remove IRSA backend, allow optional access_key, secret in S3Compatible backend for IRSA

Author: sapinb

bin/mosaic/src/config.rs

@@ -306,6 +306,12 @@ pub(crate) enum TableStoreBackend {
         bucket: String,
         region: String,
         prefix: String,
+<<<<<<< HEAD
+=======
+        /// When both `access_key_id` and `secret_access_key` are omitted, the
+        /// AWS credential chain is used: IRSA web-identity token → ECS task
+        /// creds → EC2 instance profile.
+>>>>>>> 3e11546 (remove IRSA backend, allow optional access_key, secret in S3Compatible backend for IRSA)
         access_key_id: Option<String>,
         secret_access_key: Option<String>,
         endpoint: Option<String>,
@@ -319,6 +325,7 @@ pub(crate) enum TableStoreBackend {
         #[serde(default)]
         virtual_hosted_style_request: bool,
     },
+<<<<<<< HEAD
 }
 
 impl TableStoreBackend {
@@ -336,6 +343,8 @@ impl TableStoreBackend {
             Self::LocalFilesystem { .. } => None,
         }
     }
+=======
+>>>>>>> 3e11546 (remove IRSA backend, allow optional access_key, secret in S3Compatible backend for IRSA)
 }
 
 #[derive(Debug, Clone, Deserialize)]

bin/mosaic/src/main.rs

@@ -154,6 +154,14 @@ where
                 builder = builder.with_secret_access_key(secret_access_key);
             }
 
+            // When credentials are omitted the builder falls through to the
+            // AWS credential chain: IRSA web-identity → ECS task → instance profile.
+            if let (Some(key_id), Some(secret)) = (access_key_id, secret_access_key) {
+                builder = builder
+                    .with_access_key_id(key_id)
+                    .with_secret_access_key(secret);
+            }
+
             if let Some(endpoint) = endpoint {
                 builder = builder.with_endpoint(endpoint);
             }