Skip to content

[tiered-storage] Allow AWS credentials to be refreshed #9387

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Feb 1, 2021
Merged

[tiered-storage] Allow AWS credentials to be refreshed #9387

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e417eb1
[tiered-storage] Allow AWS credentials to be refreshed
addisonj Jan 28, 2021
9f6303b
address feedback
addisonj Feb 1, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 30 additions & 20 deletions ...n/java/org/apache/bookkeeper/mledger/offload/jcloud/provider/JCloudBlobStoreProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import static org.apache.bookkeeper.mledger.offload.jcloud.provider.TieredStorageConfiguration.S3_ROLE_SESSION_NAME_FIELD;

import com.amazonaws.auth.AWSCredentials;
import com.amazonaws.auth.AWSCredentialsProvider;
import com.amazonaws.auth.AWSSessionCredentials;
import com.amazonaws.auth.DefaultAWSCredentialsProviderChain;
import com.amazonaws.auth.STSAssumeRoleSessionCredentialsProvider;
Expand Down Expand Up @@ -304,33 +305,42 @@ public ProviderMetadata getProviderMetadata() {

static final CredentialBuilder AWS_CREDENTIAL_BUILDER = (TieredStorageConfiguration config) -> {
if (config.getCredentials() == null) {
AWSCredentials awsCredentials = null;
final AWSCredentialsProvider authChain;
try {
if (Strings.isNullOrEmpty(config.getConfigProperty(S3_ROLE_FIELD))) {
awsCredentials = DefaultAWSCredentialsProviderChain.getInstance().getCredentials();
authChain = DefaultAWSCredentialsProviderChain.getInstance();
} else {
awsCredentials =
authChain =
new STSAssumeRoleSessionCredentialsProvider.Builder(
config.getConfigProperty(S3_ROLE_FIELD),
config.getConfigProperty(S3_ROLE_SESSION_NAME_FIELD)
).build().getCredentials();
}

if (awsCredentials instanceof AWSSessionCredentials) {
// if we have session credentials, we need to send the session token
// this allows us to support EC2 metadata credentials
SessionCredentials sessionCredentials = SessionCredentials.builder()
.accessKeyId(awsCredentials.getAWSAccessKeyId())
.secretAccessKey(awsCredentials.getAWSSecretKey())
.sessionToken(((AWSSessionCredentials) awsCredentials).getSessionToken())
.build();
config.setProviderCredentials(() -> sessionCredentials);
} else {
Credentials credentials = new Credentials(
awsCredentials.getAWSAccessKeyId(), awsCredentials.getAWSSecretKey());
config.setProviderCredentials(() -> credentials);
).build();
}

// Important! Delay the building of actual credentials
// until later to support tokens that may be refreshed
// such as all session tokens
config.setProviderCredentials(() -> {
AWSCredentials newCreds = authChain.getCredentials();
Credentials jcloudCred = null;

if (newCreds instanceof AWSSessionCredentials) {
// if we have session credentials, we need to send the session token
// this allows us to support EC2 metadata credentials
jcloudCred = SessionCredentials.builder()
.accessKeyId(newCreds.getAWSAccessKeyId())
.secretAccessKey(newCreds.getAWSSecretKey())
.sessionToken(((AWSSessionCredentials) newCreds).getSessionToken())
.build();
} else {
// in the event we hit this branch, we likely don't have expiring
// credentials, however, this still allows for the user to update
// profiles creds or some other mechanism
jcloudCred = new Credentials(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will we, or should we still go into this if branch in our new implementation?

newCreds.getAWSAccessKeyId(), newCreds.getAWSSecretKey());
}
return jcloudCred;
});
} catch (Exception e) {
// allowed, some mock s3 service do not need credential
log.warn("Exception when get credentials for s3 ", e);
Expand Down Expand Up @@ -391,4 +401,4 @@ public ProviderMetadata getProviderMetadata() {
config.setProviderCredentials(() -> credentials);
};

}
}
54 changes: 32 additions & 22 deletions ...rg/apache/bookkeeper/mledger/offload/jcloud/provider/TieredStorageConfigurationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import org.apache.pulsar.jcloud.shade.com.google.common.base.Supplier;

import org.jclouds.domain.Credentials;
import org.testng.annotations.Test;

public class TieredStorageConfigurationTests {
Expand Down Expand Up @@ -113,7 +115,36 @@ public final void awsS3BackwardCompatiblePropertiesTest() {
assertEquals(config.getReadBufferSizeInBytes(), new Integer(500));
assertEquals(config.getServiceEndpoint(), "http://some-url:9093");
}


/**
* Confirm that with AWS we create different instances of the credentials
* object each time we call the supplier, this ensure that we get fresh credentials
* if the aws credential provider changes
*/
@Test
public final void awsS3CredsProviderTest() {
Map<String, String> map = new HashMap<>();
map.put(TieredStorageConfiguration.BLOB_STORE_PROVIDER_KEY, JCloudBlobStoreProvider.AWS_S3.getDriver());
TieredStorageConfiguration config = new TieredStorageConfiguration(map);

// set the aws properties with fake creds so the defaultProviderChain works
System.setProperty("aws.accessKeyId", "fakeid1");
System.setProperty("aws.secretKey", "fakekey1");
Credentials creds1 = config.getProviderCredentials().get();
assertEquals(creds1.identity, "fakeid1");
assertEquals(creds1.credential, "fakekey1");

// reset the properties and ensure we get different values by re-evaluating the chain
System.setProperty("aws.accessKeyId", "fakeid2");
System.setProperty("aws.secretKey", "fakekey2");
Credentials creds2 = config.getProviderCredentials().get();
assertEquals(creds2.identity, "fakeid2");
assertEquals(creds2.credential, "fakekey2");

System.clearProperty("aws.accessKeyId");
System.clearProperty("aws.secretKey");
}

/**
* Confirm that both property options are available for GCS
*/
Expand Down Expand Up @@ -177,25 +208,4 @@ public final void gcsBackwardCompatiblePropertiesTest() {
assertEquals(config.getMaxBlockSizeInBytes(), new Integer(12));
assertEquals(config.getReadBufferSizeInBytes(), new Integer(500));
}

/**
* Confirm that we can configure AWS using the old properties
*/
@Test
public final void s3BackwardCompatiblePropertiesTest() {
Map<String, String> map = new HashMap<String,String>();
map.put(TieredStorageConfiguration.BLOB_STORE_PROVIDER_KEY, JCloudBlobStoreProvider.AWS_S3.getDriver());
map.put(BC_S3_BUCKET, "test bucket");
map.put(BC_S3_ENDPOINT, "http://some-url:9093");
map.put(BC_S3_MAX_BLOCK_SIZE, "12");
map.put(BC_S3_READ_BUFFER_SIZE, "500");
map.put(BC_S3_REGION, "test region");
TieredStorageConfiguration config = new TieredStorageConfiguration(map);

assertEquals(config.getRegion(), "test region");
assertEquals(config.getBucket(), "test bucket");
assertEquals(config.getMaxBlockSizeInBytes(), new Integer(12));
assertEquals(config.getReadBufferSizeInBytes(), new Integer(500));
assertEquals(config.getServiceEndpoint(), "http://some-url:9093");
}
}