googleapis / googleapis/google-cloud-java
[google-auth-library-java] Workload identity federation doesn't support full aws credential sources.
- Lingua principale
- Java
- Stelle
- 2.1k
- Fork
- 1.2k
- Merge medio
- 1g 23h
- PR unite (30g)
- 154
Descrizione
[InternalAwsSecurityCredentialsSupplier](https://github.com/googleapis/google-auth-library-java/blob/v1.23.0/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java#L52-L55) only support environment variables or EC2 metadata server to get AWS credential.
In my usecase, I can't use workload identity federation from AWS Glue (spark) to load data to BigQuery table using spark-bigquery-connector. This spark environment has no EC2 metadata endpoint, and spark driver process' environment variables cannot be updated from a job.
#### Environment details
AWS Glue 4.0 (spark) + pyspark
#### Steps to reproduce
1. Prepare workload identity federation settings
2. run AWS Glue job
#### External references such as API reference guides
#### Any additional information below
I think AWS SDKs including aws-sdk-java provide comprehensive ways to get credential from various AWS environments, so it would be nice to use [DefaultCredentialsProvider](https://github.com/aws/aws-sdk-java-v2/blob/2.25.56/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.java) or something instead of custom implementation in this library. But I guess google team wouldn't like to use such other vendor library...
DefaultCredentialsProvider's docs
> AWS credentials provider chain that looks for credentials in this order:
> 1. Java System Properties - aws.accessKeyId and aws.secretKey
> 2. Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
> 3. Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI
> 4. Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" environment variable is set and security manager has permission to access the variable,
> 5. Instance profile credentials delivered through the Amazon EC2 metadata service
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.