From e354f8a5c6fc272e624ec6e208d45dfbb3437e10 Mon Sep 17 00:00:00 2001 From: Eunbin Son Date: Fri, 25 Sep 2026 17:18:39 +0900 Subject: [PATCH] [filesystem][s3] Mirror s3.session-token to fs.s3a.session.token S3FileIO mirrors the hyphenated access-key and secret-key options to the dotted keys read by S3A, but not the session token. s3.session-token was rewritten to fs.s3a.session-token, which S3A never reads, so temporary credentials were signed without their token. Mirror it like its siblings and document the option in the S3 filesystem docs. Generated-by: Claude Code --- docs/docs/maintenance/filesystems.mdx | 9 +++ .../java/org/apache/paimon/s3/S3FileIO.java | 1 + .../apache/paimon/s3/S3FileIOConfigTest.java | 81 +++++++++++++++++++ 3 files changed, 91 insertions(+) create mode 100644 paimon-filesystems/paimon-s3-impl/src/test/java/org/apache/paimon/s3/S3FileIOConfigTest.java diff --git a/docs/docs/maintenance/filesystems.mdx b/docs/docs/maintenance/filesystems.mdx index 54f0817f9991..74f8b72bd50e 100644 --- a/docs/docs/maintenance/filesystems.mdx +++ b/docs/docs/maintenance/filesystems.mdx @@ -453,6 +453,15 @@ Please refer to [Trino S3](https://trino.io/docs/current/object-storage/file-sys +### Temporary Credentials + +When using temporary credentials (for example from AWS STS), also provide the session token +together with the access key and secret key. + +```yaml +s3.session-token: zzz +``` + ### S3 Compliant Object Stores The S3 Filesystem also support using S3 compliant object stores such as MinIO, Tencent's COS and IBM's Cloud Object diff --git a/paimon-filesystems/paimon-s3-impl/src/main/java/org/apache/paimon/s3/S3FileIO.java b/paimon-filesystems/paimon-s3-impl/src/main/java/org/apache/paimon/s3/S3FileIO.java index 827251837342..339d81d822bd 100644 --- a/paimon-filesystems/paimon-s3-impl/src/main/java/org/apache/paimon/s3/S3FileIO.java +++ b/paimon-filesystems/paimon-s3-impl/src/main/java/org/apache/paimon/s3/S3FileIO.java @@ -51,6 +51,7 @@ public class S3FileIO extends HadoopCompliantFileIO { private static final String[][] MIRRORED_CONFIG_KEYS = { {"fs.s3a.access-key", "fs.s3a.access.key"}, {"fs.s3a.secret-key", "fs.s3a.secret.key"}, + {"fs.s3a.session-token", "fs.s3a.session.token"}, {"fs.s3a.path-style-access", "fs.s3a.path.style.access"}, {"fs.s3a.signer-type", "fs.s3a.signing-algorithm"} }; diff --git a/paimon-filesystems/paimon-s3-impl/src/test/java/org/apache/paimon/s3/S3FileIOConfigTest.java b/paimon-filesystems/paimon-s3-impl/src/test/java/org/apache/paimon/s3/S3FileIOConfigTest.java new file mode 100644 index 000000000000..7c8d731e741f --- /dev/null +++ b/paimon-filesystems/paimon-s3-impl/src/test/java/org/apache/paimon/s3/S3FileIOConfigTest.java @@ -0,0 +1,81 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.paimon.s3; + +import org.apache.paimon.catalog.CatalogContext; +import org.apache.paimon.options.Options; + +import org.apache.hadoop.fs.Path; +import org.apache.hadoop.fs.s3a.AWSCredentialProviderList; +import org.apache.hadoop.fs.s3a.S3AFileSystem; +import org.junit.jupiter.api.Test; +import software.amazon.awssdk.auth.credentials.AwsCredentials; +import software.amazon.awssdk.auth.credentials.AwsSessionCredentials; + +import static org.assertj.core.api.Assertions.assertThat; + +/** + * Tests for the Hadoop configuration that {@link S3FileIO} derives from catalog options. No S3 + * backend is contacted: {@code fs.s3a.bucket.probe=0} skips the bucket existence check and the + * endpoint is unroutable. + */ +class S3FileIOConfigTest { + + @Test + void testHyphenSessionTokenIsMirrored() throws Exception { + Options options = baseOptions(); + options.set("s3.session-token", "hyphen-token"); + + S3AFileSystem fs = fileSystem(options, "paimon-hyphen-token-bucket"); + + assertThat(fs.getConf().get("fs.s3a.session.token")).isEqualTo("hyphen-token"); + try (AWSCredentialProviderList providers = fs.shareCredentials("test")) { + AwsCredentials credentials = providers.resolveCredentials(); + assertThat(credentials).isInstanceOf(AwsSessionCredentials.class); + assertThat(((AwsSessionCredentials) credentials).sessionToken()) + .isEqualTo("hyphen-token"); + } + } + + @Test + void testDotSessionTokenIsKept() throws Exception { + Options options = baseOptions(); + options.set("s3.session.token", "dot-token"); + + S3AFileSystem fs = fileSystem(options, "paimon-dot-token-bucket"); + + assertThat(fs.getConf().get("fs.s3a.session.token")).isEqualTo("dot-token"); + } + + private static S3AFileSystem fileSystem(Options options, String bucket) throws Exception { + S3FileIO fileIO = new S3FileIO(); + fileIO.configure(CatalogContext.create(options)); + return (S3AFileSystem) fileIO.getFileSystem(new Path("s3://" + bucket + "/")); + } + + private static Options baseOptions() { + Options options = new Options(); + options.set("s3.bucket.probe", "0"); + options.set("s3.endpoint", "http://localhost:1"); + options.set("s3.endpoint.region", "us-east-1"); + options.set("s3.access-key", "dummy-access-key"); + options.set("s3.secret-key", "dummy-secret-key"); + return options; + } +}