How do we configure StarRocks external catalog to use IRSA (WebIdentityTokenCredentialsProvider) instead of EC2 IMDS for AWS authentication in EKS? The AWS SDK should automatically detect and use the web identity token when

AWS_ROLE_ARN

and

AWS_WEB_IDENTITY_TOKEN_FILE

environment variables are present, but StarRocks appears to be explicitly trying to use IMDS instead. Is there a specific configuration property or JVM option needed to enable IRSA support in StarRocks?

Hi, this setup works for us using EKS + IRSA

CREATE EXTERNAL CATALOG some_catalog
PROPERTIES
(
    "type" = "iceberg",
    "iceberg.catalog.type" = "hive",
    "hive.metastore.uris" = "<thrift://hive:9083>",
    "aws.s3.region" = "us-west-1",
    "aws.s3.use_aws_sdk_default_behavior" = "true",
    "aws.s3.use_instance_profile" = "false"
);

what about to aws glue?

we don't use glue, so I don't have much ideas on it

https://docs.starrocks.io/docs/data_source/catalog/iceberg/iceberg_rest_s3/ What about this?

I'm not working on StarRocks development, so can talk only about my experience so far. Maybe Glue integration has different settings. If problem is accessing s3 bucket you can try to add to your catalog props.

"aws.s3.use_aws_sdk_default_behavior" = "true",
    "aws.s3.use_instance_profile" = "false"