[Feature]: Allow multiple authentication methods for versionStoreType DynamoDB

[kassett]

Description

Using DynamoDB as a versionStoreType should allow for using the K8s Service Account IAM role. This means that probably the AWS SDK Provider Chain would be configurable for using the DynamoDB versionStoreType.

Expected Use Cases

• Remove the attack surface of creating an AWS user with DDB access, instead use the WebIdentity of the servers running.

Requested Changes in public API

• Changes in public API

[dimas-b]

@kassett : Nessie relies on the Quarkus plugin for DynamoDB. I hope it supports your use case. Please check this page out: https://docs.quarkiverse.io/quarkus-amazon-services/dev/amazon-dynamodb.html#_configuring_dynamodb_clients

[kassett]

Checking now, I think even if it does there is a separate issue that the helm chart requires mounting a secret, which is maybe irrelevant if there is a web identity.

[kassett]

I tried a bunch of different stuff and ended up with this, which still didn't work. Do you have any ideas?

resource "helm_release" "nessie" {
  name             = "nessie"
  namespace        = var.trino_namespace
  create_namespace = false
  repository       = "https://charts.projectnessie.org/"
  chart            = "nessie"

  depends_on = [kubernetes_namespace.namespaces]

  set {
    name  = "catalog.iceberg.warehouses[0].name"
    value = "iceberg"
  }
  set {
    name  = "catalog.iceberg.warehouses[0].location"
    value = "s3://random-com-iceberg/testing"
  }
  set {
    name  = "catalog.iceberg.defaultWarehouse"
    value = "iceberg"
  }

  # ---- Use the DDB2 version store (persistent in DynamoDB) ----
  set {
    name  = "versionStoreType"
    value = "DYNAMODB2"
  }

  set {
    name  = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
    value = module.irsa["nessie"].iam_role_arn
  }

  # ---- Quarkus web identity token config ----
  set {
    name  = "quarkus.dynamodb.aws.credentials.type"
    value = "web-identity-token"
  }
  set {
    name  = "quarkus.dynamodb.aws.credentials.role-arn"
    value = module.irsa["nessie"].iam_role_arn
  }
  set {
    name  = "quarkus.dynamodb.aws.credentials.web-identity-token-file"
    value = "/var/run/secrets/eks.amazonaws.com/serviceaccount/token"
  }

  values = [<<-YAML
    dynamodb:
      region: ${data.aws_region.this.name}
      profile: ''
      secret: null

    extraEnv:
      - name: AWS_ROLE_ARN
        value: ${module.irsa["nessie"].iam_role_arn}
      - name: AWS_WEB_IDENTITY_TOKEN_FILE
        value: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
  YAML
  ]
}