You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The TaskFileIOSupplier class always tries to get subscoped credentials and doesn't take into consideration the SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION configuration parameter.
In certain setups, we should be able to load a FileIO without credentials.
To Reproduce
Assuming you're using AWS s3 as storage type for your catalog:
Set SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION to true and run polaris
Send a Purge request from a client that doesn't try to delete the files on the client side (e.g. pyiceberg)
Look at the traces and see the call to aws.AssumeRole coming from TaskFileIOSupplier
Actual Behavior
Polaris tries to get subscoped credentials for the FileIO
Expected Behavior
Polaris should load a FileIO without credentials
Additional context
No response
System information
No response
The text was updated successfully, but these errors were encountered:
Is this a possible security vulnerability?
Describe the bug
The TaskFileIOSupplier class always tries to get subscoped credentials and doesn't take into consideration the SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION configuration parameter.
In certain setups, we should be able to load a FileIO without credentials.
To Reproduce
Assuming you're using AWS s3 as storage type for your catalog:
Actual Behavior
Polaris tries to get subscoped credentials for the FileIO
Expected Behavior
Polaris should load a FileIO without credentials
Additional context
No response
System information
No response
The text was updated successfully, but these errors were encountered: