Skip to content

fix: fix S3 Data Lake connector empty role_arn validation - #67005

Merged
Davin Chia (davinchia) merged 12 commits into
masterfrom
fix/s3-data-lake-empty-role-arn-validation
Oct 7, 2025
Merged

Davin Chia (davinchia) merged 12 commits into
masterfrom
fix/s3-data-lake-empty-role-arn-validation

Conversation

@davinchia

@davinchia Davin Chia (davinchia) commented Oct 2, 2025 •

Copy link
Copy Markdown
Contributor
  • Change role_arn validation to check for both null and blank strings
  • Add validation for mismatched AWS credentials (only one of access_key_id or secret_access_key provided)
  • Add comprehensive tests for empty string role_arn, null role_arn, and credential validation
  • Improve error messages for better debugging

Fixes airbytehq/airbyte-internal-issues#14643

What

How

Review guide

User Impact

Can this PR be safely reverted and rolled back?

  • YES 💚
  • NO ❌

Important

Auto-merge enabled.

This PR is set to merge automatically when all requirements are met.

@github-actions

github-actions Bot commented Oct 2, 2025

Copy link
Copy Markdown
Contributor

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

Helpful Resources

PR Slash Commands

Airbyte Maintainers (that's you!) can execute the following slash commands on your PR:

  • /format-fix - Fixes most formatting issues.
  • /update-connector-cdk-version connector=<CONNECTOR_NAME> - Updates the specified connector to the latest CDK version.
    Example: /update-connector-cdk-version connector=destination-bigquery
  • /bump-version - Bumps connector versions.
    • You can specify a custom changelog by passing changelog. Example: /bump-version changelog="My cool update"
    • Leaving the changelog arg blank will auto-populate the changelog from the PR title.
  • /run-cat-tests - Runs legacy CAT tests (Connector Acceptance Tests)
  • /build-connector-images - Builds and publishes a pre-release docker image for the modified connector(s).
  • /poe connector source-example lock - Run the Poe lock task on the source-example connector, committing the results back to the branch.
  • /poe source example lock - Alias for /poe connector source-example lock.
  • /poe source example use-cdk-branch my/branch - Pin the source-example CDK reference to the branch name specified.
  • /poe source example use-cdk-latest - Update the source-example CDK dependency to the latest available version.

📝 Edit this welcome message.

@github-actions

github-actions Bot commented Oct 2, 2025 •

Copy link
Copy Markdown
Contributor

destination-s3-data-lake Connector Test Results

224 tests   141 ✅  5m 15s ⏱️
 15 suites   83 💤
 15 files      0 ❌

Results for commit 3caf38d.

♻️ This comment has been updated with latest results.

@edgao Edward Gao (edgao) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one comment about logic, otherwise lgtm

// Validate that either both credentials are provided or neither (for instance profiles)
if ((awsAccessKeyId == null) != (awsSecretAccessKey == null)) {
throw IllegalArgumentException(
"Both access_key_id and secret_access_key must be provided together, or neither (to use instance profiles)"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in assume role mode, we always use the key+secret

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

PTAL Edward Gao (@edgao)

- Change role_arn validation to check for both null and blank strings
- Empty string role_arn is now treated as null and uses key-based auth
- Refactor tests for better conciseness with helper function
- Use consistent Kotlin patterns matching existing codebase style

Fixes airbytehq/airbyte-internal-issues#14643
@davinchia
Davin Chia (davinchia) force-pushed the fix/s3-data-lake-empty-role-arn-validation branch from b0181e3 to be9142a Compare October 2, 2025 16:05
- Update version from 0.3.36 to 0.3.37
- Add changelog entry for empty string role_arn fix
@davinchia
Davin Chia (davinchia) marked this pull request as ready for review October 2, 2025 16:23
@davinchia
Davin Chia (davinchia) requested a review from a team as a code owner October 2, 2025 16:23
@davinchia

Davin Chia (davinchia) commented Oct 2, 2025 •

Copy link
Copy Markdown
Contributor Author

/format-fix

Format-fix job started... Check job output.

✅ Changes applied successfully. (b4b2f45)

@github-actions

github-actions Bot commented Oct 2, 2025 •

Copy link
Copy Markdown
Contributor

Deploy preview for airbyte-docs ready!

✅ Preview
https://airbyte-docs-k6g3uepws-airbyte-growth.vercel.app

Built with commit 3caf38d.
This pull request is being automatically deployed with vercel-action

Davin Chia (davinchia) and others added 4 commits October 3, 2025 17:05
Use UUID-based table names for check operation test tables to prevent
conflicts with:
- Stale metadata from previous check runs
- Concurrent check operations
- User tables named airbyte_test_table

This fixes the integration test failure caused by corrupted Glue catalog
metadata pointing to non-existent S3 files.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
@davinchia
Davin Chia (davinchia) force-pushed the fix/s3-data-lake-empty-role-arn-validation branch from f465b5a to 109a3dd Compare October 7, 2025 00:41
Davin Chia (davinchia) and others added 5 commits October 6, 2025 17:52
…tables

Wrap test table creation in try-finally to ensure cleanup always occurs,
even if validation logic is added in the future or if the operation fails.

This prevents accumulation of orphaned test tables in Glue catalog and S3.
Update version and changelog for empty role_arn validation fix.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
The configUpdater is not needed for check tests as they use actual config values directly, not test infrastructure placeholders.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
@davinchia
Davin Chia (davinchia) enabled auto-merge (squash) October 7, 2025 18:31
@davinchia
Davin Chia (davinchia) merged commit 0120d16 into master Oct 7, 2025
34 checks passed
@davinchia
Davin Chia (davinchia) deleted the fix/s3-data-lake-empty-role-arn-validation branch October 7, 2025 18:38
Matteo Palarchio (matteogp) pushed a commit that referenced this pull request Oct 10, 2025
- Change role_arn validation to check for both null and blank strings
- Add validation for mismatched AWS credentials (only one of
access_key_id or secret_access_key provided)
- Add comprehensive tests for empty string role_arn, null role_arn, and
credential validation
- Improve error messages for better debugging

Fixes airbytehq/airbyte-internal-issues#14643

Co-authored-by: Octavia Squidington III <octavia-squidington-iii@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants