feat(services/s3): support explicit AWS profiles - #7949
Open
Xuanwo wants to merge 7 commits into
Open
Conversation
…profile # Conflicts: # core/Cargo.lock # core/services/s3/Cargo.toml
…profile # Conflicts: # core/services/s3/src/docs.md
Xuanwo
marked this pull request as ready for review
August 5, 2026 05:22
Xuanwo
requested review from
PsiACE,
Zheaoli,
messense and
tisonkun
as code owners
August 5, 2026 05:22
dosubot
Bot
added
size:L
tisonkun
reviewed
Aug 5, 2026
| .with_http_send(ctx.http_transport().clone()) | ||
| .with_env(reqsign_core::OsEnv), | ||
| .with_env(OsEnv) | ||
| .with_command_execute(TokioCommandExecute), |
Member
There was a problem hiding this comment.
Is it needed later or just random modification?
tisonkun
reviewed
Aug 5, 2026
tisonkun
left a comment
tisonkun
left a comment
Member
There was a problem hiding this comment.
I remember apache/opendal-reqsign#792 and wonder why we should handle this credential loading thing in opendal rather than reqsign.
dosubot
Bot
added
size:M
Member
Author
Yep, a not needed helper function. I have removed it. |
tisonkun
approved these changes
Aug 5, 2026
erickguan
approved these changes
Aug 5, 2026
erickguan
reviewed
Aug 5, 2026
Comment on lines
+97
to
+101
| /// AWS profile used by the default credential provider chain. | ||
| /// | ||
| /// This profile takes precedence over the `AWS_PROFILE` environment | ||
| /// variable and applies to shared AWS config and credentials files and SSO. | ||
| /// |
Member
There was a problem hiding this comment.
Suggested change
| /// AWS profile used by the default credential provider chain. | |
| /// | |
| /// This profile takes precedence over the `AWS_PROFILE` environment | |
| /// variable and applies to shared AWS config and credentials files and SSO. | |
| /// | |
| /// AWS profile. | |
| /// | |
| /// By default, reqsign which is the default credential provider, supplies profile in order: | |
| /// - explicit option | |
| /// - `AWS_PROFILE` environment variable, from which reqsign reads profile from: | |
| /// - `~/.aws/credentials` (or the path specified by `AWS_SHARED_CREDENTIALS_FILE`) | |
| /// - `~/.aws/config` (or the path specified by `AWS_CONFIG_FILE`) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue does this PR close?
Closes #7944.
Rationale for this change
S3Buildercurrently either uses the ambientAWS_PROFILEor requires callers to replace the complete credential provider chain. This prevents applications from selecting different AWS profiles for different S3 operators while keeping OpenDAL's default credential resolution behavior.reqsign now provides an aggregate profile selector on its default AWS credential provider builder, so OpenDAL can expose per-builder profile selection without reconstructing or wrapping the provider chain locally.
What changes are included in this PR?
S3Config::profile, itsaws_profilealias, andS3Builder::profile.DefaultCredentialProviderBuilder::with_profile, preserving explicit profile >AWS_PROFILE>defaultprecedence.disable_config_loadauthoritative and leave customcredential_provider_chainbehavior unchanged.reqsign-aws-v4 3.1.0,reqsign-core 3.2.1, andreqsign-file-read-tokio 3.0.4.Are there any user-facing changes?
Yes. S3 users can select an AWS profile per builder through
S3Builder::profile,profilein serialized configuration, or theaws_profilecompatibility alias. The selected profile is forwarded to the reqsign default profile provider and applies to shared AWS config and credentials files and SSO. This PR does not change command execution support forcredential_process.This change is additive and does not alter credential resolution when no explicit profile is configured.
Validation
cargo test --locked -p opendal-service-s3— 25 unit tests and 8 doctests passed; 7 doctests were ignored.cargo clippy --locked -p opendal-service-s3 --all-targets -- -D warningscargo build --locked --target wasm32-unknown-unknown --no-default-features --features=services-s3cargo check --workspace --all-targets --all-features --lockedcargo checkinbindings/pythonandbindings/javacargo fmt --all -- --check./scripts/workspace.py cargo fmt -- --checktaplo format --checkThe Ruby lockfile resolves all reqsign packages from crates.io. A local
cargo check --lockedcompiled the OpenDAL and reqsign crates, then stopped inrb-sysbecause the macOS system Ruby 2.6 installation cannot provide the required Stable API; Ruby CI uses the repository's Ruby 3.3 toolchain.AI Usage Statement
OpenAI Codex with a GPT-5 model assisted with analysis, implementation, and validation.