Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FILES() command doesn't work with AWS SSO credentials #52955

Open
matthinea opened this issue Nov 15, 2024 · 0 comments
Open

FILES() command doesn't work with AWS SSO credentials #52955

matthinea opened this issue Nov 15, 2024 · 0 comments
Labels
type/bug Something isn't working

Comments

@matthinea
Copy link

matthinea commented Nov 15, 2024

Steps to reproduce:

  1. Use aws sso login to get AWS credentials
  2. Run aws configure export-credentials --profile default
  3. Query an S3 location that your credentials should have access to using the FILES() DSL and the AccessKeyId and SecretAccessKey printed by step 2 as the aws.s3.access_key and aws.s3.secret_key, respectively.

Expected behavior

Either of the following:

  1. The credentials produced by aws sso login should work.
  2. The error message should be more informative.

Real behavior

ERROR 1064 (HY000): Access storage error. Error code: null. Error message: null. 

In debugging this, I was able to eventually gain access to the S3 file via another pair of credentials, supplied by the AWS web console via IAM > Users. I think the issue is that aws sso login produces a session token that usually must accompany the access key and secret.

Supporting a session_token would be a nice feature, but otherwise, a better error message would be helpful, as well as a note in the docs that the credentials produced via SSO won't work.

StarRocks version:

3.3.5-6d81f75

@matthinea matthinea added the type/bug Something isn't working label Nov 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant