googleapis / googleapis/google-cloud-java

[google-auth-library-java] Workload identity federation doesn't support full aws credential sources.

Aperta
#12,595 4 commenti 1 reazione 1 assegnatario Rivendicata da @lsirac Vedi su GitHub
priority: p2 type: feature request
Lingua principale
Java
Stelle
2.1k
Fork
1.2k
Merge medio
1g 23h
PR unite (30g)
154

Descrizione

[InternalAwsSecurityCredentialsSupplier](https://github.com/googleapis/google-auth-library-java/blob/v1.23.0/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java#L52-L55) only support environment variables or EC2 metadata server to get AWS credential.

In my usecase, I can't use workload identity federation from AWS Glue (spark) to load data to BigQuery table using spark-bigquery-connector. This spark environment has no EC2 metadata endpoint, and spark driver process' environment variables cannot be updated from a job.

#### Environment details

AWS Glue 4.0 (spark) + pyspark

#### Steps to reproduce

1. Prepare workload identity federation settings
2. run AWS Glue job

#### External references such as API reference guides
#### Any additional information below

I think AWS SDKs including aws-sdk-java provide comprehensive ways to get credential from various AWS environments, so it would be nice to use [DefaultCredentialsProvider](https://github.com/aws/aws-sdk-java-v2/blob/2.25.56/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.java) or something instead of custom implementation in this library. But I guess google team wouldn't like to use such other vendor library...

DefaultCredentialsProvider's docs

> AWS credentials provider chain that looks for credentials in this order:
> 1. Java System Properties - aws.accessKeyId and aws.secretKey
> 2. Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
> 3. Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI
> 4. Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" environment variable is set and security manager has permission to access the variable,
> 5. Instance profile credentials delivered through the Amazon EC2 metadata service

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.