cube-js/cube

Allow dynamic assumeRoleArn in Athena driver config

开放

#10,128 创建于 2025年11月11日

 (1 条评论) (1 个反应) (0 位负责人)Rust (1,965 个派生)batch import
driver:athenahelp wanted

仓库指标

星标
 (19,563 个星标)
PR 合并指标
 (PR 指标待抓取)

描述

Apologies if there is another way to do this, but I tried multiple approaches with no results..

Is your feature request related to a problem? Please describe. The Athena driver only reads assumeRoleArn from environment variables. In multi-tenant setups, it is not possible to pass a tenant-specific assume-role ARN via the driver config.

Describe the solution you'd like Allow the driver to accept assumeRoleArn (and optionally assumeRoleExternalId) from the driver config, prioritizing it over the environment variable. Example:

@config("driver_factory")
def driver_factory(context):
  return {
    type: 'athena',
    database: '...',
    assumeRoleArn: 'arn:aws:iam::123456789012:role/cube-tenant-XYZ',
    assumeRoleExternalId: 'optional-external-id',
    accessKeyId: '...',
    secretAccessKey: '...',
    region: 'us-east-1',
    S3OutputLocation: 's3://...',
  }

Describe alternatives you've considered I tried to generate the credentials externally and pass it to the driver but this is also not supported.

Additional context This change would simplify multi-tenant deployments where each tenant uses a unique Athena role.

贡献者指南