Enabling long-running jobs to use federated STS assume role authentication for AWS resources.

[prodriguezdefino]

Currently long-running jobs, being those streaming or batch based, have limited options to authenticate against AWS services when running outside of AWS. In fact, the only viable option for batch pipelines or streaming pipelines that execute for more than X hours is to use a StaticCredentialsProvider configuration, this approach imposes some scrutiny given that the use of such provider is discouraged in favor of using temporary credentials.

AWSOptions enables the configuration of a provider named StsAssumeRoleWithWebIdentityCredentialsProvider which will use short-lived credentials and uses OIDC web identity tokens to authenticate the AWS sdk in a federated way. The problem this implementation presents is that once a web identity token is created it normally has a predefined expiration date, for which the AWS requests will fail after the expiration time is reached.

This change implements a StsAssumeRoleWithDynamicWebIdentityCredentialsProvider which can be configured with a FQCN in charge of providing fresh web id tokens that can be used to authenticate against AWS services in a federated way. The implementation delegates to the class StsAssumeRoleWithWebIdentityCredentialsProvider most of the logic, but creates the authentication request dynamically and attaches a refreshed web id token for all credential resolution requests.

Also, a simple Google ADC web id token provider (GoogleADCIdTokenProvider) is included for convenience, this enables XLang Dataflow pipelines to be configured without the need of including any Java code.

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

[prodriguezdefino]

fixes #34441

[prodriguezdefino]

Run Java_Amazon-Web-Services2_IO_Direct PreCommit

[github-actions]

Assigning reviewers. If you would like to opt out of this review, comment assign to next reviewer:

R: @m-trieu for label java.
R: @chamikaramj for label io.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).