Function buildAWSSdkSecret

server/server.go:2214–2252

buildAWSSdkSecret fetches credentials via the Go AWS SDK and builds a CREATE SECRET statement with PROVIDER config using the explicit temporary credentials.

(ctx context.Context, dlCfg DuckLakeConfig)

// RefreshS3Secret replaces the DuckDB S3 secret with updated credentials.
// Used when a hot-idle worker is reclaimed and STS credentials have rotated.
// Respects the configured S3 provider (config, aws_sdk, credential_chain).
func RefreshS3Secret(db *sql.DB, dlCfg DuckLakeConfig, duckLakeSem chan struct{}) error {
	if dlCfg.ObjectStore == "" {
		return nil
	}
	ae := newAttachStepExecer(db)
	if duckLakeSem != nil {
		duckLakeSem <- struct{}{}
		defer ae.releaseSem(duckLakeSem)
	}

	provider := S3ProviderForConfig(dlCfg)
	var secretStmt string
	switch provider {
	case "aws_sdk":
		sdkCtx, sdkCancel := context.WithTimeout(context.Background(), attachStepTimeout)
		defer sdkCancel()
		var err error
		secretStmt, err = buildAWSSdkSecret(sdkCtx, dlCfg)
		if err != nil {
			return fmt.Errorf("refresh aws_sdk S3 secret: %w", err)
		}
	case "credential_chain":
		secretStmt = buildCredentialChainSecret(dlCfg)
	default:
		secretStmt = buildConfigSecret(dlCfg)
	}

	// If the previous session left the connection in DuckDB's "Current
	// transaction is aborted" state, the exec will always fail. Issue a
	// ROLLBACK to recover, matching the pattern in StartCredentialRefresh.
	if _, err := ae.Exec(secretStmt); err != nil {
		if isTransactionAborted(err) {
			_, _ = ae.Exec("ROLLBACK")
			if _, retryErr := ae.Exec(secretStmt); retryErr != nil {
				return fmt.Errorf("refresh S3 secret after rollback: %s", redactSecretStatementError(retryErr.Error()))
			}
		} else {
			return fmt.Errorf("refresh S3 secret: %s", redactSecretStatementError(err.Error()))
		}
	}
	slog.Debug("Refreshed S3 secret for hot-idle reuse.", "provider", provider)