This is an automated email from the ASF dual-hosted git repository.
JingsongLi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/paimon.git
The following commit(s) were added to refs/heads/master by this push:
new 826976f0f9 [filesystem][s3] Mirror s3.session-token to
fs.s3a.session.token (#10228)
826976f0f9 is described below
commit 826976f0f9aed564723ccd3fd80a16b349e86ea7
Author: Eunbin Son <[email protected]>
AuthorDate: Sat Oct 3 18:06:14 2026 +0900
[filesystem][s3] Mirror s3.session-token to fs.s3a.session.token (#10228)
---
docs/docs/maintenance/filesystems.mdx | 9 +++
.../main/java/org/apache/paimon/s3/S3FileIO.java | 1 +
.../org/apache/paimon/s3/S3FileIOConfigTest.java | 81 ++++++++++++++++++++++
3 files changed, 91 insertions(+)
diff --git a/docs/docs/maintenance/filesystems.mdx
b/docs/docs/maintenance/filesystems.mdx
index 54f0817f99..74f8b72bd5 100644
--- a/docs/docs/maintenance/filesystems.mdx
+++ b/docs/docs/maintenance/filesystems.mdx
@@ -453,6 +453,15 @@ Please refer to [Trino
S3](https://trino.io/docs/current/object-storage/file-sys
</Tabs>
+### Temporary Credentials
+
+When using temporary credentials (for example from AWS STS), also provide the
session token
+together with the access key and secret key.
+
+```yaml
+s3.session-token: zzz
+```
+
### S3 Compliant Object Stores
The S3 Filesystem also support using S3 compliant object stores such as MinIO,
Tencent's COS and IBM's Cloud Object
diff --git
a/paimon-filesystems/paimon-s3-impl/src/main/java/org/apache/paimon/s3/S3FileIO.java
b/paimon-filesystems/paimon-s3-impl/src/main/java/org/apache/paimon/s3/S3FileIO.java
index 8272518373..339d81d822 100644
---
a/paimon-filesystems/paimon-s3-impl/src/main/java/org/apache/paimon/s3/S3FileIO.java
+++
b/paimon-filesystems/paimon-s3-impl/src/main/java/org/apache/paimon/s3/S3FileIO.java
@@ -51,6 +51,7 @@ public class S3FileIO extends HadoopCompliantFileIO {
private static final String[][] MIRRORED_CONFIG_KEYS = {
{"fs.s3a.access-key", "fs.s3a.access.key"},
{"fs.s3a.secret-key", "fs.s3a.secret.key"},
+ {"fs.s3a.session-token", "fs.s3a.session.token"},
{"fs.s3a.path-style-access", "fs.s3a.path.style.access"},
{"fs.s3a.signer-type", "fs.s3a.signing-algorithm"}
};
diff --git
a/paimon-filesystems/paimon-s3-impl/src/test/java/org/apache/paimon/s3/S3FileIOConfigTest.java
b/paimon-filesystems/paimon-s3-impl/src/test/java/org/apache/paimon/s3/S3FileIOConfigTest.java
new file mode 100644
index 0000000000..7c8d731e74
--- /dev/null
+++
b/paimon-filesystems/paimon-s3-impl/src/test/java/org/apache/paimon/s3/S3FileIOConfigTest.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.s3;
+
+import org.apache.paimon.catalog.CatalogContext;
+import org.apache.paimon.options.Options;
+
+import org.apache.hadoop.fs.Path;
+import org.apache.hadoop.fs.s3a.AWSCredentialProviderList;
+import org.apache.hadoop.fs.s3a.S3AFileSystem;
+import org.junit.jupiter.api.Test;
+import software.amazon.awssdk.auth.credentials.AwsCredentials;
+import software.amazon.awssdk.auth.credentials.AwsSessionCredentials;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Tests for the Hadoop configuration that {@link S3FileIO} derives from
catalog options. No S3
+ * backend is contacted: {@code fs.s3a.bucket.probe=0} skips the bucket
existence check and the
+ * endpoint is unroutable.
+ */
+class S3FileIOConfigTest {
+
+ @Test
+ void testHyphenSessionTokenIsMirrored() throws Exception {
+ Options options = baseOptions();
+ options.set("s3.session-token", "hyphen-token");
+
+ S3AFileSystem fs = fileSystem(options, "paimon-hyphen-token-bucket");
+
+
assertThat(fs.getConf().get("fs.s3a.session.token")).isEqualTo("hyphen-token");
+ try (AWSCredentialProviderList providers =
fs.shareCredentials("test")) {
+ AwsCredentials credentials = providers.resolveCredentials();
+ assertThat(credentials).isInstanceOf(AwsSessionCredentials.class);
+ assertThat(((AwsSessionCredentials) credentials).sessionToken())
+ .isEqualTo("hyphen-token");
+ }
+ }
+
+ @Test
+ void testDotSessionTokenIsKept() throws Exception {
+ Options options = baseOptions();
+ options.set("s3.session.token", "dot-token");
+
+ S3AFileSystem fs = fileSystem(options, "paimon-dot-token-bucket");
+
+
assertThat(fs.getConf().get("fs.s3a.session.token")).isEqualTo("dot-token");
+ }
+
+ private static S3AFileSystem fileSystem(Options options, String bucket)
throws Exception {
+ S3FileIO fileIO = new S3FileIO();
+ fileIO.configure(CatalogContext.create(options));
+ return (S3AFileSystem) fileIO.getFileSystem(new Path("s3://" + bucket
+ "/"));
+ }
+
+ private static Options baseOptions() {
+ Options options = new Options();
+ options.set("s3.bucket.probe", "0");
+ options.set("s3.endpoint", "http://localhost:1";);
+ options.set("s3.endpoint.region", "us-east-1");
+ options.set("s3.access-key", "dummy-access-key");
+ options.set("s3.secret-key", "dummy-secret-key");
+ return options;
+ }
+}
