Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Show CallerIdentity when connect to S3 client #7162

Merged
merged 2 commits into from
Mar 27, 2023
Merged

Show CallerIdentity when connect to S3 client #7162

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fcda076
Show the caller ident when creating s3 client without ak,sk
JaySon-Huang Mar 25, 2023
2085cce
update
JaySon-Huang Mar 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions contrib/aws-cmake/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ endif()
SET(AWS_SDK_DIR "${TiFlash_SOURCE_DIR}/contrib/aws")
SET(AWS_SDK_CORE_DIR "${AWS_SDK_DIR}/src/aws-cpp-sdk-core")
SET(AWS_SDK_S3_DIR "${AWS_SDK_DIR}/generated/src/aws-cpp-sdk-s3")
SET(AWS_SDK_STS_DIR "${AWS_SDK_DIR}/generated/src/aws-cpp-sdk-sts")

SET(AWS_AUTH_DIR "${TiFlash_SOURCE_DIR}/contrib/aws-c-auth")
SET(AWS_CAL_DIR "${TiFlash_SOURCE_DIR}/contrib/aws-c-cal")
Expand Down Expand Up @@ -115,6 +116,14 @@ file(GLOB AWS_SDK_S3_SRC
list(APPEND AWS_SOURCES ${AWS_SDK_S3_SRC})
list(APPEND AWS_PUBLIC_INCLUDES "${AWS_SDK_S3_DIR}/include/")

# aws-cpp-sdk-sts
file(GLOB AWS_SDK_STS_SRC
"${AWS_SDK_STS_DIR}/source/*.cpp"
"${AWS_SDK_STS_DIR}/source/model/*.cpp"
)

list(APPEND AWS_SOURCES ${AWS_SDK_STS_SRC})
list(APPEND AWS_PUBLIC_INCLUDES "${AWS_SDK_STS_DIR}/include/")

# aws-c-auth
file(GLOB AWS_AUTH_SRC
Expand Down
24 changes: 22 additions & 2 deletions dbms/src/Storages/S3/S3Common.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,10 @@
#include <aws/s3/model/PutBucketLifecycleConfigurationRequest.h>
#include <aws/s3/model/PutObjectRequest.h>
#include <aws/s3/model/TaggingDirective.h>
#include <aws/sts/STSClient.h>
#include <aws/sts/STSServiceClientModel.h>
#include <aws/sts/model/GetCallerIdentityRequest.h>
#include <aws/sts/model/GetCallerIdentityResult.h>
#include <common/logger_useful.h>
#include <kvproto/disaggregated.pb.h>
#include <pingcap/kv/Cluster.h>
Expand Down Expand Up @@ -335,7 +339,7 @@ ClientFactory & ClientFactory::instance()

std::unique_ptr<Aws::S3::S3Client> ClientFactory::create() const
{
return create(config);
return create(config, log);
}

std::shared_ptr<TiFlashS3Client> ClientFactory::sharedTiFlashClient()
Expand All @@ -346,7 +350,7 @@ std::shared_ptr<TiFlashS3Client> ClientFactory::sharedTiFlashClient()
return initClientFromWriteNode();
}

std::unique_ptr<Aws::S3::S3Client> ClientFactory::create(const StorageS3Config & config_)
std::unique_ptr<Aws::S3::S3Client> ClientFactory::create(const StorageS3Config & config_, const LoggerPtr & log)
{
Aws::Client::ClientConfiguration cfg;
cfg.maxConnections = config_.max_connections;
Expand All @@ -361,6 +365,22 @@ std::unique_ptr<Aws::S3::S3Client> ClientFactory::create(const StorageS3Config &
}
if (config_.access_key_id.empty() && config_.secret_access_key.empty())
{
Aws::Client::ClientConfiguration sts_cfg;
sts_cfg.verifySSL = false;
Aws::STS::STSClient sts_client(sts_cfg);
Aws::STS::Model::GetCallerIdentityRequest req;
auto get_identity_outcome = sts_client.GetCallerIdentity(req);
if (!get_identity_outcome.IsSuccess())
{
const auto & error = get_identity_outcome.GetError();
LOG_WARNING(log, "get CallerIdentity failed, exception={} message={}", error.GetExceptionName(), error.GetMessage());
}
else
{
const auto & result = get_identity_outcome.GetResult();
LOG_INFO(log, "CallerIdentity{{UserId:{}, Account:{}, Arn:{}}}", result.GetUserId(), result.GetAccount(), result.GetArn());
}

// Request that does not require authentication.
// Such as the EC2 access permission to the S3 bucket is configured.
// If the empty access_key_id and secret_access_key are passed to S3Client,
Expand Down
2 changes: 1 addition & 1 deletion dbms/src/Storages/S3/S3Common.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ class ClientFactory
DISALLOW_COPY_AND_MOVE(ClientFactory);
std::unique_ptr<Aws::S3::S3Client> create() const;

static std::unique_ptr<Aws::S3::S3Client> create(const StorageS3Config & config_);
static std::unique_ptr<Aws::S3::S3Client> create(const StorageS3Config & config_, const LoggerPtr & log);
static Aws::Http::Scheme parseScheme(std::string_view endpoint);

std::shared_ptr<TiFlashS3Client> initClientFromWriteNode();
Expand Down