Skip to content

Commit

Permalink
[#6031] extend S3 credential provider to support S3 fileset operations (
Browse files Browse the repository at this point in the history
#6033)

### What changes were proposed in this pull request?

add get file meta permission for fileset operation

### Why are the changes needed?

Fix: #6031 

### Does this PR introduce _any_ user-facing change?
no

### How was this patch tested?
pass fileset tests
  • Loading branch information
FANNG1 authored Jan 2, 2025
1 parent ebe553f commit c158b75
Showing 1 changed file with 9 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
package org.apache.gravitino.s3.credential;

import java.net.URI;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import java.util.Objects;
Expand Down Expand Up @@ -49,6 +50,7 @@

/** Generates S3 token to access S3 data. */
public class S3TokenProvider implements CredentialProvider {

private StsClient stsClient;
private String roleArn;
private String externalID;
Expand Down Expand Up @@ -134,6 +136,7 @@ private IamPolicy createPolicy(
allowGetObjectStatementBuilder.addResource(
IamResource.create(getS3UriWithArn(arnPrefix, uri)));
String bucketArn = arnPrefix + getBucketName(uri);
String rawPath = trimLeadingSlash(uri.getPath());
bucketListStatmentBuilder
.computeIfAbsent(
bucketArn,
Expand All @@ -142,10 +145,14 @@ private IamPolicy createPolicy(
.effect(IamEffect.ALLOW)
.addAction("s3:ListBucket")
.addResource(key))
.addCondition(
.addConditions(
IamConditionOperator.STRING_LIKE,
"s3:prefix",
concatPathWithSep(trimLeadingSlash(uri.getPath()), "*", "/"));
Arrays.asList(
// Get raw path metadata information for AWS hadoop connector
rawPath,
// Listing objects in raw path
concatPathWithSep(rawPath, "*", "/")));
bucketGetLocationStatmentBuilder.computeIfAbsent(
bucketArn,
key ->
Expand Down

0 comments on commit c158b75

Please sign in to comment.