googleapis / googleapis/google-cloud-java

[google-auth-library-java] Workload identity federation doesn't support full aws credential sources.

未关闭
#12,595 4 条评论 1 个 reaction 已指派 1 人 已被 @lsirac 认领 在 GitHub 查看
priority: p2 type: feature request
主要语言
Java
星标
2.1k
派生
1.2k
平均合并
1 天 23 小时
30 天内合并 PR
154

描述

[InternalAwsSecurityCredentialsSupplier](https://github.com/googleapis/google-auth-library-java/blob/v1.23.0/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java#L52-L55) only support environment variables or EC2 metadata server to get AWS credential.

In my usecase, I can't use workload identity federation from AWS Glue (spark) to load data to BigQuery table using spark-bigquery-connector. This spark environment has no EC2 metadata endpoint, and spark driver process' environment variables cannot be updated from a job.

#### Environment details

AWS Glue 4.0 (spark) + pyspark

#### Steps to reproduce

1. Prepare workload identity federation settings
2. run AWS Glue job

#### External references such as API reference guides
#### Any additional information below

I think AWS SDKs including aws-sdk-java provide comprehensive ways to get credential from various AWS environments, so it would be nice to use [DefaultCredentialsProvider](https://github.com/aws/aws-sdk-java-v2/blob/2.25.56/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.java) or something instead of custom implementation in this library. But I guess google team wouldn't like to use such other vendor library...

DefaultCredentialsProvider's docs

> AWS credentials provider chain that looks for credentials in this order:
> 1. Java System Properties - aws.accessKeyId and aws.secretKey
> 2. Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
> 3. Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI
> 4. Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" environment variable is set and security manager has permission to access the variable,
> 5. Instance profile credentials delivered through the Amazon EC2 metadata service

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。