feat(auth): add web identity token credential fallback for AWS WIF

[wynbennett]

Summary

• The AWS credential reader in GetCredentials only checked three static env vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN). Environments that use web identity federation — Terraform Enterprise dynamic provider credentials, EKS IRSA, or any OIDC-based workload identity setup — inject credentials via AWS_WEB_IDENTITY_TOKEN_FILE + AWS_ROLE_ARN instead. These were silently ignored, resulting in a "missing AWS credentials" error before any network call was made.
• Add a fallback in GetCredentials: when AWS_SESSION_TOKEN is absent, check for AWS_WEB_IDENTITY_TOKEN_FILE + AWS_ROLE_ARN and exchange the token for STS credentials via AssumeRoleWithWebIdentity. The existing static env var path and ContextAWSVariables override are both unchanged.
• No new dependencies — implementation uses only stdlib (net/http, encoding/xml, os).

Changes

api/datadog/aws.go

• Added stsEndpointOverride field to AWSAuth (unexported, for test injection only)
• Added assumeRoleWithWebIdentity which reads the token file and calls STS directly
• Updated GetCredentials to fall through to web identity when session token env var is absent
• Added constants for AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME

api/datadog/aws_test.go (new)

• TestGetCredentials_EnvVars — static env var path still works
• TestGetCredentials_WebIdentity — web identity exchange against a mock STS server
• TestGetCredentials_WebIdentityMissingEnvVars — graceful fallback when no credentials at all
• TestGetCredentials_ContextOverridesWebIdentity — explicit context takes precedence over env vars

Test plan

• go test ./api/datadog/ -run TestGetCredentials passes (all 4 cases)
• Existing behaviour unchanged: ContextAWSVariables and static env vars continue to work as before
• Verify with a TFE workspace configured with dynamic provider credentials targeting an IAM role

🤖 Generated with Claude Code