ChenSammi commented on code in PR #11121: URL: https://github.com/apache/ozone/pull/11121#discussion_r3913056717
########## hadoop-hdds/docs/content/design/ozone-sts.md: ########## @@ -66,6 +67,11 @@ return value of the AssumeRole call will be temporary credentials consisting of an IAM policy is specified, the temporary credential will have the permissions comprising the intersection of the role permissions and the IAM policy permissions. **Note:** If the IAM policy is specified and does not grant any permissions, then the generated temporary credentials won't have any permissions and will essentially be useless. +- [GetCallerIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html) returns the account, +ARN, and user ID for the caller credentials used to sign the request. Ozone uses a static account ID of `123456789012`. +For permanent S3 credentials, `UserId` is the resolved Kerberos principal and `Arn` is `arn:aws:iam::123456789012:user/<kerberosShortName>` +where `<kerberosShortName>` is the short username of the Kerberos principal. For STS temporary credentials, `UserId` is +the `AssumedRoleId` and `Arn` is the assumed-role user ARN from the session token. Review Comment: "3.4 SessionToken Format" needs an update too. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
