Add IAM Role support for exchange spooling on S3

[linzebing]

Description

As title. Also drop a useless config.

Is this change a fix, improvement, new feature, refactoring, or other?

New feature

Is this a change to the core query engine, a connector, client library, or the SPI interfaces? (be specific)

trino-exchange-filesystem

How would you describe this change to a non-technical end user or system administrator?

Related issues, pull requests, and links

• Fixes IAM role support for exchange spooling on S3 #12444

Documentation

( ) No documentation is needed.
(x) Sufficient documentation is included in this PR.
( ) Documentation PR is available with #prnumber.
( ) Documentation issue #issuenumber is filed, and can be handled later.

Release notes

( ) No release notes entries required.
(x) Release notes entries required with the following suggested text:

# Section
* Add IAM Role support for exchange spooling on S3. ({issue}`12444`)

[losipiuk]

Please note ci / error-prone-checks failure

[losipiuk]

Can you validate config here that different configuration options are mutually exclusive?

• both config.getS3AwsAccessKey() and config.getS3AwsSecretKey() must be either set or unset
• if accessKey and secretKey are set then other auth related config options are not set.
• externalId can only be set if iaRole is set

[linzebing]

I'm not sure if we need to do that because TrinoS3FileSystem didn't perform such checks. Also they are not really mutually exclusive, it's just that priority is different (static credentials > iamRole > default credentials)

[losipiuk]

I think the fact that TS3FS does not do that is an omission.
Also unless I am missing sth they are mutually exclusive. If you set S3 Access and Secret key it does not matter what you set in IamRole as you would not get to line in code when you use that.
You would return in return StaticCredentialsProvider.create(AwsBasicCredentials.create(config.getS3AwsAccessKey(), config.getS3AwsSecretKey())); right?

Hence if user provides both access/secretKey and IAM role it is fishy, I would throw in such case.

[linzebing]

OK, let me add the validations

[losipiuk]

Thanks. I made the assertions a bit more explicit and used IllegalArgumentException instead of verify (verify should rather be used for consistency assertions - for things that would never happen if system is working correctly).
PTAL if I did not mess anything up.

[linzebing]

I'm fine with this, but I think my version is more concise. We can merge it still

[losipiuk]

Yeah it is :) But I think actionable error messages are more important than concise code.
I am also dumb - and reading concise code is hard for me :P

[losipiuk]

LGTM.
Small comment on validation

[linzebing]

CI: #12300