[Egress providers - S3 store] Add support for service accounts when running dotnet monitor in kubernetes

[jwreford99]

Summary

Reason for change
As it stands, the S3 egress provider does not currently support the use of service accounts when running dotnet monitor in kubernetes.

This is one of the two recommended ways to give pods permission to access AWS resources via roles. This tends to be recommended over long lived access keys as it removes the need for regular rotation of credentials etc.

Details of change made

The full documentation for this lives here on AWS's documentation site. It uses OpenID Connect to do authentication and is natively supported in the existing C# SDK which is already used. However, there is a note when talking about SDK support for .NET that says:

You must also include AWSSDK.SecurityToken.

This is correlated to my experience trying service accounts on my own kubernetes cluster, as I tried to use service accounts and received the error:

{Succeeded:false,FailureMessage:Assembly AWSSDK.SecurityToken could not be found or loaded. This assembly must be available at runtime to use Amazon.Runtime.AssumeRoleAWSCredentials.}

This happens because the S3 Storage extension already uses FallbackCredentialsFactory.GetCredentials, which does all the authentication work automatically

dotnet-monitor/src/Extensions/S3Storage/S3Storage.cs

Line 71 in cca1dad

awsCredentials ??= FallbackCredentialsFactory.GetCredentials();

(note that the different ways it can be authenticated are best shown in the AWS SDK code itself, which shows it supports Web Identity Credentials (the thing needed for service accounts) as well as credentials from environment variables)

However, that function isn't possible unless AWSSDK.SecurityToken is available at runtime. Therefore, this PR adds a dependency to the S3 project to bring in AWSSDK.SecurityToken

Places I was unsure
I wasn't sure how the dependabot setup works. AFAICT it relies on variables defined in the Versions file, but I couldn't quite figure out how to get that linked up to actually work so any guidance on that would be much appreciated

I also very much welcome any feedback on the documentation, as I wasn't quite sure on tone of voice etc that made sense for this change

I haven't created an issue for this as it was such a small change, however, if you would rather I do so I would be happy to!

Release Notes Entry

Support added for kubernetes service accounts when using the S3 storage egress provider

[jwreford99]

@dotnet-policy-service agree company="Gearset"

[schmittjoseph]

Thanks for looking into this and making this PR with the detailed explanation!

Can you also update this file in this PR? We need to explicitly configuring signing information for 3rd party files:

dotnet-monitor/eng/Signing.props

Lines 2 to 5 in a0927a5

	<ItemGroup>
	<FileSignInfo Include="AWSSDK.Core.dll" CertificateName="3PartySHA2" />
	<FileSignInfo Include="AWSSDK.S3.dll" CertificateName="3PartySHA2" />
	<FileSignInfo Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />

e.g. add a new line with:

    <FileSignInfo Include="AWSSDK.SecurityToken.dll" CertificateName="3PartySHA2" />

[jwreford99]

@schmittjoseph done in c3c0a5f, thanks!

Anything further I need to do with the dependabot so that this new package gets updated correctly?

[schmittjoseph]

@schmittjoseph done in c3c0a5f, thanks!

Anything further I need to do with the dependabot so that this new package gets updated correctly?

Nope, everything looks good in terms of dependabot! We pull our public dependencies from the .NET org's nuget.org mirror(https://dev.azure.com/dnceng/public/_artifacts/feed/dotnet-public) which has a slightly older version of AWSSDK.SecurityToken (the one you've selected already). Since dependabot also looks at this mirror, it won't try to update this dependency yet if you tried to.

[schmittjoseph]

/backport to release/8.x

[github-actions]

Started backporting to release/8.x: https://github.com/dotnet/dotnet-monitor/actions/runs/9116375732

[schmittjoseph]

/backport to release/8.0

[github-actions]

Started backporting to release/8.0: https://github.com/dotnet/dotnet-monitor/actions/runs/9116382467