RPC GetFileSystemSecurityToken supports grant table-level STS token

[wuchong]

Search before asking

• I searched in the issues and found nothing similar.

Motivation

Currently, RPC GetFileSystemSecurityToken is a cluster level operation that grand user a STS temporary token for all table files on remote storage. There is a big security risk on this. And we should support table-level STS token.

Solution

Add repeated PbTablePath tables = 1; in GetFileSystemSecurityTokenRequest. For each given table, check its ACL to ensure that the requesting user has read permission. Only after the ACL check succeeds, grant STS permission for the corresponding paths on remote storage (see how to grant directory permission for OSS, link).

Anything else?

No response

Willingness to contribute

• I'm willing to submit a PR!

[wuchong]

cc @loserwang1024