iremcaginyurtturk opened a new pull request, #1999:
URL: https://github.com/apache/iceberg-go/pull/1999
## Problem
The REST catalog's SigV4 signer builds its `aws.Config` only from
`config.LoadDefaultConfig` (the AWS default credential chain), so the `s3.*`
credential properties passed to the catalog are ignored for request signing.
As a result, connecting to an AWS SigV4 REST catalog (**S3 Tables** at
`s3tables.<region>.amazonaws.com/iceberg`, or the **Glue** Iceberg REST
endpoint) fails with `no EC2 IMDS role found` unless
`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`/`AWS_SESSION_TOKEN` are also
present in the environment — even when the caller already supplied those
credentials via `s3.access-key-id` / `s3.secret-access-key` /
`s3.session-token`.
This is the same gap tracked for the Python client in
apache/iceberg-python#2070.
## Fix
In `createSession`, when no explicit `aws.Config` was provided
(`WithAwsConfig`), build a static credentials provider from the `s3.*`
credential properties when a key pair is present, and fall back to the default
chain otherwise. An explicitly provided `aws.Config` still takes precedence.
```go
if creds, ok := staticCredsFromProps(opts.additionalProps); ok {
cfg.Credentials = creds
}
```
## Testing
- New unit test `TestStaticCredsFromProps` (full key pair → provider with
session token; lone access key → no provider; empty → no provider).
- Verified end-to-end against a live AWS S3 Tables bucket:
create/replace/merge succeed with credentials supplied only via catalog
properties and **no** `AWS_*` environment variables.
- `go test ./catalog/rest/` passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
