feat: assume role provider credentials (#28)

* feat: assume role provider credentials

This commit updates the awsutil dependency to its latest version, which
supports the capability of using dynamic credentials. The storage service
was refactored to make static credentials optional. The credentials pkg
was refactored to support several attribute fields used for the assume
role provider. The host service still enforces the use of static
credentials.

plugin/service/storage/attributes_test.go

@@ -16,29 +16,35 @@ import (
 func TestGetStorageAttributes(t *testing.T) {
 	cases := []struct {
 		name                string
-		in                  map[string]any
+		in                  *structpb.Struct
 		expected            *StorageAttributes
 		expectedErrContains string
 	}{
 		{
-			name:                "missing region",
-			in:                  map[string]any{},
+			name: "missing region",
+			in: &structpb.Struct{
+				Fields: make(map[string]*structpb.Value),
+			},
 			expectedErrContains: "missing required value \"region\"",
 		},
 		{
 			name: "unknown fields",
-			in: map[string]any{
-				"region": "us-west-2",
-				"foo":    true,
-				"bar":    true,
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region": structpb.NewStringValue("us-west-2"),
+					"foo":    structpb.NewBoolValue(true),
+					"bar":    structpb.NewBoolValue(true),
+				},
 			},
 			expectedErrContains: "attributes.bar: unrecognized field, attributes.foo: unrecognized field",
 		},
 		{
 			name: "good w/ endpoint",
-			in: map[string]any{
-				cred.ConstRegion:    "us-west-2",
-				ConstAwsEndpointUrl: "0.0.0.0",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":       structpb.NewStringValue("us-west-2"),
+					"endpoint_url": structpb.NewStringValue("0.0.0.0"),
+				},
 			},
 			expected: &StorageAttributes{
 				CredentialAttributes: &cred.CredentialAttributes{
@@ -49,8 +55,10 @@ func TestGetStorageAttributes(t *testing.T) {
 		},
 		{
 			name: "good w/o endpoint",
-			in: map[string]any{
-				cred.ConstRegion: "us-west-2",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region": structpb.NewStringValue("us-west-2"),
+				},
 			},
 			expected: &StorageAttributes{
 				CredentialAttributes: &cred.CredentialAttributes{
@@ -58,6 +66,35 @@ func TestGetStorageAttributes(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "credential attributes",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":                      structpb.NewStringValue("us-west-2"),
+					"disable_credential_rotation": structpb.NewBoolValue(true),
+					"role_arn":                    structpb.NewStringValue("arn:aws:iam::123456789012:role/S3Access"),
+					"role_external_id":            structpb.NewStringValue("1234567890"),
+					"role_session_name":           structpb.NewStringValue("test-session"),
+					"role_tags": structpb.NewStructValue(&structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"foo": structpb.NewStringValue("bar"),
+						},
+					}),
+				},
+			},
+			expected: &StorageAttributes{
+				CredentialAttributes: &cred.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: true,
+					RoleArn:                   "arn:aws:iam::123456789012:role/S3Access",
+					RoleExternalId:            "1234567890",
+					RoleSessionName:           "test-session",
+					RoleTags: map[string]string{
+						"foo": "bar",
+					},
+				},
+			},
+		},
 	}
 
 	for _, tc := range cases {
@@ -65,10 +102,7 @@ func TestGetStorageAttributes(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			require := require.New(t)
 
-			input, err := structpb.NewStruct(tc.in)
-			require.NoError(err)
-
-			actual, err := getStorageAttributes(input)
+			actual, err := getStorageAttributes(tc.in)
 			if tc.expectedErrContains != "" {
 				require.Error(err)
 				require.Contains(err.Error(), tc.expectedErrContains)