googleapis / googleapis/google-cloud-java

[google-auth-library-java] Workload identity federation doesn't support full aws credential sources.

Đang mở
#12,595 4 bình luận 1 reaction 1 người được giao Được @lsirac nhận Xem trên GitHub
priority: p2 type: feature request
Ngôn ngữ chính
Java
Star
2.1k
Fork
1.2k
Merge trung bình
1 ngày 23 giờ
Pull request đã merge (30 ngày)
154

Mô tả

[InternalAwsSecurityCredentialsSupplier](https://github.com/googleapis/google-auth-library-java/blob/v1.23.0/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java#L52-L55) only support environment variables or EC2 metadata server to get AWS credential.

In my usecase, I can't use workload identity federation from AWS Glue (spark) to load data to BigQuery table using spark-bigquery-connector. This spark environment has no EC2 metadata endpoint, and spark driver process' environment variables cannot be updated from a job.

#### Environment details

AWS Glue 4.0 (spark) + pyspark

#### Steps to reproduce

1. Prepare workload identity federation settings
2. run AWS Glue job

#### External references such as API reference guides
#### Any additional information below

I think AWS SDKs including aws-sdk-java provide comprehensive ways to get credential from various AWS environments, so it would be nice to use [DefaultCredentialsProvider](https://github.com/aws/aws-sdk-java-v2/blob/2.25.56/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.java) or something instead of custom implementation in this library. But I guess google team wouldn't like to use such other vendor library...

DefaultCredentialsProvider's docs

> AWS credentials provider chain that looks for credentials in this order:
> 1. Java System Properties - aws.accessKeyId and aws.secretKey
> 2. Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
> 3. Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI
> 4. Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" environment variable is set and security manager has permission to access the variable,
> 5. Instance profile credentials delivered through the Amazon EC2 metadata service

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.