cube-js/cube

Cube API and Refresh Worker use Instance Metadata for AWS Credentials like Cube Store does

Open

#4,334 opened on Apr 6, 2022

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Rust (1,965 forks)batch import
help wanted

Repository metrics

Stars
 (19,563 stars)
PR merge metrics
 (Avg merge 5d 16h) (138 merged PRs in 30d)

Description

Right now it doesn't appear that the Cube API or Refresh Worker is capable of using AWS Instance Metadata to authenticate with AWS. However, the Cube Store containers already have this capability.

From a security and configuration management perspective, Role Based Access is greatly preferred over passing in long-term access credentials to the containers with environment variables. Is this already on the road map?

This would be very useful when using the CUBEJS_DB_EXPORT_BUCKET configuration.

Contributor guide

Research direction
Investigate how Cube Store currently uses AWS Instance Metadata for credentials and apply similar logic to Cube API and Refresh Worker.
Tech stack
rust
Domain
backendcloud
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
AWS IAMCube API/Refresh Worker knowledge
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65