Repository navigation
[Cherry-pick to branch-1.3] [#13977] fix(credential): Scope and validate cloud credentials (#13987) - #14129
Open
github-actions[bot] wants to merge 2 commits into
Open
[Cherry-pick to branch-1.3] [#13977] fix(credential): Scope and validate cloud credentials (#13987)#14129github-actions[bot] wants to merge 2 commits into
github-actions[bot] wants to merge 2 commits into
Conversation
### What changes were proposed in this pull request? - Do not vend unscoped `aws-irsa` credentials for catalog-level requests. Keep table-path requests scoped by an STS session policy. - Normalize AWS and OSS STS role session names to fit provider character and length limits while retaining a stable user identifier. - Reject `wasb(s)` locations before vending an ADLS SAS that Iceberg would not look up. - Include every requested path in the OSS `ListObjects` policy for a bucket. - Add regression tests and update the IRSA credential-vending documentation. ### Why are the changes needed? Catalog-level IRSA requests could expose the assumed role's full permissions. Invalid session names prevented credential generation for some users. Blob-host ADLS locations could receive unusable SAS properties, and OSS requests with multiple paths omitted listing access to later paths. `main` already rejects ADLS paths outside the configured storage account, so this PR preserves that existing behavior while addressing the remaining issues. Fix: #13977 ### Does this PR introduce _any_ user-facing change? Catalog-level requests no longer return `aws-irsa` credentials. `wasb(s)` locations now fail with a clear unsupported-location error. STS session names change to valid, bounded names. No property keys change. ### How was this patch tested? - Ran `:common:test`, `:bundles:aws:test`, `:bundles:azure:test`, and `:bundles:aliyun:test` with focused regression classes for the changed behavior and `-PskipITs`. - Ran Spotless on the four changed Java modules. - Ran `git diff --cached --check` before committing. # Conflicts: # docs/security/credential-vending.md
github-actions
Bot
added
cherry-pick
roryqi
changed the title
roryqi
removed
the
cherry-pick-conflict
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick information
bbb73f1a656842969ab603f1a5978a6c5d2acb60)branch-1.3What changes were proposed in this pull request?
wasb(s)locations, and include every requested OSS path in the listing policy.Why are the changes needed?
Catalog-level IRSA requests could expose the role's full permissions. Invalid session names, unsupported ADLS locations, and incomplete OSS listing policies could prevent correct credential vending.
Fix: #13977
Does this PR introduce any user-facing change?
Catalog-level requests no longer return
aws-irsacredentials.wasb(s)locations fail with an unsupported-location error. STS session names are normalized. No property keys change.How was this patch tested?
:common:test,:bundles:aws:test,:bundles:azure:test, and:bundles:aliyun:test, plus Spotless.git diff --cached --checkand confirmed no conflict markers remain.