Add role-based access to Glue catalog#90825
Conversation
|
Workflow [PR], commit [a44cf47] Summary: ❌
|
e3e81b1 to
6d28e16
Compare
There was a problem hiding this comment.
Pull request overview
This PR adds support for AWS role-based authentication in the Glue catalog integration. Users can now specify an IAM role ARN and optional session name for assuming roles when accessing AWS Glue, enabling more flexible and secure authentication patterns.
Key changes:
- Added two new settings:
aws_role_arnandaws_role_session_namefor role-based authentication - Updated credential provider chain to support STS AssumeRole when role ARN is specified
- Applied settings consistently across storage and database layers
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/Storages/ObjectStorage/DataLakes/DataLakeStorageSettings.h | Added role ARN and session name settings declarations for storage layer |
| src/Storages/ObjectStorage/DataLakes/DataLakeConfiguration.h | Added extern declarations and settings initialization for role-based auth |
| src/Databases/DataLake/ICatalog.h | Added role ARN and session name fields to CatalogSettings struct |
| src/Databases/DataLake/ICatalog.cpp | Updated allChanged() to include role settings in settings changes |
| src/Databases/DataLake/GlueCatalog.cpp | Implemented STS AssumeRole credential provider when role ARN is specified |
| src/Databases/DataLake/DatabaseDataLakeSettings.cpp | Added role settings declarations at database level |
| src/Databases/DataLake/DatabaseDataLake.cpp | Initialized role settings from database configuration |
kssenii
left a comment
There was a problem hiding this comment.
btw as we do have integration tests for glue catalog + mocks for role-bases access tests, may be it is possible to add a test?
|
Thanks for the PR @antonio2368, we are a Clickhouse Cloud customer and our policy is against using long lived AWS credentials so we could really use this role based Glue Catalog integration 🙏 |
|
@kssenii good thing I added the test because it showed me that the implementation was a bit more complex. |
40f8227 to
a44cf47
Compare
|
@jessedobbelaere thanks for expressing interest in this feature! Implementation should be done, I will see how soon can we get it on our Cloud. |
Add role-based access to Glue catalog
Add role-based access to Glue catalog
|
@antonio2368 Do you know when this feature will make it into a tagged release? I tried v26.1.3.52-stable which was released 3 days ago but it doesn't seem to have this feature still. |
|
@emaadali it should be available in 26.2, which is in few days |
25.8 Antalya backport of ClickHouse#90825: Add role-based access to Glue catalog
26.1 Antalya backport of ClickHouse#90825: Add role-based access to Glue catalog
Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):
Add role-based access to Glue catalog. Use settings
aws_role_arnand, optionally,aws_role_session_name.Documentation entry for user-facing changes