CredentialOperations¶

AwsCredentialVendor¶

AwsCredentialVendor is created alongside CredentialOperations.

AzureCredentialVendor¶

GcpCredentialVendor¶

GcpCredentialVendor is created alongside CredentialOperations.

Vend Credentials¶

TemporaryCredentials vendCredential(
  String path,
  Set<CredentialContext.Privilege> privileges) // (1)!
TemporaryCredentials vendCredential(
  CredentialContext context)

Uses a new CredentialContext for the given storage location (path) and the privileges.

BaseException

vendCredential throws a BaseException when the path is undefined (null or empty).

Storage Location

The input path is also known as a storage location.

vendCredential creates a CredentialContext for the given storage location (path) and the privileges.

vendCredential creates a TemporaryCredentials model with Cloud Provider-specific settings (based on the storage scheme of the CredentialContext).

Storage Scheme	Credential Vending Mechanism	TemporaryCredentials
`abfs` or `abfss`	AzureCredential	`AzureUserDelegationSAS` `sasToken` `expirationTime`
`gs`	AccessToken	`GcpOauthToken` `oauthToken` `expirationTime`
`s3`	Credentials	`AwsCredentials` `accessKeyId` `secretAccessKey` `sessionToken`

vendCredential is used when:

TemporaryModelVersionCredentialsService is requested to generateTemporaryModelVersionCredentials
TemporaryPathCredentialsService is requested to generateTemporaryPathCredential
TemporaryTableCredentialsService is requested to generateTemporaryTableCredential
TemporaryVolumeCredentialsService is requested to generateTemporaryTableCredential

vendAwsCredential¶

Credentials vendAwsCredential(
  CredentialContext context)

vendAwsCredential requests the AwsCredentialVendor to vendAwsCredentials for the given CredentialContext.

vendAwsCredential is used when:

CredentialOperations is requested to vend credentials fors3:// storage scheme
FileIOFactory is requested to getAwsCredentialsProvider
TableConfigService is requested to getS3Config