Allow setting the Glue STS endpoint and region #14412
Conversation
alexjo2144
force-pushed
the
glue/sts-endpoint
branch
from
e7a12be to
817e4a8
Compare
| provider = new STSAssumeRoleSessionCredentialsProvider | ||
| .Builder(config.getIamRole().get(), "trino-session") | ||
| .withExternalId(config.getExternalId().orElse(null)) | ||
| .withLongLivedCredentialsProvider(provider) |
There was a problem hiding this comment.
Note for reviewers: withLongLivedCredentialsProvider is deprecated and cannot be used along with withStsClient, that's why this change is here.
| @@ -606,6 +606,13 @@ Property Name Description | |||
| ``hive.metastore.glue.endpoint-url`` Glue API endpoint URL (optional). | |||
| Example: ``https://glue.us-east-1.amazonaws.com`` | |||
|
|
|||
| ``hive.metastore.glue.sts.region`` AWS region of the STS service to authenticate with. This is | |||
There was a problem hiding this comment.
Do we need a new setting? why this cannot be based on hive.metastore.glue.region?
There was a problem hiding this comment.
It is necessary if we want to support situations like using Minio's STS with AWS Glue.
There's also this: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html
TLDR: By default STS uses the global endpoint which is always available. You can set a region explicitly to reduce latency but STS is not available in all regions. So if we just use the Glue region but you're deployed in one of those places, for example eu-south-1, you need to use either the global endpoint or a diferent region with STS available.
I believe this means we need the setting.
|
Test PR with secrets: #14444 |
|
|
Description
Add config properties to specify the STS service to use when authenticating to AWS Glue. This is needed for situations like deploying in GovCloud where the global STS endpoint should not be used.
Non-technical explanation
Add options which allow for Glue to be used in situations like GovCloud.
Release notes
( ) This is not user-visible or docs only and no release notes are required.
( ) Release notes are required, please propose a release note for me.
(x) Release notes are required, with the following suggested text: