[HADOOP-13252] Tune S3A provider plugin mechanism

• Type: Sub-task
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.8.0
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: fs/s3
• Target Version/s: 2.8.0
• Hadoop Flags: Reviewed

Release Note

S3A now supports configuration of multiple credential provider classes for authenticating to S3. These are loaded and queried in sequence for a valid set of credentials. For more details, refer to the description of the fs.s3a.aws.credentials.provider configuration property or the S3A documentation page.

• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 09/Jun/16 09:17
• Updated: 28/Aug/18 21:11
• Resolved: 19/Aug/16 20:00

Description

We've now got some fairly complex auth mechanisms going on: -hadoop config, KMS, env vars, "none". IF something isn't working, it's going to be a lot harder to debug.

Review and tune the S3A provider point

• add logging of what's going on in s3 auth to help debug problems
• make a whole chain of logins expressible
• allow the anonymous credentials to be included in the list
• review and updated documents.

I propose carefully adding some debug messages to identify which auth provider is doing the auth, so we can see if the env vars were kicking in, sysprops, etc.

What we mustn't do is leak any secrets: this should be identifying whether properties and env vars are set, not what their values are. I don't believe that this will generate a security risk.

Issue Links

• incorporates: HADOOP-13313 S3A TemporaryAWSCredentialsProvider to support Hadoop Credential providers for secrets
• is duplicated by: HADOOP-13319 S3A to list InstanceProfileCredentialsProvider after EnvironmentVariableCredentialsProvider
• is related to: HADOOP-14833 Remove s3a user:secret authentication