kms related error after bump to 1.4.0

[bilec]

Hi, after bumping to 1.4.0 from 1.3.0-incubating. I started to get kms related errors.
I am using STS and also have tried setting "kmsUnavailable": "true" via polaris-console Storage Configation - Properties

2026-04-28 06:05:29,983 INFO  [org.apa.pol.ser.exc.IcebergExceptionMapper] [11c1c748-a93d-428e-b459-54c724a426ac_0000000000000000069,iup] [,,,] (executor-thread-1) Handling runtimeException Failed to get subscoped credentials: At character offset 82, `kms:DescribeKey` is not a valid action. (Service: Sts, Status Code: 400, Request ID: tx0000016182c64c1b4dc82-0069f04e29-63965729-default) (SDK Attempt Count: 1)

I am doing something wrong?

[jbonofre]

Hi,

It seems you are using a non-AWS STS endpoint, which rejects KMS actions as invalid.

I think your storage config doesn't set the kmsUnavailable=true flag. Since region and accountId are likely set (making AWS S3 enabled), a wildcard KMS policy with kms:DescribeKey gets injected into the AssumeRole call, which your Ceph STS endpoint rejects.

You should set the AwsStorageConfigurationInfo with kmsUnvailable: true for this catalog. You can do that via the management API:

  {                                                                                                                                                                                                                                                                            
    "storageType": "S3",                                                                                                                                                                                                                                                       
    "allowedLocations": ["s3://..."],                                                                                                                                                                                                                                          
    "stsEndpoint": "http://<your-ceph-endpoint>",
    "kmsUnavailable": true                                                                                                                                                                                                                                                     
  }

That said, I think there's a improvement to do: the isAwsS3 check in addKmsKeyPolaris shouldn't be true when a custom STS endpoint is configured, since a custom endpoint means you're not on native AWS.

[bilec]

thank you, that worked