Add AWS IAM Roles Anywhere authentication to s3, sqs and sqs-files adapters

[maximelb]

Summary

Adds support for authenticating to AWS using IAM Roles Anywhere as an alternative to long-lived access keys, for the three adapters that talk to AWS: s3, sqs and sqs-files (which covers CloudTrail-style S3 bucket ingestion).

Instead of pasting a permanent access_key/secret_key, users can now provide an X.509 certificate + private key issued under a CA they registered as a Roles Anywhere trust anchor, along with the trust anchor / profile / role ARNs. The adapter exchanges the certificate for temporary session credentials via the Roles Anywhere CreateSession API and refreshes them automatically before expiry. The AWS credentials in use are always short-lived, the certificate is revocable and expiring, and no permanent IAM user is needed.

Configuration

New optional roles_anywhere block on the three adapter configs, mutually exclusive with access_key/secret_key:

roles_anywhere:
  certificate: <PEM leaf cert, optionally followed by its chain>
  private_key: <PEM RSA or ECDSA key (PKCS#8, PKCS#1 or SEC1)>
  trust_anchor_arn: arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/UUID
  profile_arn: arn:aws:rolesanywhere:us-east-1:123456789012:profile/UUID
  role_arn: arn:aws:iam::123456789012:role/my-role

PEM values may also be passed on a single line with \n escapes (convenient for UI/CLI configs). The region and endpoint are derived from the trust anchor ARN, including GovCloud and CN partitions. Existing configs using access keys are unaffected.

Implementation notes

• CreateSession uses a SigV4 variant (SigV4-X509) that is deliberately not implemented in any AWS SDK. The official rolesanywhere-credential-helper cannot be imported as a library without pulling in a cgo PKCS#11 dependency, which would break this repo's cross-compilation (AIX, Solaris, BSDs...). The signing process is small and publicly documented, so it is implemented directly in utils/aws_roles_anywhere.go per the official signing spec, using only the standard library.
• The provider plugs into the existing aws-sdk-go v1 credentials.Provider interface with expiry-based auto-refresh (5 minutes before expiration).
• Certificate chains are supported via the X-Amz-X509-Chain signed header for setups where the trust anchor is a root CA and the client cert is issued by an intermediate.

Testing

• Mock Roles Anywhere server that validates requests exactly like the real service: it rebuilds the canonical request from the received headers and verifies the SigV4-X509 signature against the public key of the certificate presented in X-Amz-X509, for both RSA and ECDSA keys, including the serial-number credential field and algorithm/key-type match.
• Tests for certificate chain handling, single-line escaped PEM input, non-2xx API responses, endpoint derivation from ARNs across partitions, and invalid PEM/ARN inputs.
• Config validation tests for all three adapters covering the static-keys/Roles-Anywhere either-or logic.
• go build ./..., go vet and go test on all touched packages pass, plus cross-compile checks for aix/ppc64 and windows/amd64.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SiRyZ4DwMZtcpeYWh8oFFx