Split cloud storage and notification clients into optional extras

[khoaanguyenn]

Is your feature request related to a problem? Please describe.

We use elementary-data[redshift] on an AWS-only stack. Installing elementary forces base dependencies that are irrelevant to our environment — google-cloud-storage (which pulls in google-auth, pyasn1, pyasn1-modules, rsa, and 6 more Google packages), azure-storage-blob (+ azure-core), and pymsteams.

These unused transitive dependencies regularly trigger CVE findings in vulnerability scanners (e.g., Trivy) and block our deployment pipelines. For example, pyasn1 v0.6.2 (CVE-2026-30922) was recently flagged — a package we don't use but can't avoid installing.

Describe the solution you'd like

Move cloud storage and notification clients behind optional extras:

[project.optional-dependencies]
s3 = ["boto3"]
gcs = ["google-cloud-storage"]
azure = ["azure-storage-blob"]
slack = ["slack-sdk"]
teams = ["pymsteams"]

Users would then install only what they need: elementary-data[redshift,s3,slack]

Describe alternatives you've considered

We currently use uv's exclude-dependencies to strip out google-cloud-storage and azure-storage-blob at install time. This works but is fragile — it shifts the maintenance burden to every consumer and must be re-verified on each elementary upgrade.

Additional context

The current base dependencies include clients for all three cloud providers (boto3, google-cloud-storage, azure-storage-blob) and both notification backends (slack-sdk, pymsteams), regardless of which dbt adapter extra is selected. The extras only control database adapters today.

Would you be willing to contribute this feature?

Yes, happy to submit a PR.

[khoaanguyenn]

Update: We discovered that google.auth and azure.storage.blob are imported unconditionally at module load time:

• config.py:5 — import google.auth
• monitor/cli.py:9 → data_monitoring_report.py:8 — from azure.storage.blob import BlobServiceClient

This means consumers cannot work around the bundled deps using package manager exclusions (e.g., uv exclude-dependencies) — doing so causes ModuleNotFoundError on any edr invocation, even when only using S3/Redshift.

Moving these to lazy imports (inside the functions/methods that need them) would unblock exclusion as a workaround while the extras split is implemented.