feat(providers): AWS STS AssumeRole refresh strategy and aws-s3 profile#1782

Draft

russellb wants to merge 12 commits into

NVIDIA:mainfrom

russellb:feat/1576-aws-sts-with-sigv4

Commits on Jun 5, 2026

feat(sandbox): proxy-side AWS SigV4 credential signing for CONNECT tunnels

jhjaggars
authored and
russellb
committed
fix(policy): validate signing_service at policy load time

jhjaggars
authored and
russellb
committed
feat(sandbox): support unsigned payload and streaming SigV4 signing

jhjaggars
authored and
russellb
committed
fix(sandbox): address SigV4 PR review feedback

jhjaggars
authored and
russellb
committed
fix(sandbox): address second review — FIPS+dualstack, missing tests, OCSF nit

jhjaggars
authored and
russellb
committed
fix(sandbox): address third review — chunked SignBody gap, provider DTO, startup validation

jhjaggars
authored and
russellb
committed
feat(providers): add aws_sts_assume_role refresh strategy (v2 only)
russellb
committed
feat(providers): wire SigV4 signing into aws-s3 profile and add docs
russellb
committed
fix(sandbox): reject service names as regions in extract_aws_region
russellb
committed
fix(sandbox): handle streaming SigV4 payload modes from boto3
russellb
committed
fix(tui): add AwsStsAssumeRole match arm to refresh strategy label
russellb
committed
feat(policy): allow single-label * wildcard in middle DNS labels and tighten aws-s3 endpoints
russellb
committed