seanghaeli opened a new pull request, #76639: URL: https://github.com/apache/airflow/pull/76639
With the default `credential_strategy` of `credential_chain`, `AwsDuckDBHook` never uses keys stored in the AWS connection named by `aws_conn_id`; DuckDB resolves credentials on its own, and only `config` copies the connection's credentials in ([review on #76634](https://github.com/apache/airflow/pull/76634#pullrequestreview-5808010157)). Every other AWS hook uses the connection's credentials when it has them, so this one surprises people. This adds an `auto` strategy and makes it the default: - `aws_conn_id` is `None`: `credential_chain`. - The AWS connection has an access key, a `role_arn` or a `profile_name`: `config`. - Otherwise (no credentials in the connection, or no such connection): `credential_chain`, so instance roles, IRSA, Pod Identity and the like keep working and keep the refresh. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
