Add Polaris blog about KMS by dimas-b · Pull Request #3331 · apache/polaris

dimas-b · 2025-12-24T20:06:56Z

Following up on #2802

Checklist

🛡️ Don't disclose security issues! (contact [email protected])
🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
🧪 Added/updated tests with good coverage, or manually tested (and explained how)
💡 Added comments for complex logic
🧾 Updated CHANGELOG.md (if needed)
📚 Updated documentation in site/content/in-dev/unreleased (if needed)

Following up on apache#2802

dimas-b · 2025-12-24T20:07:15Z

CC: @fivetran-ashokborra , @fabio-rizzo-01

adnanhemani

LGTM! Thanks for this @dimas-b !

singhpk234

Thanks a ton for penning it down @dimas-b !

Thank you @fivetran-ashokborra @fabio-rizzo-01 for working on these and the polaris community members for making this happen !

singhpk234 · 2025-12-26T02:57:48Z

site/content/blog/2025/12/24/aws-kms.md

+AWS [Key Management Service](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html) (KMS) provides
+a way to encrypt S3 data in AWS without exposing raw key material outside AWS services.
+
+Apache Polaris supports using KMS in its catalogs backed by AWS S3 storage.


minor: do we need (incubating) here ?

I guess not... the statement below already mentions a specific incubating version, plus the site's front page has the appropriate "incubating" designation.

site/content/blog/2025/12/24/aws-kms.md

singhpk234 · 2025-12-26T03:05:17Z

site/content/blog/2025/12/24/aws-kms.md

+This can be achieved by using the `--allowed-kms-key` CLI option to add zero or more extra KMS key ARNs to the
+catalog's storage configuration.
+
+Note: if the key material is rotated without introducing a new key ARN, no catalog changes are necessary.


didn't fully get this part, can you please elaborate

singhpk234

LGTM, thanks @dimas-b !

Added some questions on the timeline for the cli feature.

singhpk234 · 2025-12-29T18:36:24Z

site/content/blog/2025/12/24/aws-kms.md

+Apache Polaris supports using KMS in its catalogs backed by AWS S3 storage.
+
+The core functionality is available via Polaris REST API since the `1.2.0-incubating` release.
+CLI support will be made available in the release following `1.3.0-incubating`.


Are we planning to CP #3330 this tp 1.3x ? and have a new RC ?

I guess not. Let's not expand scope of 1.3.0

I was trying to understand more what the above statement meant, 1.3.1 could also be a following release.
i think we mean 1.4 ideally and we are not sure if will be 2.0 ?

singhpk234 · 2025-12-29T18:37:43Z

site/content/blog/2025/12/24/aws-kms.md

+## Using Multiple KMS Keys
+
+If the bucket used by the catalog has had multiple different KMS key ARNs associated with it over time,
+Polaris needs to know all related key ARNs in order to properly form policies for accessing old and new data.


optional :

Suggested change

Polaris needs to know all related key ARNs in order to properly form policies for accessing old and new data.

Polaris needs to know all related key ARNs in order to properly form policies used for vending creds for accessing old and new data.

thx - updated

singhpk234 · 2025-12-29T18:38:44Z

site/content/blog/2025/12/24/aws-kms.md

+This can be achieved by using the `--allowed-kms-key` CLI option to add zero or more extra KMS key ARNs to the
+catalog's storage configuration.


do we plan to merge this blog post cli pr gets merged ?

yes, CLI needs to go first

fivetran-ashokborra · 2025-12-30T06:21:55Z

CC: @fivetran-ashokborra , @fabio-rizzo-01

LGTM, Thanks for the acknowledgement 🙏 @fabio-rizzo-01 thanks for working on this feature

dimas-b · 2025-12-30T20:39:29Z

I'm going to merge this PR in its current form. Willing to take feedback and make adjustments after merging.

* Add Polaris blog about KMS Following up on apache#2802

* Disable renovate bot for openapi generator cli (apache#3306) * Fix openapi-generator-cli version in build system * Fix openapi-generator-cli version in build system * Build: Ensure reproducible .properties files (apache#3089) This is a safety net in case Properties are generated anywhere during the build. * Generate release vote e-mail as Github Step Summary (apache#3150) * Improve error handling in quickstart setup script (apache#3288) Add error detection and validation to API calls in the quickstart docker-compose setup with clear error messages for easier debugging. * (doc): Fix tools doc and add tool doc for mcp server (apache#3311) * chore(deps): update actions/stale digest to a21a081 (apache#3326) * Add cancel release candidate workflow (apache#3321) This commit fixes apache#3080 * fix(deps): update quarkus platform and group to v3.30.5 (apache#3329) * chore(deps): update actions/checkout digest to 8e8c483 (apache#3319) * fix(deps): update dependency org.agrona:agrona to v2.4.0 (apache#3333) * (feat): Helm: add priority class name support for helm (apache#3310) * Add priority class name support for helm * Update changelog * Update default port for metrics from 8282 to 8182 (apache#3335) Corrects the default metrics port from 8282 to 8182 and clarifies the available metrics endpoints in the documentation. * fix(deps): update dependency software.amazon.awssdk:bom to v2.40.16 (apache#3336) * Add KMS options to catalogs create CLI (apache#3330) * Add Polaris blog about KMS (apache#3331) * Add Polaris blog about KMS Following up on apache#2802 * Use mainstream PostgreSQLContainer (apache#3345) Migrate from the deprecated PostgreSQLContainer class to the mainstream one as suggested by javadoc. * fix(deps): update dependency org.apache.iceberg:iceberg-bom to v1.10.1 (apache#3317) * Enforce mypy for CLI (apache#3305) * fix(deps): update dependency software.amazon.awssdk:bom to v2.41.1 (apache#3351) * Last merged commit e75eb4b --------- Co-authored-by: Yong Zheng <[email protected]> Co-authored-by: Pierre Laporte <[email protected]> Co-authored-by: Tamas Mate <[email protected]> Co-authored-by: Mend Renovate <[email protected]> Co-authored-by: rishii-19-works <[email protected]> Co-authored-by: Dmitri Bourlatchkov <[email protected]>

Add Polaris blog about KMS

8733206

Following up on apache#2802

github-project-automation bot added this to Basic Kanban Board Dec 24, 2025

github-project-automation bot moved this to PRs In Progress in Basic Kanban Board Dec 24, 2025

adnanhemani approved these changes Dec 24, 2025

View reviewed changes

singhpk234 reviewed Dec 26, 2025

View reviewed changes

MonkeyCanCode previously approved these changes Dec 26, 2025

View reviewed changes

github-project-automation bot moved this from PRs In Progress to Ready to merge in Basic Kanban Board Dec 26, 2025

dimas-b added 2 commits December 29, 2025 11:11

review: rephrase KMS key application

4e5bdb3

review: rephrase key rotation statement

0002df1

dimas-b dismissed MonkeyCanCode’s stale review via 0002df1 December 29, 2025 16:15

singhpk234 previously approved these changes Dec 29, 2025

View reviewed changes

review: mention policies for vended creds

5fac6a2

dimas-b dismissed singhpk234’s stale review via 5fac6a2 December 29, 2025 22:21

MonkeyCanCode approved these changes Dec 29, 2025

View reviewed changes

dimas-b merged commit 118e342 into apache:main Dec 30, 2025
15 checks passed

github-project-automation bot moved this from Ready to merge to Done in Basic Kanban Board Dec 30, 2025

dimas-b deleted the kms-blog branch December 30, 2025 20:39

evindj pushed a commit to evindj/polaris that referenced this pull request Jan 26, 2026

Add Polaris blog about KMS (apache#3331)

6dc3d4b

* Add Polaris blog about KMS Following up on apache#2802

	Polaris needs to know all related key ARNs in order to properly form policies for accessing old and new data.
	Polaris needs to know all related key ARNs in order to properly form policies used for vending creds for accessing old and new data.

		This can be achieved by using the `--allowed-kms-key` CLI option to add zero or more extra KMS key ARNs to the
		catalog's storage configuration.

Conversation

dimas-b commented Dec 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

dimas-b commented Dec 24, 2025

Uh oh!

adnanhemani left a comment

Choose a reason for hiding this comment

Uh oh!

singhpk234 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

singhpk234 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fivetran-ashokborra commented Dec 30, 2025

Uh oh!

dimas-b commented Dec 30, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

dimas-b commented Dec 24, 2025 •

edited

Loading