XJDKC commented on PR #1506: URL: https://github.com/apache/polaris/pull/1506#issuecomment-2867995349
Hi folks, I've updated the spec to extract the Polaris service identity info into a nested object. Right now, I’ve added support for two types of service identities: * **AWS_IAM_USER**: Polaris is configured with long-lived AWS credentials from an IAM user. It uses these credentials to assume the IAM role provided by Polaris users, then accesses the remote catalog using the subscoped temp credentials. * **AWS_IAM_USER**: Polaris retrieves temporary credentials via [Amazon ECS container credentials](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html) or [Amazon EC2 instance IAM role credentials](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html), then assumes the polaris user-provided IAM role to get new temporary credentials to access the remote catalog. Looking ahead, we may introduce additional service identity types (e.g., GCP Service Account) and aim to unify the behavior between storage config and connection config for consistency. cc: @dennishuo @dimas-b -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
