Search before asking
Description
If you set s3.assumed.role.arn in server.yaml, you'd expect Fluss to do S3 I/O as that role. It doesn't. The plugin just logs "Using default AWS credential chain with AssumeRole" and returns, so S3A never gets an AssumedRoleCredentialProvider, so all remote.data.dir writes (remote log, KV snapshots, lake offsets) run with whatever ambient identity the default chain finds. `
The ARN is only used for delegation token generation.
We hit this while validating the Glue docs (#3424) on ECS Fargate, tiering wrote with the task's ambient credentials, not the configured role.
Willingness to contribute
Search before asking
Description
If you set s3.assumed.role.arn in server.yaml, you'd expect Fluss to do S3 I/O as that role. It doesn't. The plugin just logs "Using default AWS credential chain with AssumeRole" and returns, so S3A never gets an AssumedRoleCredentialProvider, so all remote.data.dir writes (remote log, KV snapshots, lake offsets) run with whatever ambient identity the default chain finds. `
The ARN is only used for delegation token generation.
We hit this while validating the Glue docs (#3424) on ECS Fargate, tiering wrote with the task's ambient credentials, not the configured role.
Willingness to contribute