googleapis / googleapis/google-cloud-java

[google-auth-library-java] Workload identity federation doesn't support full aws credential sources.

Ouverte
#12,595 4 commentaires 1 réaction 1 personne assignée Réclamée par @lsirac Voir sur GitHub
priority: p2 type: feature request
Langage dominant
Java
Étoiles
2.1k
Forks
1.2k
Merge moyen
1 j 23 h
PR mergées (30 j)
154

Description

[InternalAwsSecurityCredentialsSupplier](https://github.com/googleapis/google-auth-library-java/blob/v1.23.0/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java#L52-L55) only support environment variables or EC2 metadata server to get AWS credential.

In my usecase, I can't use workload identity federation from AWS Glue (spark) to load data to BigQuery table using spark-bigquery-connector. This spark environment has no EC2 metadata endpoint, and spark driver process' environment variables cannot be updated from a job.

#### Environment details

AWS Glue 4.0 (spark) + pyspark

#### Steps to reproduce

1. Prepare workload identity federation settings
2. run AWS Glue job

#### External references such as API reference guides
#### Any additional information below

I think AWS SDKs including aws-sdk-java provide comprehensive ways to get credential from various AWS environments, so it would be nice to use [DefaultCredentialsProvider](https://github.com/aws/aws-sdk-java-v2/blob/2.25.56/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.java) or something instead of custom implementation in this library. But I guess google team wouldn't like to use such other vendor library...

DefaultCredentialsProvider's docs

> AWS credentials provider chain that looks for credentials in this order:
> 1. Java System Properties - aws.accessKeyId and aws.secretKey
> 2. Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
> 3. Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI
> 4. Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" environment variable is set and security manager has permission to access the variable,
> 5. Instance profile credentials delivered through the Amazon EC2 metadata service

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.