diqiu50 opened a new issue, #13012:
URL: https://github.com/apache/gravitino/issues/13012
### Version
main branch
### Describe what's wrong
A Glue catalog created without `aws-access-key-id`/`aws-secret-access-key`
(and no usable
default AWS credential chain source either) is created successfully (HTTP
200). Every
subsequent operation on that catalog then fails with a raw AWS SDK
credential-chain
exception that never mentions the connector's own `aws-access-key-id`/
`aws-secret-access-key` properties, so an operator has no way to tell what
to fix from
the error message.
### Error message and/or stacktrace
500 RuntimeException
Failed to operate object operation [LIST] under [glue_probe], reason
[Unable to load credentials from any of the providers in the chain
AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(),
EnvironmentVariableCredentialsProvider(),
WebIdentityTokenCredentialsProvider(),
ProfileCredentialsProvider(...), ContainerCredentialsProvider(),
InstanceProfileCredentialsProvider()]) : [...]]
at GlueCatalogOperations.listSchemas(GlueCatalogOperations.java:185)
Same for listTables and table load.
### How to reproduce
Create a Glue catalog with a region and warehouse but no recognised
credential
properties:
POST /api/metalakes/acme/catalogs
{"name":"glue_probe","type":"relational","provider":"glue",
"properties":{
"warehouse":"s3://<bucket>/<prefix>",
"aws-region":"us-east-2"}}
Returns 200 with the catalog created. Then:
GET /api/metalakes/acme/catalogs/glue_probe/schemas
fails with the stacktrace above.
Adding the declared properties afterwards fixes it immediately:
PUT /api/metalakes/acme/catalogs/glue_probe
{"updates":[
{"@type":"setProperty","property":"aws-access-key-id","value":"AKIA..."},
{"@type":"setProperty","property":"aws-secret-access-key","value":"<secret>"}]}
### Additional context
Two problems:
1. Nothing at catalog-creation time checks that a usable AWS credential
source exists.
2. Even at runtime, the error surfaced to the client is the AWS SDK's raw
credential-chain-exhausted message, which never names this connector's own
`aws-access-key-id`/`aws-secret-access-key` properties.
The JDBC catalogs have the same shape of defect with `jdbc-database`
(accepted at
create, fails on first use) — worth tracking separately.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
