Skip to content

Conversation

@timH6502
Copy link
Contributor

Description

Enable Redshift COPY with temporary STS credentials by including the session token in the CREDENTIALS clause when present. If not provided, the old behavior is preserved.

Without the session token, COPY using temporary STS creds fails.
This only affects the S3 -> Redshift COPY path when credentials are temporary

More information can be found here:
https://docs.aws.amazon.com/redshift/latest/dg/copy-parameters-authorization.html

Specifically this section:
To use temporary token credentials, you must provide the temporary access key ID, the temporary secret access key, and the temporary token. The credentials-args string is in the following format.

CREDENTIALS
'aws_access_key_id=<temporary-access-key-id>;aws_secret_access_key=<temporary-secret-access-key>;token=<temporary-token>'

…ws_session_token is present, append the session token. Keeps IAM_ROLE path and long-lieved keys unchanged
@rudolfix rudolfix self-requested a review November 13, 2025 14:25
@rudolfix rudolfix self-assigned this Nov 13, 2025
Undo auto formatting changes
Remove blank line
Undo auto formatting changes
@timH6502
Copy link
Contributor Author

@rudolfix I've updated the code, linting should (hopefully) not be an issue any more. May you please re-run the pipeline?

Use string concatenation instead of two separate branches
Fixed incorrect string concatenation
@timH6502 timH6502 requested a review from rudolfix November 13, 2025 16:42
Explicitly use attribute
Use correct variable
rudolfix
rudolfix previously approved these changes Nov 13, 2025
Copy link
Collaborator

@rudolfix rudolfix left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! last question: how do you pass STS to dlt? do you create configuration in code? could you paste code sample?

@timH6502
Copy link
Contributor Author

timH6502 commented Nov 13, 2025

LGTM! last question: how do you pass STS to dlt? do you create configuration in code? could you paste code sample?

The last commit is required. I've done that on the train and is was all a bit messy. Now it works again.
The key can be set via the aws_session_token in the secrets.toml (or via environment variables) as in the example below.

[destination.filesystem.credentials]
aws_access_key_id = ""
aws_secret_access_key = ""
aws_session_token = ""
region_name = ""
aws_iam_role = ""

@timH6502 timH6502 requested a review from rudolfix November 14, 2025 13:07
@timH6502
Copy link
Contributor Author

timH6502 commented Nov 17, 2025

@rudolfix Is there something to be done, or will an autoformatter handle the rest?

@rudolfix
Copy link
Collaborator

@timH6502 auto format will not fix the code after it is pushed. you need to do make format and push the change. pls. try. otherwise the code is good

Change identation
@timH6502
Copy link
Contributor Author

@rudolfix Not sure what formatter/settings are required. However, the log indicates that only some identation had to be changed. Hope it works now.

Black (default settings vscode plugin) would change lines 131, 132, 139 and 140.

Copy link
Collaborator

@rudolfix rudolfix left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rudolfix rudolfix merged commit 8a23408 into dlt-hub:devel Nov 20, 2025
47 of 50 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants