Add S3 region configuration to security mapping

[kekwan]

Description

• Add ability to configure S3 regions dynamically per-bucket via security mapping feature

Additional context and related issues

• add S3 endpoint configuration to security mapping #3869 provides undocumented capability to dynamically update s3 endpoints but this is not sufficient for use-cases that have cross-region S3 access. For use-cases like cross-region VPC endpoints, you need to set the corresponding region also.

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
(X) Release notes are required, with the following suggested text:

# Section
* Add S3 region configuration to security mapping

[hashhar]

using the security mapping feature to change endpoint and region is a misuse IMO.

The correct solution is to use different catalogs IMO.

@electrum your opinion?

[kekwan]

using the security mapping feature to change endpoint and region is a misuse IMO.

The correct solution is to use different catalogs IMO.

@electrum your opinion?

I do agree that would be ideal. But I think there are valid use-cases for this feature.

For example, our user has tables with data from many different buckets each needing their own VPC endpoints. Using a single catalog gives us a unified querying experience and doesn't require us enforcing users to make sure they're using the correct catalog.

[electrum]

I think this is reasonable. The feature is really “flexible S3 configuration” and not just security.

[github-actions]

This pull request has gone a while without any activity. Tagging the Trino developer relations team: @bitsondatadev @colebow @mosabua

[mosabua]

👋 @kekwan could you rebase this PR so we can continue review and get to merge potentially.

[github-actions]

This pull request has gone a while without any activity. Tagging the Trino developer relations team: @bitsondatadev @colebow @mosabua

[github-actions]

Closing this pull request, as it has been stale for six weeks. Feel free to re-open at any time.