influxdata / influxdata/influxdb
AWS authentication conventions not fully implemented
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Steps to reproduce:__
List the minimal actions needed to reproduce the behaviour.
1. Log in to AWS by cli: `aws sso login`
2. Run influxdb3 with an s3 bucket
__Expected behaviour:__
Describe what you expected to happen.
influxdb3 should integrate with the AWS SDK for authentication and authenticate based on the previous AWS login, **without** needing to export the standard AWS environmental variables of AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
__Actual behaviour:__
Describe What actually happened.
Service fails with authentication issues
__Additional Information:__
The desired behaviour is seen in the aws cli client itself and also, for example, terraform. Neither require the environment variables to be exported in order to utilise the existing AWS session. This also means that authentication is not limited to the scope of a single bash session, an aws login in one terminal results in (for example) terraform being able to access AWS from other terminals too.
This is the same behaviour I observed with datafusion-cli, as suggested by @alamb, suggesting that there is a common root cause here, presumably in object_store, as influxdb3 uses object_store's AmazonS3Builder interface to establish connectivity S3.
Contributor guide
Research direction
Start by inspecting the object_store AmazonS3Builder authentication path used by influxdb3, then compare it with the AWS CLI and Terraform behavior after aws sso login. Reproduce the failure with an S3 bucket and verify that influxdb3 authenticates without AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, rust
- Domain
- backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100