forks
8
Avg merge
2d 19h
Merged PRs (30d)
1

Description

Migrated from [DBZ-3753](https://issues.redhat.com/browse/DBZ-3753)

Per [https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html,] when no credentials provider is configured, the SDK will iterate through several providers to to find the appropriate credentials.

If this line, [https://github.com/debezium/debezium/blob/5b757372d82f79d314f0392b516cf63245fc72a9/debezium-server/debezium-server-kinesis/src/main/java/io/debezium/server/kinesis/KinesisChangeConsumer.java#L82,] is removed, then the SDK will use this user-friendly, and flexible, method to fetch credentials, vs requiring users to create a config file. As it is, this does not work with IRSA (IAM Roles for Service Accounts), even with a custom client in the classpath, and so we are forced to create users with credentials vs using role assumption.

Contributor guide

Open the contributing guide

Research direction

Start in debezium-server/debezium-server-kinesis/src/main/java/io/debezium/server/kinesis/KinesisChangeConsumer.java at the linked credentials-provider configuration line. Read the AWS SDK default credentials-provider documentation and verify that removing the explicit provider enables the documented provider chain, including IRSA; done means Kinesis credentials can be resolved without requiring a config file.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
authentication, cloud
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.