amaechler commented on code in PR #20540:
URL: https://github.com/apache/druid/pull/20540#discussion_r4338819811
##########
extensions-core/s3-extensions/src/main/java/org/apache/druid/storage/s3/ServerSideEncryptingAmazonS3.java:
##########
@@ -411,6 +413,15 @@ public static ServerSideEncryptingAmazonS3.Builder builder(
// Apply assume role if configured
if (!Strings.isNullOrEmpty(assumeRoleArn)) {
+ if (s3InputSourceConfig == null ||
!s3InputSourceConfig.isCredentialsConfigured()) {
+ credentialsProvider = maybeAssumeIntermediateRole(
Review Comment:
The intermediate role is only meant as a hop before `assumeRoleArn`
(`s3.md`: "inserts one role in between"). Without `assumeRoleArn`, the export
uses the process's own S3 client, the same as on master, so applying the
intermediate role there would change how existing exports without a role
authenticate. I agree the MSQ reference row reads as if it also applies without
`assumeRoleArn`, so I left a wording suggestion on
`docs/multi-stage-query/reference.md`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
