Issue S3 web identity token refresh call with sufficient permissions (elastic#119748) (elastic#119929)

pxsalehi · web-flow · commit eb6c6fdb609e · 2025-01-10T21:48:10.000+11:00
Closes elastic#119747
diff --git a/docs/changelog/119748.yaml b/docs/changelog/119748.yaml
@@ -0,0 +1,6 @@
+pr: 119748
+summary: Issue S3 web identity token refresh call with sufficient permissions
+area: Snapshot/Restore
+type: bug
+issues:
+ - 119747
diff --git a/modules/repository-s3/src/main/java/org/elasticsearch/repositories/s3/S3Service.java b/modules/repository-s3/src/main/java/org/elasticsearch/repositories/s3/S3Service.java
@@ -417,7 +417,7 @@ public void onFileCreated(Path file) {
                     public void onFileChanged(Path file) {
                         if (file.equals(webIdentityTokenFileSymlink)) {
                             LOGGER.debug("WS web identity token file [{}] changed, updating credentials", file);
-                            credentialsProvider.refresh();
+                            SocketAccess.doPrivilegedVoid(credentialsProvider::refresh);
                         }
                     }
                 });

Original file line number	Diff line number	Diff line change
`@@ -417,7 +417,7 @@ public void onFileCreated(Path file) {`
`417`	`417`	`public void onFileChanged(Path file) {`
`418`	`418`	`if (file.equals(webIdentityTokenFileSymlink)) {`
`419`	`419`	`LOGGER.debug("WS web identity token file [{}] changed, updating credentials", file);`
`420`		`- credentialsProvider.refresh();`
	`420`	`+ SocketAccess.doPrivilegedVoid(credentialsProvider::refresh);`
`421`	`421`	`}`
`422`	`422`	`}`
`423`	`423`	`});`