feat: Load credential while role_arn has been specified (#13875)

* feat: Load credential while role_arn has been specified Signed-off-by: Xuanwo <[email protected]> * Fix tests Signed-off-by: Xuanwo <[email protected]> --------- Signed-off-by: Xuanwo <[email protected]>
databendlabs · Nov 30, 2023 · cbf641c · cbf641c
1 parent d9200db
commit cbf641c
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/src/query/sql/src/planner/binder/location.rs b/src/query/sql/src/planner/binder/location.rs
@@ -175,6 +175,10 @@ fn parse_s3_params(l: &mut UriLocation, root: String) -> Result<StorageParams> {
         )
     })?;
 
+    // If role_arn is empty and we don't allow allow insecure, we should disable credential loader.
+    let disable_credential_loader =
+        role_arn.is_empty() && !GlobalConfig::instance().storage.allow_insecure;
+
     let sp = StorageParams::S3(StorageS3Config {
         endpoint_url: secure_omission(endpoint),
         region,
@@ -184,9 +188,7 @@ fn parse_s3_params(l: &mut UriLocation, root: String) -> Result<StorageParams> {
         security_token,
         master_key,
         root,
-        // Disable credential load by default.
-        // TODO(xuanwo): we should support AssumeRole.
-        disable_credential_loader: !GlobalConfig::instance().storage.allow_insecure,
+        disable_credential_loader,
         enable_virtual_host_style,
         role_arn,
         external_id,

diff --git a/src/query/sql/tests/location.rs b/src/query/sql/tests/location.rs
@@ -287,7 +287,7 @@ async fn test_parse_uri_location() -> Result<()> {
                     security_token: "".to_string(),
                     master_key: "".to_string(),
                     root: "/tmp/".to_string(),
-                    disable_credential_loader: true,
+                    disable_credential_loader: false,
                     enable_virtual_host_style: false,
                     role_arn: "aws::iam::xxxx".to_string(),
                     external_id: "".to_string(),