Do you ❤️ Trino? Give us a 🌟 on GitHub

Trino Community Broadcast

77: One tool to proxy them all

Oct 29, 2025

Introduction

Jordan Zimmerman and Pablo Arteaga introduce us to a new Trino subproject and its use cases with AWS S3 and other storage systems, metastores, and query engines - aws-proxy.

Video

Host

Guest

Releases and news

Trino 478 is in the final staging of getting to release. We will talk about the details in the next episode.

Other releases and news

Introducing Jordan and Pablo

Manfred chats with Pablo and Jordan about their involvement in the Trino community. We end up chatting a bunch about the Airlift framework that is a foundation for Trino since Jordan has been involved in that project for a long time. Pablo has been involved in Trino itself and worked on the OPA plugin and the Trino Gateway, among other things.

aws-proxy

The AWS Proxy is an open-source Java toolkit and library, not a standalone application, designed to act as a transparent proxy for AWS Simple Storage Service (S3) compatible object storage protocols.

It was created by developers from Starburst, Bloomberg and other organizations in the Trino community to address the need for enhanced governance and security with tools like Apache Spark that lack security controls. It also supports direct data access to S3 or S3-compatible systems, like MinIO or Dell ECS.

Key functionality and use cases

  • Security and governance layer: The primary goal is to prevent client applications from bypassing governance systems by accessing S3 directly. It ensures all data access is channeled through the proxy, where custom business logic can be applied.
  • Signature handling: It handles the complex AWS Signature Version 4 (SIGv4) protocol used for authenticating requests, which was the most challenging part of its development.
  • Emulated credentials: Clients are configured to use fake, worthless credentials that are only recognized by the proxy. The proxy then validates the user’s identity and request against security policies (like OPA), signs the request with the real, secure AWS keys (kept safe behind the firewall), and forwards it to the real S3 store.
  • Extensibility: It’s built on the Airlift framework and uses a simple Service Provider Interface (SPI) plugin mechanism. This allows users to add custom logic authorization, object storage abstraction from buckets to tables, redirection, and other use cases.

In essence, it takes standard S3 requests from data tools and mediates them, applying security, control, and abstraction before forwarding them to the actual data lake storage.

Resources

Rounding out