Skip to content

fix(be): fix BE access to aws under eks pod identity - #66555

Open
Owen-CH-Leung wants to merge 2 commits into
apache:masterfrom
qube-rt:chore-thirdparty-upgrade-aws-sdk-cpp-1.11.221
Open

fix(be): fix BE access to aws under eks pod identity#66555
Owen-CH-Leung wants to merge 2 commits into
apache:masterfrom
qube-rt:chore-thirdparty-upgrade-aws-sdk-cpp-1.11.221

Conversation

@Owen-CH-Leung

Copy link
Copy Markdown

What problem does this PR solve?

Issue Number: close #66554

Problem Summary

Fixes the issue above by forwarding AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE alongside the inline token. Given a file path, the provider will re-read it before every fetch, so credentials survive token rotation. ECS, which sets only the inline variable AWS_CONTAINER_AUTHORIZATION_TOKEN, is unaffected.

Why the aws-sdp-cpp bump

The GeneralHTTPCredentialsProvider does not exist before 1.11.221. The only container provider available at the currently pinned version is TaskRoleCredentialsProvider, which takes the token as a string and has no notion of a token file. 1.11.221 is the first version whose GeneralHTTPCredentialsProvider re-reads the token file.

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason
  • Behavior changed:

    • No.
    • Yes.
  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@hello-stephen

Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@Owen-CH-Leung Owen-CH-Leung changed the title Chore thirdparty upgrade aws sdk cpp 1.11.221 chore(thirdparty): fix BE access to aws under eks pod identity Aug 6, 2026
@Owen-CH-Leung Owen-CH-Leung changed the title chore(thirdparty): fix BE access to aws under eks pod identity fix(be): fix BE access to aws under eks pod identity Aug 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] BE loses S3 access once the EKS Pod Identity token rotates; token file is never re-read

2 participants