foundationdb icon indicating copy to clipboard operation
foundationdb copied to clipboard

Add support for assuming a role in the provided AWS config

Open johscheuer opened this issue 2 years ago • 3 comments

This is currently a limitation of the AWS C++ SDK and needs some changes to the FDBAWSCredentialsProvider.cpp , one of the issues in the AWS C++ SDK had a "solution": https://github.com/aws/aws-sdk-cpp/issues/150#issuecomment-538548438. It would be great to add support for assuming a role with the source_profile to allow such configurations to make use of the SDK auth.

There are some other limitation around the AWS C++ SDK that should be documented like: https://github.com/aws/aws-sdk-cpp/issues/1963.

johscheuer avatar Aug 25 '23 15:08 johscheuer

#10880 fixes this.

jzhou77 avatar Sep 08 '23 00:09 jzhou77

the proposed change in github issue is to use a AWSCredentialsProvider who consists of multiple credentials. While AWS client can accepts a AWSCredentialsProvider OR a single credential, and AWSClient can find the correct credential smartly when used. Unfortunately our code only gets a single credential and use it for a connection, so I guess refactoring our code to use AWS client is the way to go.. Let me know AWS: S3Client constructor is called here it finally goes to AWSClient constructor here when it is used, it get different creds by name here Our code S3BlobStoreEndpoint get a single credential and construct a S3BlobStoreEndpoint::Credentials to build connection here

flowguru avatar Sep 08 '23 17:09 flowguru

so it seems a major refactor on fdb side to adopt aws client is needed

flowguru avatar Sep 08 '23 17:09 flowguru