Files
doris/common
Mingyu Chen (Rayner)andOwen Leung 378dc72412 branch-4.1: [fix](be): fix BE access to aws under eks pod identity #67076 (#67555)
Cherry-picked from #67076

**Depends on #67554** (the branch-4.1 backport of #66851) (the
aws-sdk-cpp 1.11.219 -> 1.11.221 pin). BE cannot compile
this without `GeneralHTTPCredentialsProvider.h`, which first ships in
1.11.221, so that PR has to
land and the pre-built thirdparty artifacts be re-published first.

### Backport notes

branch-4.1 does not have the `common/cpp/obj-client/` refactor, so this
could not be applied
verbatim:

- The `CredProviderType::Container` switch case lives in **two** places
on this branch,
`be/src/util/s3_util.cpp` and `cloud/src/recycler/s3_accessor.cpp`,
instead of the single
`common/cpp/obj-client/auth/aws_credential_factory.cpp` upstream. Both
now call
  `create_container_credentials_provider()`, and the then-unused
  `<aws/core/platform/Environment.h>` include was dropped from both.
- `common/cpp/aws_common.{h,cpp}` and
`common/cpp/custom_aws_credentials_provider_chain.cpp` carry
the same change as upstream (the new `AWS_CONTAINER_*` constants,
`container_credentials_available()`
and `create_container_credentials_provider()`); the declarations follow
this branch's local
  indentation in `aws_common.h`.
- The tests reach the same providers through this branch's entry points:
  `S3ClientFactory::get_aws_credentials_provider()` and
  `S3Accessor::_get_aws_credentials_provider_v2()`.
- `ContainerProviderTypeIsUsableAsStsBaseProvider` is **not** carried
over. Upstream it exists to
reach `AwsCredentialFactory::create()` below `S3ClientFactory`; this
branch has no such layer, so
the case would have been a second copy of
`ContainerProviderTypeReadsRotatedTokenFileForPodIdentity`
-- both go through the very same
`_create_credentials_provider(Container)`. The other five new
cases, the two new test headers and the MSK IAM cases are all carried
over unchanged.

The other files (`be/src/runtime/aws_msk_iam_auth.cpp`,
`be/test/runtime/aws_msk_iam_auth_test.cpp`,
`gensrc/proto/cloud.proto`, `gensrc/thrift/AgentService.thrift`) applied
cleanly.

`clang-format` 16 was run over every changed file under `be/src`,
`be/test`, `cloud/src` and
`cloud/test` (the paths the Code Formatter workflow checks) and reports
no diff. BE was **not**
compiled locally: this branch's `thirdparty/installed` is still on
aws-sdk-cpp 1.11.219, so the new
header is not available until the backport of #66851 lands.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01DzUYFcGHQH3bnLGCjpncVj

Co-authored-by: Owen Leung <owen.leung2@gmail.com>
2026-09-07 18:25:44 +08:00
..
…

This directory contains the shared dependency code for various modules. The code within the cpp directory primarily consists of common foundational code for the Backend (BE) and Meta Service (MS) modules, including object storage access and a testing framework for common C++ code.