Pull Request Overview

Opened on September 18, 2026
Status Open
Commit count 2 with first commit September 18, 2026

Total Delta

526 Total Diff Delta

Open Days

Open 0 weekdays

Test Delta

249 Diff Delta in Test Files

Breakdown by Phase

How long has this pull request spent in each phase of its lifecycle?

Fraction of total time	Business days	Phase
	0.0 days	Authoring 1 commit before pull request opened for review
	0.0 days	Awaiting first review

Total time for pull request still awaiting merge: 0.4 business days

[ESQL] Fail fast on expired S3 tokens

ExpiredToken/InvalidToken/TokenRefreshRequired become a typed 400 so sibling GETs abort and parquet prefetch skips sync fallback.

Closes #159699

Comments Threads Pending Resolution

Resolved Comment Threads

bpintea reviewed on September 18, 2026

x-pack/plugin/esql-datasource-s3/src/main/java/org/elasticsearch/xpack/esql/datasource/s3/S3StorageObject.java

Outdated

            return;

        }

        // Expired/invalid session tokens cannot be retried with the same signature. Map immediately

        // and skip the AWS Standard token refresh — same shape as RequestTimeTooSkewed above.

        if (S3FailureDetail.findCredentialsExpired(unwrapped) != null) {

x-pack/plugin/esql-datasource-parquet/src/main/java/org/elasticsearch/xpack/esql/datasource/parquet/OptimizedParquetColumnIterator.java

Outdated

    static void abortExpiredPrefetches(RuntimeException asyncFailure, ArrayDeque<PendingPrefetch> remaining) {

        try {

            cancelPendingPrefetches(remaining);

        } catch (Throwable cleanupFailure) {

x-pack/plugin/esql-datasource-s3/src/main/java/org/elasticsearch/xpack/esql/datasource/s3/S3FailureDetail.java

Outdated

     * AWS session-token failures. Matched by error code only — a bare HTTP 400/403 is not expiry

     * (Hadoop's HEAD trap, malformed ranges, {@code AuthorizationHeaderMalformed}).

     */

    private static final Set<String> CREDENTIALS_EXPIRED_CODES = Set.of("ExpiredToken", "InvalidToken", "TokenRefreshRequired");

GitClear uses cookies to ensure you get the best experience on our website. Learn more about our cookie policy

	973		`return;`
	974		`}`
	975		`// Expired/invalid session tokens cannot be retried with the same signature. Map immediately`
	976		`// and skip the AWS Standard token refresh — same shape as RequestTimeTooSkewed above.`
	977		`if (S3FailureDetail.findCredentialsExpired(unwrapped) != null) {`

	2288
	2289		`static void abortExpiredPrefetches(RuntimeException asyncFailure, ArrayDeque<PendingPrefetch> remaining) {`
	2290		`try {`
	2291		`cancelPendingPrefetches(remaining);`
	2292		`} catch (Throwable cleanupFailure) {`

	38		`* AWS session-token failures. Matched by error code only — a bare HTTP 400/403 is not expiry`
	39		`* (Hadoop's HEAD trap, malformed ranges, {@code AuthorizationHeaderMalformed}).`
	40		`*/`
	41		`private static final Set<String> CREDENTIALS_EXPIRED_CODES = Set.of("ExpiredToken", "InvalidToken", "TokenRefreshRequired");`
	42

[ESQL] Fail fast on expired S3 tokens #159729

Pull Request Overview

Total Delta

Open Days

Test Delta

[ESQL] Fail fast on expired S3 tokens

Comments Threads Pending Resolution

Resolved Comment Threads