linkedin / linkedin/openhouse

[Feature] Add Data Access Token vending in OpenHouse

Open
#242 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feat
Dominant language
Java
Stars
399
Forks
80
Avg merge
3d 23h
Merged PRs (30d)
15

Description

### Willingness to contribute

{"label"=>"Yes. I can contribute a fix for this bug independently.", "value"=>"independent"}

### Feature Request Proposal

Cloud blob storage providers like AWS and Azure have "data access token", tokens that provide authorized access to S3 storage / Azure Blob Storage, support via AWS S3 Access Grants and Azure Shared Access Signatures respectively.

As a catalog, OpenHouse can vend these "data access tokens" for accessing storage to a specific table and users would subsequently leverage these credentials to access their storage.

### Motivation

> #### What is the use case for this feature?
This would put OpenHouse in the data access control place and remove the need to synchronize data access control with underlying blob storage.

### What component(s) does this feature affect?

- [X] `Table Service`: This is the RESTful catalog service that stores table metadata. `:services:tables`
- [ ] `Jobs Service`: This is the job orchestrator that submits data services for table maintenance. `:services:jobs`
- [ ] `Data Services`: This is the jobs that performs table maintenance. `apps:spark`
- [ ] `Iceberg internal catalog`: This is the internal Iceberg catalog for OpenHouse Catalog Service. `:iceberg:openhouse`
- [ ] `Spark Client Integration`: This is the Apache Spark integration for OpenHouse catalog. `:integration:spark`
- [ ] `Documentation`: This is the documentation for OpenHouse. `docs`
- [ ] `Local Docker`: This is the local Docker environment for OpenHouse. `infra/recipes/docker-compose`
- [ ] `Other`: Please specify the component.

### Details

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Table Service RESTful catalog service in :services:tables and review how table access is currently represented. Define the scope for vending table-specific AWS S3 Access Grants and Azure Shared Access Signatures; done means the service can issue authorized storage credentials for a specific table.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, azure
Domain
api, backend-api-design, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.