Skip to content

Pass principal name as part of aws subscoped credentials session name #3196

@tokoko

Description

@tokoko

Is your feature request related to a problem? Please describe.

We are trying to monitor how different principals use the catalog. While Polaris listeners enable us to audit table reads on table level, we also need information regarding physical storage reads for each principal, for example to keep track of the s3 costs incurred by each. This seems to be impossible at the moment when using vended credentials as all subscoped credentials are produced by the same parent role and session name for each subscoped credential is a simple hardcoded value - "PolarisAwsCredentialsStorageIntegration".

Describe the solution you'd like

It would be ideal to use principal name as part of the session name so that the final value would look something like this "Polaris_TestPrincipal" (probably best to keep the prefix short as session name length is capped at 64 chars). This would enable users to use aws monitoring tools like CloudTrail to get better information about physical s3 reads.

Describe alternatives you've considered

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions