[#13012] fix(catalog-glue): Fail fast and give actionable errors on missing AWS credentials - #13013
Merged
Merged
Conversation
…s on missing AWS credentials A Glue catalog created without any usable AWS credential source was stored successfully and then failed on every operation with a raw AWS SDK credential-chain error that never named this connector's own aws-access-key-id/aws-secret-access-key properties. - Eagerly resolve credentials in GlueClientProvider.buildClient() so catalog creation/update fails fast instead of persisting an unusable catalog. - Translate credential-chain SdkClientException into a message naming the connector's properties at every Glue API call site, via a shared callGlue() helper.
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
This PR makes the Glue catalog fail fast when AWS credentials can’t be resolved and improves runtime errors by translating AWS SDK credential-chain failures into actionable, connector-specific messages.
Changes:
- Eagerly validates AWS credentials during
GlueClientconstruction to prevent storing unusable catalogs. - Adds translation logic to map AWS SDK credential-chain failures to messages referencing
aws-access-key-id/aws-secret-access-key. - Adds unit tests for credential validation and for runtime exception translation in schema listing.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| catalogs/catalog-glue/src/main/java/org/apache/gravitino/catalog/glue/GlueClientProvider.java | Adds fail-fast credential resolution and throws actionable IllegalArgumentException when resolution fails. |
| catalogs/catalog-glue/src/main/java/org/apache/gravitino/catalog/glue/GlueExceptionConverter.java | Introduces detection + conversion of credential-chain failures into connector-actionable runtime exceptions. |
| catalogs/catalog-glue/src/main/java/org/apache/gravitino/catalog/glue/GlueCatalogOperations.java | Wraps Glue SDK calls to translate credential failures while preserving existing GlueException semantics. |
| catalogs/catalog-glue/src/test/java/org/apache/gravitino/catalog/glue/TestGlueClientProvider.java | Replaces flaky default-chain test with deterministic credential validation tests. |
| catalogs/catalog-glue/src/test/java/org/apache/gravitino/catalog/glue/TestGlueCatalogSchemaOperations.java | Adds tests ensuring credential failures are translated and non-credential client exceptions are rethrown. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+59
to
+67
| static RuntimeException toCredentialException(SdkClientException e, String context) { | ||
| return new RuntimeException( | ||
| String.format( | ||
| "Failed to authenticate with AWS Glue while %s. No usable AWS credentials were " | ||
| + "found. Set both '%s' and '%s' catalog properties, or ensure the default AWS " | ||
| + "credential chain can resolve credentials.", | ||
| context, GlueConstants.AWS_ACCESS_KEY_ID, GlueConstants.AWS_SECRET_ACCESS_KEY), | ||
| e); | ||
| } |
Code Coverage Report
Files
|
…ling - validateCredentials() only asserts "no usable credentials" for a recognized credential-chain-exhausted SdkClientException; other SdkClientExceptions (e.g. network/IMDS failures) get a distinct message that doesn't misrepresent the cause. - Tighten the credential-failure marker string to reduce false positive matches. - Reword toCredentialException's connector wording so it reads correctly for both noun-phrase and gerund-phrase context strings. - Add direct unit tests for isCredentialFailure/toCredentialException and for the non-credential SdkClientException path in validateCredentials. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
jerryshao
previously approved these changes
Sep 9, 2026
…ation # Conflicts: # catalogs/catalog-glue/src/main/java/org/apache/gravitino/catalog/glue/GlueCatalogOperations.java # catalogs/catalog-glue/src/main/java/org/apache/gravitino/catalog/glue/GlueExceptionConverter.java # catalogs/catalog-glue/src/test/java/org/apache/gravitino/catalog/glue/TestGlueExceptionConverter.java
yuqi1129
previously approved these changes
Sep 9, 2026
…ation Conflicts were limited to catalog-glue and were import-block only: GlueExceptionConverter and its test both needed upstream's AccessDeniedException/ForbiddenException imports alongside this branch's SdkClientException-based credential handling. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M3AXLWarBpSTPRED5dHUsw
yuqi1129
approved these changes
Sep 10, 2026
jerryshao
pushed a commit
that referenced
this pull request
Sep 10, 2026
… give actionable errors on missing AWS credentials (#13013) (#13071) **Cherry-pick Information:** - Original commit: 172c903 - Target branch: `branch-1.3` --------- Co-authored-by: Yuhui <hui@datastrato.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: diqiu50 <diqiu50@apache.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
surfacing the raw AWS SDK error.
Why are the changes needed?
A Glue catalog created without usable AWS credentials was stored successfully and
then failed on every operation with a raw AWS SDK error that never mentioned the
connector's own properties.
Fix: #13012
Does this PR introduce any user-facing change?
Yes: creating/updating a Glue catalog with no usable AWS credential source now
fails immediately instead of succeeding and failing later.
How was this patch tested?
Added unit tests in
GlueClientProvider/GlueCatalogOperations; existing tests pass.