enhancement(sinks): allow to provide aws session token

changelog.d/aws-auth-session-token.enhancement.md

@@ -0,0 +1,3 @@
+Adds support for session tokens in AWS authentication options. When using temporary credentials (access key, secret key, and session token), the session token is required. Temporary credentials can be provided by an external system and updated using the `SECRET` backend.
+
+authors: anil-db

src/aws/auth.rs

@@ -71,6 +71,11 @@ pub enum AwsAuthentication {
         #[configurable(metadata(docs::examples = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"))]
         secret_access_key: SensitiveString,
 
+        /// The AWS session token.
+        /// See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+        #[configurable(metadata(docs::examples = "AQoDYXdz...AQoDYXdz..."))]
+        session_token: Option<SensitiveString>,
+
         /// The ARN of an [IAM role][iam_role] to assume.
         ///
         /// [iam_role]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html
@@ -275,11 +280,12 @@ impl AwsAuthentication {
                 external_id,
                 region,
                 session_name,
+                session_token,
             } => {
                 let provider = SharedCredentialsProvider::new(Credentials::from_keys(
                     access_key_id.inner(),
                     secret_access_key.inner(),
-                    None,
+                    session_token.clone().map(|v| v.inner().into()),
                 ));
                 if let Some(assume_role) = assume_role {
                     let auth_region = region.clone().map(Region::new).unwrap_or(service_region);
@@ -372,6 +378,7 @@ impl AwsAuthentication {
             external_id: None,
             region: None,
             session_name: None,
+            session_token: None,
         }
     }
 }

website/cue/reference/base/configuration.cue

@@ -364,6 +364,11 @@ base: configuration: configuration: {
 														"""
 						required: false
 					}
+					session_token: {
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+						description: "The AWS session token."
+						required:    false
+					}
 					credentials_file: {
 						type: string: examples: ["/my/aws/credentials"]
 						description: "Path to the credentials file."

website/cue/reference/components/sinks/base/aws_cloudwatch_logs.cue

@@ -139,6 +139,11 @@ base: components: sinks: aws_cloudwatch_logs: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	batch: {

website/cue/reference/components/sinks/base/aws_cloudwatch_metrics.cue

@@ -139,6 +139,11 @@ base: components: sinks: aws_cloudwatch_metrics: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	batch: {

website/cue/reference/components/sinks/base/aws_kinesis_firehose.cue

@@ -139,6 +139,11 @@ base: components: sinks: aws_kinesis_firehose: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	batch: {

website/cue/reference/components/sinks/base/aws_kinesis_streams.cue

@@ -139,6 +139,11 @@ base: components: sinks: aws_kinesis_streams: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	batch: {

website/cue/reference/components/sinks/base/aws_s3.cue

@@ -214,6 +214,11 @@ base: components: sinks: aws_s3: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	batch: {

website/cue/reference/components/sinks/base/aws_sns.cue

@@ -139,6 +139,11 @@ base: components: sinks: aws_sns: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	encoding: {

website/cue/reference/components/sinks/base/aws_sqs.cue

@@ -139,6 +139,11 @@ base: components: sinks: aws_sqs: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	encoding: {

website/cue/reference/components/sinks/base/clickhouse.cue

@@ -149,6 +149,11 @@ base: components: sinks: clickhouse: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {

website/cue/reference/components/sinks/base/databend.cue

@@ -144,6 +144,11 @@ base: components: sinks: databend: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {

website/cue/reference/components/sinks/base/elasticsearch.cue

@@ -182,6 +182,12 @@ base: components: sinks: elasticsearch: configuration: {
 				required:      false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description:   "The AWS session token."
+				relevant_when: "strategy = \"aws\""
+				required:      false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 			strategy: {
 				description: """
 					The authentication strategy to use.

website/cue/reference/components/sinks/base/http.cue

@@ -149,6 +149,11 @@ base: components: sinks: http: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {

website/cue/reference/components/sinks/base/loki.cue

@@ -149,6 +149,11 @@ base: components: sinks: loki: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {

website/cue/reference/components/sinks/base/opentelemetry.cue

@@ -152,6 +152,11 @@ base: components: sinks: opentelemetry: configuration: protocol: {
 							required: false
 							type: string: examples: ["vector-indexer-role"]
 						}
+						session_token: {
+							description: "The AWS session token."
+							required:    false
+							type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+						}
 					}
 				}
 				password: {

website/cue/reference/components/sinks/base/prometheus_exporter.cue

@@ -161,6 +161,11 @@ base: components: sinks: prometheus_exporter: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {

website/cue/reference/components/sinks/base/prometheus_remote_write.cue

@@ -155,6 +155,12 @@ base: components: sinks: prometheus_remote_write: configuration: {
 				required:      false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description:   "The AWS session token."
+				relevant_when: "strategy = \"aws\""
+				required:      false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 			strategy: {
 				description: "The authentication strategy to use."
 				required:    true

website/cue/reference/components/sinks/base/websocket.cue

@@ -149,6 +149,11 @@ base: components: sinks: websocket: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {

website/cue/reference/components/sources/base/aws_s3.cue

@@ -134,6 +134,11 @@ base: components: sources: aws_s3: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	compression: {

website/cue/reference/components/sources/base/aws_sqs.cue

@@ -134,6 +134,11 @@ base: components: sources: aws_sqs: configuration: {
 				required: false
 				type: string: examples: ["vector-indexer-role"]
 			}
+			session_token: {
+				description: "The AWS session token."
+				required:    false
+				type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+			}
 		}
 	}
 	client_concurrency: {

website/cue/reference/components/sources/base/http_client.cue

@@ -118,6 +118,11 @@ base: components: sources: http_client: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {

website/cue/reference/components/sources/base/nginx_metrics.cue

@@ -123,6 +123,11 @@ base: components: sources: nginx_metrics: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {

website/cue/reference/components/sources/base/prometheus_scrape.cue

@@ -123,6 +123,11 @@ base: components: sources: prometheus_scrape: configuration: {
 						required: false
 						type: string: examples: ["vector-indexer-role"]
 					}
+					session_token: {
+						description: "The AWS session token."
+						required:    false
+						type: string: examples: ["AQoDYXdz...AQoDYXdz..."]
+					}
 				}
 			}
 			password: {