lemon0333 commented on issue #2747: URL: https://github.com/apache/iceberg-python/issues/2747#issuecomment-5398277885
I'd like to pick this up if no one is already on it. **Proposed approach** — extend the existing assume-role mechanism (currently honored only by the S3 FileIO via `client.role-arn` / `client.role-session-name`, see `pyiceberg/io/pyarrow.py`) to the boto3 sessions built by `GlueCatalog` and `DynamoDbCatalog`: - In each catalog's `boto3.Session` construction path (`pyiceberg/catalog/glue.py`, `pyiceberg/catalog/dynamodb.py`), when a role ARN is configured, perform an STS `AssumeRole` from the base session and use the returned temporary credentials for the Glue/DynamoDB client. - Resolve the role config with the same precedence already used for the other `client.*` properties: a service-prefixed override (`glue.role-arn` / `dynamodb.role-arn`, `glue.role-session-name` / `dynamodb.role-session-name`) falling back to the unified `client.role-arn` / `client.role-session-name`. This mirrors how `glue.region` → `client.region` etc. already work. - Default behavior (no role ARN set) stays exactly as-is. - Tests with `moto` (mock STS + Glue + DynamoDB) asserting the client is built from the assumed-role credentials. Since the thread doesn't have a maintainer response yet, could a maintainer confirm this direction — and in particular whether you'd like the service-prefixed properties (`glue.role-arn` / `dynamodb.role-arn`) in addition to the unified `client.role-arn`, or the unified ones only? Happy to adjust the naming to match your conventions. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
