cockroachdb/cockroach

Explicit auth with TEMP tokens

Open

#56,577 opened on Nov 11, 2020

View on GitHub
 (6 comments) (0 reactions) (0 assignees)Go (4,124 forks)batch import
C-wishlistT-disaster-recoverygood first issue

Repository metrics

Stars
 (32,150 stars)
PR merge metrics
 (Avg merge 5d 4h) (26 merged PRs in 30d)

Description

Informs #56536

Use of external storage temp tokens, together with explicit authentication is dangerous. In general, explicitly specified tokens could expire while long running operation (backup, restore) is still executing, without any way for us to regenerate such temp token.

We should error out if external storage URI uses temporary credentials for backup, restore, import, scheduled backup and cdc.

We should also provide an extra URI parameter for the user to specify if they really wish to override this behavior: "&REALLY_USE_TEMP_CREDENTIALS"

Epic CRDB-71

Jira issue: CRDB-2924

Contributor guide

Research direction
Examine how external storage URIs with temporary credentials are parsed and used in backup/restore workflows. Identify where validation should be added to error out on temp tokens, and how to implement the override parameter.
Tech stack
go
Domain
backenddatabase
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
GoCockroachDB
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30