[Feature] Add Data Access Token vending in OpenHouse
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 399
- Forks
- 80
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 15
Description
### Willingness to contribute
{"label"=>"Yes. I can contribute a fix for this bug independently.", "value"=>"independent"}
### Feature Request Proposal
Cloud blob storage providers like AWS and Azure have "data access token", tokens that provide authorized access to S3 storage / Azure Blob Storage, support via AWS S3 Access Grants and Azure Shared Access Signatures respectively.
As a catalog, OpenHouse can vend these "data access tokens" for accessing storage to a specific table and users would subsequently leverage these credentials to access their storage.
### Motivation
> #### What is the use case for this feature?
This would put OpenHouse in the data access control place and remove the need to synchronize data access control with underlying blob storage.
### What component(s) does this feature affect?
- [X] `Table Service`: This is the RESTful catalog service that stores table metadata. `:services:tables`
- [ ] `Jobs Service`: This is the job orchestrator that submits data services for table maintenance. `:services:jobs`
- [ ] `Data Services`: This is the jobs that performs table maintenance. `apps:spark`
- [ ] `Iceberg internal catalog`: This is the internal Iceberg catalog for OpenHouse Catalog Service. `:iceberg:openhouse`
- [ ] `Spark Client Integration`: This is the Apache Spark integration for OpenHouse catalog. `:integration:spark`
- [ ] `Documentation`: This is the documentation for OpenHouse. `docs`
- [ ] `Local Docker`: This is the local Docker environment for OpenHouse. `infra/recipes/docker-compose`
- [ ] `Other`: Please specify the component.
### Details
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Table Service RESTful catalog service in :services:tables and review how table access is currently represented. Define the scope for vending table-specific AWS S3 Access Grants and Azure Shared Access Signatures; done means the service can issue authorized storage credentials for a specific table.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, azure
- Domain
- api, backend-api-design, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100