duckdb / duckdb/duckdb-aws

S3 Secret auto refresh not working

Open
#97 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
65
Forks
44
Avg merge
10d 11h
Merged PRs (30d)
2

Description

We create secret and the S3 fetch works fine and the timestamp of S3 credentials match with the timestamp of the temporary credentials. The issue is post the credentials expiry time, the fetch is still probably happening with the same old credential and we are hitting 400 errors. If we put in new secret things start to work again. We are using EC2 IAM Role and does auto refresh work in this case as documented [here](https://duckdb.org/docs/stable/core_extensions/aws.html)

```
CREATE SECRET env_test (
TYPE s3,
PROVIDER credential_chain,
REFRESH auto
);
```

Image

Image

Image

Image

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the documented CREATE SECRET env_test configuration with an EC2 IAM Role, then observe S3 fetches before and after the temporary credentials expire. Compare the credential timestamps and 400 errors; done means the credential chain refreshes automatically after expiry without recreating the secret.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.