David-Banquet opened a new pull request, #4132: URL: https://github.com/apache/iceberg-python/pull/4132
Closes #2747 # Rationale for this change This picks up #3838 by @lemon0333, which was closed for inactivity before anyone reviewed it (see my [comment there](https://github.com/apache/iceberg-python/pull/3838#issuecomment-6147026774)). Their commit is kept as is, with them as author. `client.role-arn` / `client.role-session-name` are honored by the S3 FileIO but ignored by the Glue and DynamoDB catalogs, which build their own `boto3.Session`. #3838 extends them to both catalogs, with service-prefixed overrides (`glue.role-arn`, `dynamodb.role-arn`, and the matching `*-role-session-name`) falling back to the `client.*` ones, like the other session properties. The second commit changes one thing: #3838 built the catalog session from the static credentials of a single `AssumeRole` call, so a long-lived catalog started failing with `ExpiredToken` once the role session ended (one hour by default). The session now uses botocore's `AssumeRoleCredentialFetcher` with `DeferredRefreshableCredentials`: the role is assumed on first use and again before the credentials expire, the same way botocore handles `role_arn` in an AWS profile. # Are these changes tested? Yes, with `moto`: - the 7 tests from #3838 (unified and prefixed properties, no assume-role without an ARN, temporary credentials); - a new test that advances the clock into botocore's refresh window and checks that the Glue catalog assumes the role again. It fails on the #3838 version. ``` uv run python -m pytest tests/catalog/test_glue.py tests/catalog/test_dynamodb.py # 99 passed uv run prek run --files <changed files> # all passed ``` # Are there any user-facing changes? Yes: the Glue and DynamoDB catalogs now honor `client.role-arn` / `client.role-session-name`, plus the new `glue.role-arn`, `glue.role-session-name`, `dynamodb.role-arn` and `dynamodb.role-session-name`. Documented in `configuration.md`. Nothing changes when no role ARN is set. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
