(hudi) branch master updated: [HUDI-7699] Support STS external ids and configurable session names in the AWS StsAssumeRoleCredentialsProvider (#11134)

[danny0405]

This is an automated email from the ASF dual-hosted git repository.

danny0405 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hudi.git


The following commit(s) were added to refs/heads/master by this push:
     new 9860e943c63 [HUDI-7699] Support STS external ids and configurable 
session names in the AWS StsAssumeRoleCredentialsProvider (#11134)
9860e943c63 is described below

commit 9860e943c638c11302964d943a0d2f2f46a77051
Author: Ian Streeter <ian.stree...@gmx.com>
AuthorDate: Thu May 9 00:17:29 2024 +0100

    [HUDI-7699] Support STS external ids and configurable session names in the 
AWS StsAssumeRoleCredentialsProvider (#11134)
    
    [HUDI-6695](https://issues.apache.org/jira/browse/HUDI-6695) added a AWS 
credentials provider to support assuming a role when syncing to Glue.
    
    We use Hudi in a multi-tenant environment, and our customers give us 
delegated access to their Glue catalog.  In this multi-tenant setup it is 
important to use [an external 
ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html)
 to improve security when assuming IAM roles.
    
    Furthermore, the STS session name is currently hard-coded to "hoodie".  It 
is helpful for us to have configurable session names so we have better 
tracability of what entities are creating STS sessions in the cloud.
    
    Currently, the assumed role is configured with the `hoodie.aws.role.arn` 
config property.  I would like to add the following extra optional config 
properties, which will be used by the 
`HoodieConfigAWSAssumedRoleCredentialsProvider`:
    
    - `hoodie.aws.role.external.id`
    - `hoodie.aws.role.session.name`
---
 ...dieConfigAWSAssumedRoleCredentialsProvider.java |  5 +++-
 .../org/apache/hudi/config/HoodieAWSConfig.java    | 34 +++++++++++++++++++++-
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git 
a/hudi-aws/src/main/java/org/apache/hudi/aws/credentials/HoodieConfigAWSAssumedRoleCredentialsProvider.java
 
b/hudi-aws/src/main/java/org/apache/hudi/aws/credentials/HoodieConfigAWSAssumedRoleCredentialsProvider.java
index 89c31b8a08b..0333e973da7 100644
--- 
a/hudi-aws/src/main/java/org/apache/hudi/aws/credentials/HoodieConfigAWSAssumedRoleCredentialsProvider.java
+++ 
b/hudi-aws/src/main/java/org/apache/hudi/aws/credentials/HoodieConfigAWSAssumedRoleCredentialsProvider.java
@@ -41,9 +41,12 @@ public class HoodieConfigAWSAssumedRoleCredentialsProvider 
implements AwsCredent
 
   public HoodieConfigAWSAssumedRoleCredentialsProvider(Properties props) {
     String roleArn = 
props.getProperty(HoodieAWSConfig.AWS_ASSUME_ROLE_ARN.key());
+    String externalId = 
props.getProperty(HoodieAWSConfig.AWS_ASSUME_ROLE_EXTERNAL_ID.key());
+    String sessionName = 
props.getProperty(HoodieAWSConfig.AWS_ASSUME_ROLE_SESSION_NAME.key());
     AssumeRoleRequest req = AssumeRoleRequest.builder()
           .roleArn(roleArn)
-          .roleSessionName("hoodie")
+          .roleSessionName(sessionName)
+          .externalId(externalId)
           .build();
     StsClient stsClient = StsClient.builder().build();
 
diff --git a/hudi-aws/src/main/java/org/apache/hudi/config/HoodieAWSConfig.java 
b/hudi-aws/src/main/java/org/apache/hudi/config/HoodieAWSConfig.java
index c74d5fdfa0b..8a13652e0fa 100644
--- a/hudi-aws/src/main/java/org/apache/hudi/config/HoodieAWSConfig.java
+++ b/hudi-aws/src/main/java/org/apache/hudi/config/HoodieAWSConfig.java
@@ -73,9 +73,23 @@ public class HoodieAWSConfig extends HoodieConfig {
           .key("hoodie.aws.role.arn")
           .noDefaultValue()
           .markAdvanced()
-          .sinceVersion("0.13.2")
+          .sinceVersion("0.15.0")
           .withDocumentation("AWS Role ARN to assume");
 
+  public static final ConfigProperty<String> AWS_ASSUME_ROLE_SESSION_NAME = 
ConfigProperty
+          .key("hoodie.aws.role.session.name")
+          .defaultValue("hoodie")
+          .markAdvanced()
+          .sinceVersion("0.15.0")
+          .withDocumentation("Session name to use when assuming the AWS Role");
+
+  public static final ConfigProperty<String> AWS_ASSUME_ROLE_EXTERNAL_ID = 
ConfigProperty
+          .key("hoodie.aws.role.external.id")
+          .noDefaultValue()
+          .markAdvanced()
+          .sinceVersion("0.15.0")
+          .withDocumentation("External ID use when assuming the AWS Role");
+
   public static final ConfigProperty<String> AWS_GLUE_ENDPOINT = ConfigProperty
           .key("hoodie.aws.glue.endpoint")
           .noDefaultValue()
@@ -114,6 +128,14 @@ public class HoodieAWSConfig extends HoodieConfig {
     return getString(AWS_ASSUME_ROLE_ARN);
   }
 
+  public String getAWSAssumeRoleExternalID() {
+    return getString(AWS_ASSUME_ROLE_EXTERNAL_ID);
+  }
+
+  public String getAWSAssumeRoleSessionName() {
+    return getString(AWS_ASSUME_ROLE_SESSION_NAME);
+  }
+
   public static class Builder {
 
     private final HoodieAWSConfig awsConfig = new HoodieAWSConfig();
@@ -150,6 +172,16 @@ public class HoodieAWSConfig extends HoodieConfig {
       return this;
     }
 
+    public HoodieAWSConfig.Builder withAssumeRoleExternalID(String 
assumeRoleExternalID) {
+      awsConfig.setValue(AWS_ASSUME_ROLE_EXTERNAL_ID, assumeRoleExternalID);
+      return this;
+    }
+
+    public HoodieAWSConfig.Builder withAssumeRoleSessionName(String 
assumeRoleSessionName) {
+      awsConfig.setValue(AWS_ASSUME_ROLE_SESSION_NAME, assumeRoleSessionName);
+      return this;
+    }
+
     public Builder withDynamoDBTable(String dynamoDbTableName) {
       awsConfig.setValue(DYNAMODB_LOCK_TABLE_NAME, dynamoDbTableName);
       return this;