feat(providers): AWS STS AssumeRole refresh strategy and aws-s3 profile#1782

Open

russellb wants to merge 16 commits into

NVIDIA:mainfrom

russellb:feat/1576-aws-sts-with-sigv4

Commits on Jul 14, 2026

feat(providers): add AWS STS credential refresh and aws-s3 provider profile
russellb
committed
feat(providers): declarative multi-output credential refresh
russellb
committed
fix(providers): reject caller-supplied STS endpoint override
russellb
committed
fix(providers): validate canonical AWS STS profile binding at configure
russellb
committed
fix(providers): require AWS STS source credentials as a complete pair
russellb
committed
fix(providers): enforce providers_v2 gate on every AWS STS mint
russellb
committed
fix(providers): clear all refresh-owned expiries when deleting a refresh
russellb
committed
docs(providers): read AWS STS secret from env, not process arguments
russellb
committed
fix(providers): decide refresh-owned expiry cleanup inside the CAS closure
russellb
committed
docs(providers): give the aws-s3 STS example PyPI egress for boto3
russellb
committed
fix(prover): match whole middle-label host wildcards like the runtime
russellb
committed
fix(providers): don't let a rotation resurrect a deleted refresh
russellb
committed
fix(providers): serialize refresh configuration to reserve keys atomically
russellb
committed
fix(persistence): return typed Conflict for absent-row conditional writes
russellb
committed
fix(providers): gate provider credential write on refresh generation ownership
russellb
committed
feat(providers): support aws_session_token for temporary source credentials
russellb
committed