omar-massfih commented on code in PR #75810:
URL: https://github.com/apache/airflow/pull/75810#discussion_r4402075584
##########
providers/snowflake/src/airflow/providers/snowflake/utils/_rest_auth.py:
##########
@@ -154,6 +171,60 @@ def get_token(self) -> SnowflakeRestToken:
token = self._jwt_generator.get_token()
return SnowflakeRestToken(token=token, token_type="KEYPAIR_JWT")
+ def _get_workload_identity_token(self, conn_config: dict[str, Any]) ->
SnowflakeRestToken:
+ """
+ Return a Workload Identity Federation token, fetching a new one when
the cached one expires.
+
+ The caller must hold ``self._lock``.
+ """
+ if self._wif_token is not None and time.time() <
self._wif_token_expires_at:
+ return self._wif_token
+
+ provider_name = str(conn_config["workload_identity_provider"]).upper()
Review Comment:
Fixed. WIF validates the destination before cloud token fetching, OIDC file
reads, and cache reuse. Added malformed-host, suffix-boundary, and
environment-allowlist regression tests.
##########
providers/snowflake/src/airflow/providers/snowflake/utils/_rest_auth.py:
##########
@@ -163,6 +234,64 @@ def build_auth_headers(self) -> dict[str, str]:
}
+def _fetch_aws_identity_token() -> str:
+ """Return the JWT from ``sts:GetWebIdentityToken`` for the workload's AWS
identity."""
+ try:
+ import boto3
+ except ImportError as e:
+ raise ValueError(
+ "Workload Identity Federation with the AWS provider requires the
boto3 package."
+ ) from e
+ sts = boto3.client("sts")
Review Comment:
Fixed. Resolution now follows `AWS_REGION`, `AWS_DEFAULT_REGION`, then EC2
metadata, with a clear error when unresolved. STS uses the explicit region and
regional endpoints even with legacy settings.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
