cube-js / cube

📊 Cube — The Semantic Layer for Building Data Applications
https://cube.dev
Other
17.83k stars 1.77k forks source link

Added credentials chain support in AWS Athena Driver #2306

Open jogoussard opened 3 years ago

jogoussard commented 3 years ago

Is your feature request related to a problem? Please describe. The Cubejs Athena driver supports only environment based credentials for permanent credentials according to what I see in the code (i.e. access and secret keys only). However, there are multiple ways to authenticate on AWS, including short-lived credentials that require not only access and security keys, but secret and session tokens. Forcing users to create long-lived credentials on their AWS account to support development or deployment of CubeJS doesn't seem the best way to go.

Describe the solution you'd like One solution is to modify the AthenaDriver credentials setup to use a credentials provider chain including the SharedIniFileCredentials:

    const envCreds = new AWS.Credentials({
      accessKeyId: process.env.CUBEJS_AWS_KEY,
      secretAccessKey: process.env.CUBEJS_AWS_SECRET,
      region: process.env.CUBEJS_AWS_REGION});
    const ec2Credentials = new AWS.EC2MetadataCredentials();  
    const sharedCreds = new AWS.SharedIniFileCredentials({profile: process.env.CUBEJS_AWS_PROFILE});  
    const chain = new AWS.CredentialProviderChain();
    chain.providers.push(sharedCreds);
    chain.providers.push(ec2Credentials);
    chain.providers.push(envCreds);

    this.config = {
//       accessKeyId: process.env.CUBEJS_AWS_KEY,
//       secretAccessKey: process.env.CUBEJS_AWS_SECRET,
      credentialProvider: chain,

This chain will try to acquire

Describe alternatives you've considered None for now.

Additional context

github-actions[bot] commented 3 years ago

If you are interested in working on this issue, please leave a comment below and we will be happy to assign the issue to you. If this is the first time you are contributing a Pull Request to Cube.js, please check our contribution guidelines. You can also post any questions while contributing in the #contributors channel in the Cube.js Slack.