Workflow [PR], commit [9070f73]

PR #1427 — Verification Report

Summary of Test Results

None of the observed failures are related to this PR.

Manual Verification

The PR was verified through manual testing using AWS Glue.

Test Setup

The AWS user was configured with the following policy only:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::407099639081:role/glue-reader"
    }
  ]
}

The glue-reader role policy was modified during testing (e.g. AmazonS3FullAccess, AmazonGlacierFullAccess, and a custom policy).
Verification confirmed that ClickHouse can only list and query tables permitted by the role’s policy.

Important Notes

1. Changes to the IAM role policy are not reflected immediately in ClickHouse; a delay of up to 5 minutes is expected.
2. Restarting ClickHouse forces the policy changes to take effect immediately.
3. Recreating the database with a different aws_role_session_name also applies policy changes immediately.

Regression Testing

Regression run:
https://github.com/Altinity/clickhouse-regression/actions/runs/22577467785/job/65400340538

Full analysis of the regression results is not possible because this PR does not include all Antalya features.

Conclusion: PR #1427 was verified. All observed issues are pre-existing or infrastructure-related and are not caused by this change.

Audit Report: PR #1427

Possible defects

• Medium: Empty STS credentials can be explicitly injected into S3 engine args
  • Impact: transient STS AssumeRole failures can produce explicit empty key/secret literals in S3 engine args, leading to auth failures and reduced recovery behavior.
  • Anchor:
    • src/Databases/DataLake/GlueCatalog.cpp (createObjectStorageForEarlyTableAccess)
    • src/IO/S3/Credentials.cpp (AwsAuthSTSAssumeRoleCredentialsProvider::Reload)
    • src/Databases/DataLake/StorageCredentials.h (S3Credentials::addCredentialsToEngineArgs)
  • Trigger: STS AssumeRole fails while role-based auth is enabled and metadata path takes the args.size() == 1 fallback.
  • Transition mapping: STS failure (empty creds) -> unconditional fallback injection.
  • Why defect: changed logic unconditionally injects provider credentials without non-empty guard.
  • Smallest logical repro:
    1. Configure Glue with aws_role_arn / aws_role_session_name.
    2. Force STS AssumeRole failure.
    3. Query table requiring early metadata/object read.
    4. Observe failures caused by explicit empty credentials path.
  • Likely fix direction:
    • Add non-empty guard before S3Credentials(...).addCredentialsToEngineArgs(args).
    • If creds are empty, skip explicit AST injection and keep provider-based behavior.
  • Regression test direction:
    • Add negative test: STS failure must not produce explicit empty credentials in engine args.
    • Keep current positive/negative session-name test as baseline.
  • Affected subsystem / blast radius: Glue catalog + Iceberg early metadata read path.
  • Evidence:

if (args.size() == 1)
{
    if (table_metadata.hasStorageCredentials())
    {
        table_metadata.getStorageCredentials()->addCredentialsToEngineArgs(args);
    }
    else
    {
        auto credentials = credentials_provider->GetAWSCredentials();
        DataLake::S3Credentials(credentials.GetAWSAccessKeyId(), credentials.GetAWSSecretKey(), credentials.GetSessionToken()).addCredentialsToEngineArgs(args);
    }
}