amaechler commented on code in PR #20540:
URL: https://github.com/apache/druid/pull/20540#discussion_r4338819501
##########
extensions-core/s3-extensions/src/main/java/org/apache/druid/data/input/s3/S3InputSource.java:
##########
@@ -129,7 +129,9 @@ public S3InputSource(
awsEndpointConfig,
awsClientConfig,
s3InputSourceConfig,
- null
+ null,
+ s3ClientBuilder.getIntermediateRoleConfig(),
+ s3ClientBuilder.getIntermediateRoleEndpointConfig()
Review Comment:
In this setup the spec can't be deserialized at all, with or without
`druid.s3.intermediateAssumeRoleArn`. `S3InputSource` injects the process-level
`ServerSideEncryptingAmazonS3`, and building it throws `SdkClientException:
Unable to load region from any of the providers in the chain` when there is no
`druid.s3.endpoint.signingRegion` and no `AWS_REGION`, `aws.region`, profile or
IMDS region. I checked this on this branch by deserializing an `s3` spec that
sets `endpointConfig.signingRegion` through the `S3StorageDruidModule` wiring:
it fails the same way with and without the intermediate role, and succeeds in
both cases once `druid.s3.endpoint.signingRegion` is set. So falling back to
the spec's region wouldn't make this case work, and using the spec's region
would send the operator's intermediate AssumeRole to the bucket's Region, which
breaks for opt-in Regions the intermediate role's account hasn't enabled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
