topic Re: why the userIdentity is anonymous? in Data Engineering

why the userIdentity is anonymous?

rt-slowth — Mon, 15 Jan 2024 08:07:53 GMT

Do you know why the userIdentity is anonymous in AWS Cloudtail's logs even though I have specified an instance profile?

Re: why the userIdentity is anonymous?

CharlesReily — Mon, 15 Jan 2024 10:09:42 GMT

If you're using AssumeRole to switch roles, make sure that the assumed role session is being used correctly. The Security Token Service (STS) is responsible for issuing temporary security credentials when assuming roles. Ensure that your EC2 instances have been assigned the correct IAM roles with the necessary permissions. AWS CloudTrail logs typically capture the identity of the caller making the API request. If your EC2 instance has the correct IAM role associated with it, CloudTrail should log the identity appropriately.

Re: why the userIdentity is anonymous?

rt-slowth — Fri, 26 Jan 2024 00:10:05 GMT

@Retired_mod @CharlesReily

Directory listing mode is supported by default. File notification mode is only supported on single user clusters.

I was trying to use File Notification Mode in DLT and encountered the above problem...

Re: why the userIdentity is anonymous?

Babu_Krishnan — Wed, 01 May 2024 22:59:00 GMT

I tried with "Single User" cluster, but still getting error "org.apache.spark.sql.streaming.StreamingQueryException: [STREAM_FAILED] Query [id = 55e0cb16-5e12-444d-a132-a24b999e2e4a, runId = 3ae637bb-847a-472b-a133-64b58ccb35cb] terminated with exception: User: anonymous is not authorized to perform: sqs:receivemessage on resource: arn:aws:sqs:us-east-1:4".

Used "data_security_mode":"SINGLE_USER" in Cluste policy. Am I missing anything ?

Re: why the userIdentity is anonymous?

rt-slowth — Wed, 01 May 2024 23:24:25 GMT

@Babu_Krishnan

As far as I know, pipelines created with Shared Cluster and Delta Live Table are not in File notification mode.
Since Delta Live Table is a Shared Cluster by default.
Before that, how is your AWS IAM role set up?
If you can share your cluster configuration and the code that performs the readStream, I'll see what I can do.

Re: why the userIdentity is anonymous?

Babu_Krishnan — Thu, 02 May 2024 02:27:31 GMT

@rt-slowth , Thanks for the reply. IAM role should be fine (with all the required permissions) since it was perfectly working with DLT without UC. We are seeing this failure when we are migrating. the existing DLT to Unity Catalog. FYI , I am able run the pipeline with "Direcltory listing" mode, I see this SQS permission error only when we use the file notification mode.