big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HADOOP-18234. Fix s3a access point xml examples (#4309)

Browse Source 
Contributed by Ashutosh Gupta

Change-Id: Ib99a4c7113d60690c1301d80cd5c27a43c463db0
This commit is contained in:
Ashutosh Gupta 2022-05-16 17:47:14 +01:00 committed by Steve Loughran
parent a50ce18f4d
commit c2071947f8
No known key found for this signature in database
GPG Key ID: D22CF846DBB162A0
1 changed files with 3 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hadoop-tools/hadoop-aws/src/site/markdown/tools/hadoop-aws/index.md
View File

@ -1592,7 +1592,7 @@ Accessing data through an access point, is done by using its ARN, as opposed to
You can set the Access Point ARN property using the following per bucket configuration property:
```xml
<property>
<name>fs.s3a.sample-bucket.accesspoint.arn</name>
<name>fs.s3a.bucket.sample-bucket.accesspoint.arn</name>
<value> {ACCESSPOINT_ARN_HERE} </value>
<description>Configure S3a traffic to use this AccessPoint</description>
</property>
@ -1602,21 +1602,11 @@ This configures access to the `sample-bucket` bucket for S3A, to go through the
new Access Point ARN. So, for example `s3a://sample-bucket/key` will now use your
configured ARN when getting data from S3 instead of your bucket.
You can also use an Access Point name as a path URI such as `s3a://finance-team-access/key`, by
configuring the `.accesspoint.arn` property as a per-bucket override:
```xml
<property>
<name>fs.s3a.finance-team-access.accesspoint.arn</name>
<value> {ACCESSPOINT_ARN_HERE} </value>
<description>Configure S3a traffic to use this AccessPoint</description>
</property>
```
The `fs.s3a.accesspoint.required` property can also require all access to S3 to go through Access
Points. This has the advantage of increasing security inside a VPN / VPC as you only allow access
to known sources of data defined through Access Points. In case there is a need to access a bucket
directly (without Access Points) then you can use per bucket overrides to disable this setting on a
bucket by bucket basis i.e. `fs.s3a.{YOUR-BUCKET}.accesspoint.required`.
bucket by bucket basis i.e. `fs.s3a.bucket.{YOUR-BUCKET}.accesspoint.required`.
```xml
<!-- Require access point only access -->
@ -1626,7 +1616,7 @@ bucket by bucket basis i.e. `fs.s3a.{YOUR-BUCKET}.accesspoint.required`.
</property>
<!-- Disable it on a per-bucket basis if needed -->
<property>
<name>fs.s3a.example-bucket.accesspoint.required</name>
<name>fs.s3a.bucket.example-bucket.accesspoint.required</name>
<value>false</value>
</property>
```