[HADOOP-15672] add s3guard CLI command to generate session keys for an assumed role

• Type: Sub-task
• Status: Resolved
• Priority: Minor
• Resolution: Duplicate
• Affects Version/s: 3.2.0
• Fix Version/s: 3.3.0
• Component/s: fs/s3
• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 14/Aug/18 20:13
• Updated: 26/Sep/19 19:26
• Resolved: 26/Sep/19 19:25

Description

the aws cli get-session-token can generate the keys for short-lived session.

I'd like something similar in an s3guard command, e.g. "create-role-keys", which would take the existing (full) credentials and optionally:

• ARN of role to adopt
• duration
• name
• restrictions as path to a JSON file or just stdin
• output format
• whether to use a per-bucket binding for the credentials in the property names generated
• MFA secrets

output formats

• A JCEKS file (with chosen passwd? For better hive use: append/replace entries in existing file); saved through the hadoop FS APIs to HDFS, file:// or elsewhere
• hadoop config XML
• spark properties

The goal here is to have a workflow where you can generate role credentials to use for a limited time, store them in a JCEKS file and then share them in your jobs. This can be for: Jenkins, Oozie, build files, ..

Issue Links

• is related to: HADOOP-14556 S3A to support Delegation Tokens
• is superceded by: HADOOP-14556 S3A to support Delegation Tokens