roryqi opened a new pull request, #13987: URL: https://github.com/apache/gravitino/pull/13987
### What changes were proposed in this pull request? - Do not vend unscoped `aws-irsa` credentials for catalog-level requests. Keep table-path requests scoped by an STS session policy. - Normalize AWS and OSS STS role session names to fit provider character and length limits while retaining a stable user identifier. - Reject `wasb(s)` locations before vending an ADLS SAS that Iceberg would not look up. - Include every requested path in the OSS `ListObjects` policy for a bucket. - Add regression tests and update the IRSA credential-vending documentation. ### Why are the changes needed? Catalog-level IRSA requests could expose the assumed role's full permissions. Invalid session names prevented credential generation for some users. Blob-host ADLS locations could receive unusable SAS properties, and OSS requests with multiple paths omitted listing access to later paths. `main` already rejects ADLS paths outside the configured storage account, so this PR preserves that existing behavior while addressing the remaining issues. Fix: #13977 ### Does this PR introduce _any_ user-facing change? Catalog-level requests no longer return `aws-irsa` credentials. `wasb(s)` locations now fail with a clear unsupported-location error. STS session names change to valid, bounded names. No property keys change. ### How was this patch tested? - Ran `:common:test`, `:bundles:aws:test`, `:bundles:azure:test`, and `:bundles:aliyun:test` with focused regression classes for the changed behavior and `-PskipITs`. - Ran Spotless on the four changed Java modules. - Ran `git diff --cached --check` before committing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
