aws: STS WebIdentity credentials provider

[suniltheta]

Co-authored-by: Scott LaVigne lavignes@amazon.com

Commit Message: aws: STS WebIdentity credentials provider
Additional Description: Envoy support for k8s IAM Roles for Service Accounts aws/aws-app-mesh-roadmap#182. This is an AWS internal patch that is upstreamed after updating it to adopt to use http async client way of fetching metadata credentials.
Note: This change enables SSL on curl dependency which is on deprecation path #30731. The SSL on curl is required to establish https connection with STS service.

Risk Level: Low
Testing: Unit testing
Docs Changes: Yes
Release Notes: Yes
Platform Specific Features: NA

[suniltheta]

Looks like can't enable SSL on curl without failing windows build for reasons mentioned in

envoy/bazel/foreign_cc/BUILD

Lines 260 to 262 in 2de016d

	# SSL (via Envoy's SSL dependency) is disabled, curl's CMake uses
	# FindOpenSSL.cmake which fails at what looks like version parsing
	# (the libraries are found ok).

So no option but to remove the code path that would enable WebIdentity credentials provider for deprecated curl path.

[KBaichoo]

Can you take a look as codeowner @lavignes?

Thank you

/assign @lavignes

[suniltheta]

Has merge conflicts with #31135. Once the other change is merged I will update this change and will be good for review.

[suniltheta]

@soulxu can you please help identify someone for a first pass review?

[mattklein123]

@suniltheta is there someone else from AWS that can review for correctness or has it already been reviewed? I can skim after that. Thanks.

/wait-any

[suniltheta]

Thanks Matt for your help. This change was from an internal patch that was maintained for 4 years pending contribution to upstream Envoy until the deprecation of libcurl.
The internal patch is working as expected and all the functional aspects remain the same in this PR except the unit testing code required modification to adapt to using http async client. Also, did some change to get STS response in json format to avoid adding an external dependency for xml parsing (pugixml or tinyxml2).

I have manually tested that this change works for AWS Request Signing http filter extension to fetch the credentials properly from AWS STS.

---

Let me quickly try to find if anyone from internal AWS cpp sdk interest slack channel can help with giving some feedback. And get back here to check with you again.

[mattklein123]

If it's already being used that is fine. I can give it a quick skim.

[mattklein123]

LGTM with a question, thanks.

/wait-any

[michaelfinch]

Thank you for supporting this!