Broker Load fails on GCS after gcs-connector upgrade to 3.0.13 #70011 When accessing GCS from AWS (StarRocks), starting from version 4.0.2, the gcs-connector version was changed, and authentication using a service account key no longer works. Instead of using the service account key method, it now always attempts to authenticate using VM-based authentication. This appears to be a breaking change. I would appreciate it if you could review the related PR.

Version	gcs-connector
4.0.1	hadoop3-2.2.26
4.0.4	3.0.13

cc. @Seunghun Lee

check the discussion in this issue: https://github.com/StarRocks/starrocks/issues/69013

Hi Kevin, I checked shared the issue. but in my case, I'm using a valid the account email like

<mailto:foo-bar-baz@a-foo-service.iam.gserviceaccount.com|foo-bar-baz@a-foo-service.iam.gserviceaccount.com>

ok. saw the pull request. will take a look.

and, as far as I know, in GCPCloudCredential, If the

useComputeEngineServiceAccount

flag is false, it should work service account-based authentication. In my case, I added

gcp.gcs.use_compute_engine_service_account

to the

fe.conf

file and restarted the service. Even though it was set to

false

, the system still used the VM-based authentication method.

Hi @Kevin Cai, follow-up on this. #70012 didn't fully fix it: on 4.0.8+ the same Broker Load fails with an NPE inside gcs-connector, since 3.x no longer accepts inline service account keys. I opened a fix that adds an

ACCESS_TOKEN_PROVIDER

for the inline key and verified it on 4.0.13 against a real bucket. github.com/StarRocks/starrocks/pull/78649 Could you take a look when you have a moment? Thanks!