[ https://issues.apache.org/jira/browse/HADOOP-15583?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16551447#comment-16551447 ]
Steve Loughran edited comment on HADOOP-15583 at 7/21/18 12:19 AM: ------------------------------------------------------------------- FWIW, access denied exceptions in Dynamo come back as 400 + error text, *not a 403 error*. This'll be handled in this patch, mapping it to AccessDeniedException {code} [ERROR] testRestrictedRename(org.apache.hadoop.fs.s3a.auth.ITestAssumeRole) Time elapsed: 9.933 s <<< ERROR! java.nio.file.AccessDeniedException: hwdev-steve-ireland-new: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:sts::980678866538:assumed-role/stevel-s3-restricted/valid is not authorized to perform: dynamodb:DescribeTable on resource: arn:aws:dynamodb:eu-west-1:980678866538:table/hwdev-steve-ireland-new (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: ORVTQPTD262GPBK7ILH83BE4D7VV4KQNSO5AEMVJF66Q9ASUAAJG) at org.apache.hadoop.fs.s3a.S3AUtils.translateDynamoDBException(S3AUtils.java:406) at org.apache.hadoop.fs.s3a.S3AUtils.translateException(S3AUtils.java:192) at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore.initTable(DynamoDBMetadataStore.java:971) at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore.initialize(DynamoDBMetadataStore.java:312) at org.apache.hadoop.fs.s3a.s3guard.S3Guard.getMetadataStore(S3Guard.java:99) at org.apache.hadoop.fs.s3a.S3AFileSystem.initialize(S3AFileSystem.java:339) at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3354) at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:474) at org.apache.hadoop.fs.Path.getFileSystem(Path.java:361) at org.apache.hadoop.fs.s3a.auth.ITestAssumeRole.executeRestrictedRename(ITestAssumeRole.java:471) at org.apache.hadoop.fs.s3a.auth.ITestAssumeRole.testRestrictedRename(ITestAssumeRole.java:437) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47) at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12) at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44) at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17) at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26) at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27) at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55) at org.junit.internal.runners.statements.FailOnTimeout$StatementThread.run(FailOnTimeout.java:74) Caused by: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:sts::980678866538:assumed-role/stevel-s3-restricted/valid is not authorized to perform: dynamodb:DescribeTable on resource: arn:aws:dynamodb:eu-west-1:980678866538:table/hwdev-steve-ireland-new (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: ORVTQPTD262GPBK7ILH83BE4D7VV4KQNSO5AEMVJF66Q9ASUAAJG) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1639) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1304) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1056) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:743) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:717) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667) at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649) at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.doInvoke(AmazonDynamoDBClient.java:2925) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.invoke(AmazonDynamoDBClient.java:2901) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.executeDescribeTable(AmazonDynamoDBClient.java:1515) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.describeTable(AmazonDynamoDBClient.java:1491) at com.amazonaws.services.dynamodbv2.document.Table.describe(Table.java:137) at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore.initTable(DynamoDBMetadataStore.java:925) ... 20 more {code} was (Author: ste...@apache.org): FWIW, access denied exceptions in Dynamo come back as 500 + error text, *not a 4xx error*. This'll be handled in this patch, mapping it to AccessDeniedException {code} [ERROR] testRestrictedRename(org.apache.hadoop.fs.s3a.auth.ITestAssumeRole) Time elapsed: 9.933 s <<< ERROR! java.nio.file.AccessDeniedException: hwdev-steve-ireland-new: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:sts::980678866538:assumed-role/stevel-s3-restricted/valid is not authorized to perform: dynamodb:DescribeTable on resource: arn:aws:dynamodb:eu-west-1:980678866538:table/hwdev-steve-ireland-new (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: ORVTQPTD262GPBK7ILH83BE4D7VV4KQNSO5AEMVJF66Q9ASUAAJG) at org.apache.hadoop.fs.s3a.S3AUtils.translateDynamoDBException(S3AUtils.java:406) at org.apache.hadoop.fs.s3a.S3AUtils.translateException(S3AUtils.java:192) at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore.initTable(DynamoDBMetadataStore.java:971) at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore.initialize(DynamoDBMetadataStore.java:312) at org.apache.hadoop.fs.s3a.s3guard.S3Guard.getMetadataStore(S3Guard.java:99) at org.apache.hadoop.fs.s3a.S3AFileSystem.initialize(S3AFileSystem.java:339) at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3354) at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:474) at org.apache.hadoop.fs.Path.getFileSystem(Path.java:361) at org.apache.hadoop.fs.s3a.auth.ITestAssumeRole.executeRestrictedRename(ITestAssumeRole.java:471) at org.apache.hadoop.fs.s3a.auth.ITestAssumeRole.testRestrictedRename(ITestAssumeRole.java:437) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47) at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12) at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44) at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17) at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26) at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27) at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55) at org.junit.internal.runners.statements.FailOnTimeout$StatementThread.run(FailOnTimeout.java:74) Caused by: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:sts::980678866538:assumed-role/stevel-s3-restricted/valid is not authorized to perform: dynamodb:DescribeTable on resource: arn:aws:dynamodb:eu-west-1:980678866538:table/hwdev-steve-ireland-new (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: ORVTQPTD262GPBK7ILH83BE4D7VV4KQNSO5AEMVJF66Q9ASUAAJG) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1639) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1304) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1056) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:743) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:717) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667) at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649) at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.doInvoke(AmazonDynamoDBClient.java:2925) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.invoke(AmazonDynamoDBClient.java:2901) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.executeDescribeTable(AmazonDynamoDBClient.java:1515) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.describeTable(AmazonDynamoDBClient.java:1491) at com.amazonaws.services.dynamodbv2.document.Table.describe(Table.java:137) at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore.initTable(DynamoDBMetadataStore.java:925) ... 20 more {code} > Stabilize S3A Assumed Role support > ---------------------------------- > > Key: HADOOP-15583 > URL: https://issues.apache.org/jira/browse/HADOOP-15583 > Project: Hadoop Common > Issue Type: Sub-task > Components: fs/s3 > Affects Versions: 3.1.0 > Reporter: Steve Loughran > Assignee: Steve Loughran > Priority: Blocker > Attachments: HADOOP-15583-001.patch, HADOOP-15583-002.patch > > > started off just on sharing credentials across S3A and S3Guard, but in the > process it has grown to becoming one of stabilising the assumed role support > so it can be used for more than just testing. > Was: "S3Guard to get AWS Credential chain from S3AFS; credentials closed() on > shutdown" > h3. Issue: lack of auth chain sharing causes ddb and s3 to get out of sync > S3Guard builds its DDB auth chain itself, which stops it having to worry > about being created standalone vs part of an S3AFS, but it means its > authenticators are in a separate chain. > When you are using short-lived assumed roles or other session credentials > updated in the S3A FS authentication chain, you need that same set of > credentials picked up by DDB. Otherwise, at best you are doubling load, at > worse: the DDB connector may not get refreshed credentials. > Proposed: {{DynamoDBClientFactory.createDynamoDBClient()}} to take an > optional ref to aws credentials. If set: don't create a new set. > There's one little complication here: our {{AWSCredentialProviderList}} list > is autocloseable; it's close() will go through all children and close them. > Apparently the AWS S3 client (And hopefully the DDB client) will close this > when they are closed themselves. If DDB has the same set of credentials as > the FS, then there could be trouble if they are closed in one place when the > other still wants to use them. > Solution; have a use count the uses of the credentials list, starting at one: > every close() call decrements, and when this hits zero the cleanup is kicked > off > h3. Issue: {{AssumedRoleCredentialProvider}} connector to STS not picking up > the s3a connection settings, including proxy. > h3. issue: we're not using getPassword() to get user/password for proxy > binding for STS. Fix: use that and pass down the bucket ref for per-bucket > secrets in a JCEKS file. > h3. Issue; hard to debug what's going wrong :) -- This message was sent by Atlassian JIRA (v7.6.3#76005) --------------------------------------------------------------------- To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org