Repository navigation
fix(storage): forward aws_external_id to STS AssumeRole in CloudStore S3 (3.27 backport) - #4109
Closed
ashish-atlan wants to merge 1 commit into
Closed
ashish-atlan wants to merge 1 commit into
ashish-atlan wants to merge 1 commit into
Conversation
CloudStore.from_credentials read extra.aws_role_arn but never passed an external ID to make_s3_assume_role_provider, so roles whose trust policy requires sts:ExternalId could not be assumed. Read extra.aws_external_id (the key already used by the SQL IAM-auth path) and forward it; blank values are dropped since STS rejects an empty ExternalId. Refs: CSA-641
ashish-atlan
requested review from
Aryamanz29,
OnkarVO7,
atlan-ci,
cmgrote and
vaibhavatlan
as code owners
October 1, 2026 19:15
3 of 5 tasks
Collaborator
|
Not needed — fix in the app: https://github.com/atlanhq/atlan-csa-uber-app/pull/184 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changelog
release/v3.27, a new branch created atv3.27.2(0daa2965).CloudStore.from_credentials(S3) now forwardsextra.aws_external_idtomake_s3_assume_role_provider, which sends it asExternalIdon STSAssumeRole. Blank or whitespace-only values are dropped.Additional context (e.g. screenshots, logs, links)
atlan-csa-uber-app) is on 3.27.x, and every release from 3.28 on requirespyatlan>=11.3, which the app isn't ready for yet.StsCredentialProvider, not_UtcExpiryStsCredentialProvider, because v3.27.2 doesn't have that wrapper yet.release/v3.27after merge. If you'd prefer a different backport process or branch name, let me know and I'll retarget.Checklist
tests/unit/storage/test_cloud.py)Local:
tests/unit/storage/test_cloud.pygives 50 passed, and pre-commit (ruff, ruff-format, isort, pyright) passes.Copyleft License Compliance
🤖 Generated with Claude Code