Add AWS Process Credential Resolver

[jonathan343]

Important

This PR adds a standalone AWS process credential resolver. We do not currently support reading from the shared AWS config file. However, this will unblock anyone from using a process based credential provider.

Overview

This PR adds an AWS process-based credentials resolver to smithy-aws-core so credential providers can source credentials from an external command, while handling the common failure modes and caching behavior expected for both long-lived and temporary credentials.

Summary

• Introduces ProcessCredentialsResolver and ProcessCredentialsConfig in the AWS identity package and exports them as part of the public identity surface.
• Executes a configured credential process asynchronously, validates the returned JSON payload, and converts it into an AWSCredentialsIdentity.
• Handles operational edge cases around process startup failures, timeouts, non-zero exits, unsupported response versions, and missing required credential fields.
• Reuses cached credentials when they are still valid and refreshes them when temporary credentials have expired.
• Improves command handling so callers can provide either explicit argument lists or a shell-style command string.

Testing

• Adds unit coverage for successful credential loading, optional fields, validation failures, timeout and startup error handling, chained-resolver fallback behavior, credential caching/refresh, and multi-argument command parsing.

Note

This was tested with internal AWS process tools for sourcing credentials. TODO: Test with popular external tools.

import asyncio

from aws_sdk_bedrock_runtime.client import BedrockRuntimeClient
from aws_sdk_bedrock_runtime.config import Config
from aws_sdk_bedrock_runtime.models import (
    ContentBlockText,
    ConverseInput,
    Message,
)
from smithy_aws_core.identity import ProcessCredentialsResolver


async def main():
    client = BedrockRuntimeClient(
        config=Config(
            region="us-west-2",
            aws_credentials_identity_resolver=ProcessCredentialsResolver(
                "<insert command here>"
            ),
        )
    )
    input_message = Message(
        role="user", content=[ContentBlockText(value="What is boto3?")]
    )
    response = await client.converse(
        ConverseInput(
            model_id="global.amazon.nova-2-lite-v1:0", messages=[input_message]
        )
    )

    output_message = response.output
    print(output_message)


asyncio.run(main())

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.