Skip to content

snowflake-driver: Support IAM roles with IRSA for S3 export buckets #10010

@morford-brex

Description

@morford-brex

Is your feature request related to a problem? Please describe.
Currently, the Snowflake driver requires explicit AWS credentials (CUBEJS_DB_EXPORT_BUCKET_AWS_KEY and CUBEJS_DB_EXPORT_BUCKET_AWS_SECRET) for S3 export buckets, even when using IAM roles. This creates a problem in cloud-native environments (e.g. k8s with IRSA).

Describe the solution you'd like
When no explicit credentials or storage integration is provided, the driver should:

  • Skip credential validation for keyId/secretKey
  • Omit the CREDENTIALS clause from Snowflake COPY INTO commands
  • Let the AWS SDK use the default credential chain (IRSA → instance profile → environment)

Describe alternatives you've considered
The current alternative of using hardcoded credentials requires additional setup and doesn't leverage native cloud IAM capabilities.

Additional context
The AWS SDK already supports this pattern out-of-the-box - we just need the Snowflake driver to allow it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions