Repository: apache/beam
Pull request #34440: Enabling long-running jobs to use federated STS assume role authentication for AWS resources.
Author: login: prodriguezdefino
Labels: name: java
name: io
name: aws
name: Next Action: Reviewers
name: reassigned-reviewers
Created: 2025-03-26T19:54:34Z | Merged: 2025-05-22T15:55:14Z

Currently long-running jobs, being those streaming or batch based, have limited options to authenticate against AWS  services when running outside of AWS. In fact, the only viable option for batch pipelines or streaming pipelines that execute for more than X hours is to use a `StaticCredentialsProvider` configuration, this approach imposes some scrutiny given that the use of such provider is discouraged in favor of using [temporary credentials](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-temporary.html). 

AWSOptions enables the configuration of a provider named `StsAssumeRoleWithWebIdentityCredentialsProvider` which will use short-lived credentials and uses OIDC web identity tokens to authenticate the AWS sdk in a federated way. The problem this implementation presents is that once a web identity token is created it normally has a predefined expiration date, for which the AWS requests will fail after the expiration time is reached. 

This change implements a `StsAssumeRoleWithDynamicWebIdentityCredentialsProvider` which can be configured with a FQCN in charge of providing fresh web id tokens that can be used to authenticate against AWS services in a federated way. The implementation delegates to the class `StsAssumeRoleWithWebIdentityCredentialsProvider` most of the logic, but creates the authentication request dynamically and attaches a refreshed web id token for all credential resolution requests.

Also, a simple Google ADC web id token provider (`GoogleADCIdTokenProvider`) is included for convenience, this enables XLang Dataflow pipelines to be configured without the need of including any Java code.  


GitHub Actions Tests Status (on master branch)
------------------------------------------------------------------------------------------------
[![Build python source distribution and wheels](https://github.com/apache/beam/actions/workflows/build_wheels.yml/badge.svg?event=schedule&&?branch=master)](https://github.com/apache/beam/actions?query=workflow%3A%22Build+python+source+distribution+and+wheels%22+branch%3Amaster+event%3Aschedule)
[![Python tests](https://github.com/apache/beam/actions/workflows/python_tests.yml/badge.svg?event=schedule&&?branch=master)](https://github.com/apache/beam/actions?query=workflow%3A%22Python+Tests%22+branch%3Amaster+event%3Aschedule)
[![Java tests](https://github.com/apache/beam/actions/workflows/java_tests.yml/badge.svg?event=schedule&&?branch=master)](https://github.com/apache/beam/actions?query=workflow%3A%22Java+Tests%22+branch%3Amaster+event%3Aschedule)
[![Go tests](https://github.com/apache/beam/actions/workflows/go_tests.yml/badge.svg?event=schedule&&?branch=master)](https://github.com/apache/beam/actions?query=workflow%3A%22Go+tests%22+branch%3Amaster+event%3Aschedule)

See [CI.md](https://github.com/apache/beam/blob/master/CI.md) for more information about GitHub Actions CI or the [workflows README](https://github.com/apache/beam/blob/master/.github/workflows/README.md) to see a list of phrases to trigger workflows.



Diff:
diff --git a/sdks/java/io/amazon-web-services2/build.gradle b/sdks/java/io/amazon-web-services2/build.gradle
index 122fa18de895..b1e80a13153b 100644
--- a/sdks/java/io/amazon-web-services2/build.gradle
+++ b/sdks/java/io/amazon-web-services2/build.gradle
@@ -34,6 +34,7 @@ def excludeNetty = {
 
 dependencies {
   implementation library.java.vendored_guava_32_1_2_jre
+  implementation library.java.vendored_grpc_1_69_0
   implementation library.java.error_prone_annotations
   implementation project(path: ":sdks:java:core", configuration: "shadow")
   implementation library.java.aws_java_sdk2_cloudwatch, excludeNetty
diff --git a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java
new file mode 100644
index 000000000000..5987523518e0
--- /dev/null
+++ b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.auth;
+
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.GoogleCredentials;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenCredentials;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenProvider;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenProvider.Option;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.annotations.VisibleForTesting;
+
+/**
+ * A OIDC web identity token provider implementation that uses the application default credentials
+ * set by the runtime (container, GCE instance, local environment, etc.).
+ *
+ * <p>To configure a long-running (batch or streaming) Dataflow pipeline that interacts with AWS
+ * resources use a similar configuration to:
+ *
+ * <pre>{@code --awsCredentialsProvider={
+ *   "@type": "StsAssumeRoleForFederatedCredentialsProvider",
+ *   "roleArn": "<the AWS ARN of the role to be assumed by the pipeline>",
+ *   "audience": "<the configured Audience for the federated authentication>",
+ *   "webIdTokenProviderFQCN": "org.apache.beam.sdk.io.aws2.auth.GoogleADCIdTokenProvider",
+ *   "durationSeconds": 3600
+ * }}</pre>
+ */
+public class GoogleADCIdTokenProvider implements WebIdTokenProvider {
+  private final IdTokenProvider idTokenProvider;
+
+  public GoogleADCIdTokenProvider() {
+    try {
+      this.idTokenProvider = (IdTokenProvider) GoogleCredentials.getApplicationDefault();
+    } catch (IOException ex) {
+      throw new RuntimeException("Problems while retrieving application default credentials.", ex);
+    }
+  }
+
+  @VisibleForTesting
+  IdTokenCredentials createIdTokenWithApplicationDefaultCredentials(String audience) {
+    return IdTokenCredentials.newBuilder()
+        .setIdTokenProvider(this.idTokenProvider)
+        .setTargetAudience(audience)
+        .setOptions(Arrays.asList(Option.FORMAT_FULL, Option.LICENSES_TRUE))
+        .build();
+  }
+
+  @Override
+  public String resolveTokenValue(String audience) {
+    try {
+      return createIdTokenWithApplicationDefaultCredentials(audience)
+          .refreshAccessToken()
+          .getTokenValue();
+    } catch (IOException ex) {
+      throw new RuntimeException("Problems while refreshing the identification token.", ex);
+    }
+  }
+}
diff --git a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/StsAssumeRoleForFederatedCredentialsProvider.java b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/StsAssumeRoleForFederatedCredentialsProvider.java
new file mode 100644
index 000000000000..ac34366006ae
--- /dev/null
+++ b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/StsAssumeRoleForFederatedCredentialsProvider.java
@@ -0,0 +1,233 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.auth;
+
+import static org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Preconditions.checkState;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.google.auto.value.AutoValue;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.function.Supplier;
+import javax.annotation.Nullable;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Suppliers;
+import software.amazon.awssdk.auth.credentials.AnonymousCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.AwsCredentials;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
+import software.amazon.awssdk.regions.Region;
+import software.amazon.awssdk.services.sts.StsClient;
+import software.amazon.awssdk.services.sts.auth.StsAssumeRoleWithWebIdentityCredentialsProvider;
+import software.amazon.awssdk.services.sts.model.AssumeRoleWithWebIdentityRequest;
+import software.amazon.awssdk.utils.SdkAutoCloseable;
+
+/**
+ * An implementation of AwsCredentialsProvider that periodically sends an {@link
+ * AssumeRoleWithWebIdentityRequest} to the AWS Security Token Service to maintain short-lived
+ * sessions to use for authentication. In particular this class will use a {@link
+ * StsAssumeRoleWithWebIdentityCredentialsProvider} instance as a delegate for the actual
+ * implementation but it takes care of retrieving a refreshed web id token with every credential's
+ * resolution request. This is created using builder().
+ *
+ * @see <a
+ *     href="https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html">API
+ *     reference</a>
+ */
+@AutoValue
+@JsonSubTypes({
+  @JsonSubTypes.Type(
+      value = AutoValue_StsAssumeRoleForFederatedCredentialsProvider.class,
+      name = "StsAssumeRoleForFederatedCredentialsProvider")
+})
+public abstract class StsAssumeRoleForFederatedCredentialsProvider
+    implements AwsCredentialsProvider, SdkAutoCloseable {
+
+  public static final Integer DEFAULT_SESSION_DURATION_SECS = 3600;
+
+  abstract CredentialsProviderDelegate credentialsProviderDelegate();
+
+  public abstract String audience();
+
+  public abstract String assumedRoleArn();
+
+  public abstract String webIdTokenProviderFQCN();
+
+  @Nullable
+  public abstract Integer sessionDurationSecs();
+
+  @Override
+  public AwsCredentials resolveCredentials() {
+    return credentialsProviderDelegate().resolveCredentials();
+  }
+
+  @Override
+  public void close() {
+    credentialsProviderDelegate().close();
+  }
+
+  /**
+   * Creates a builder for the type {@link StsAssumeRoleForFederatedCredentialsProvider}.
+   *
+   * @return an initialized builder instance.
+   */
+  public static StsAssumeRoleForFederatedCredentialsProvider.Builder builder() {
+    return new AutoValue_StsAssumeRoleForFederatedCredentialsProvider.Builder();
+  }
+
+  /** Builder class for {@link StsAssumeRoleForFederatedCredentialsProvider}. */
+  @AutoValue.Builder
+  public abstract static class Builder {
+
+    /**
+     * Sets the role to be assumed by the authentication request.
+     *
+     * @param roleArn the AWS role ARN.
+     * @return this builder instance.
+     */
+    public abstract Builder setAssumedRoleArn(String roleArn);
+
+    /**
+     * Sets the audience to be used for the web id token request.
+     *
+     * @param audience the audience value.
+     * @return this builder instance.
+     */
+    public abstract Builder setAudience(String audience);
+
+    /**
+     * The fully qualified class name for the web id token provider. The class should be accessible
+     * in the classpath.
+     *
+     * @param idTokenProviderFQCN the class name.
+     * @return this builder instance.
+     */
+    public abstract Builder setWebIdTokenProviderFQCN(String idTokenProviderFQCN);
+
+    /**
+     * The session duration in seconds for the authentication request, by default this value is
+     * 3600.
+     *
+     * @param durationSecs the duration in seconds.
+     * @return this builder instance.
+     */
+    public abstract Builder setSessionDurationSecs(@Nullable Integer durationSecs);
+
+    /**
+     * For testing purposes, should not be set in a production setup.
+     *
+     * @param delegate The testing delegate to use.
+     * @return this builder instance.
+     */
+    abstract Builder setCredentialsProviderDelegate(CredentialsProviderDelegate delegate);
+
+    abstract Optional<CredentialsProviderDelegate> credentialsProviderDelegate();
+
+    abstract String assumedRoleArn();
+
+    abstract String audience();
+
+    abstract String webIdTokenProviderFQCN();
+
+    abstract Integer sessionDurationSecs();
+
+    abstract StsAssumeRoleForFederatedCredentialsProvider autoBuild(); // not public
+
+    /**
+     * Validates and fully initializes a {@link StsAssumeRoleForFederatedCredentialsProvider}
+     * instance.
+     *
+     * @return the initialized credentials provider instance.
+     */
+    public StsAssumeRoleForFederatedCredentialsProvider build() {
+      checkState(audience() != null, "Audience value should not be null");
+      checkState(assumedRoleArn() != null, "The role to assume should not be null");
+      checkState(
+          webIdTokenProviderFQCN() != null,
+          "The web id token provider fully qualified class name should not be null");
+      setCredentialsProviderDelegate(
+          credentialsProviderDelegate()
+              .orElse(
+                  CredentialsProviderDelegate.create(
+                      Suppliers.memoize(() -> WebIdTokenProvider.create(webIdTokenProviderFQCN())),
+                      audience(),
+                      assumedRoleArn(),
+                      sessionDurationSecs())));
+      return autoBuild();
+    }
+  }
+
+  /**
+   * Given the {@link StsAssumeRoleWithWebIdentityCredentialsProvider} is final and can not be
+   * easily mocked for testing purposes, this simple delegate container will be used to simplify
+   * unit testing.
+   */
+  static class CredentialsProviderDelegate {
+
+    private final Supplier<StsAssumeRoleWithWebIdentityCredentialsProvider>
+        credentialsProviderDelegate;
+
+    CredentialsProviderDelegate(
+        Supplier<StsAssumeRoleWithWebIdentityCredentialsProvider> credentialsProviderDelegate) {
+      this.credentialsProviderDelegate = credentialsProviderDelegate;
+    }
+
+    public static CredentialsProviderDelegate create(
+        Supplier<WebIdTokenProvider> webIdTokenProvider,
+        String audience,
+        String assumedRoleArn,
+        @Nullable Integer sessionDurationSecs) {
+      return new CredentialsProviderDelegate(
+          Suppliers.memoize(
+              () ->
+                  createCredentialsDelegate(
+                      webIdTokenProvider, audience, assumedRoleArn, sessionDurationSecs)));
+    }
+
+    public AwsCredentials resolveCredentials() {
+      return credentialsProviderDelegate.get().resolveCredentials();
+    }
+
+    public void close() {
+      credentialsProviderDelegate.get().close();
+    }
+
+    static StsAssumeRoleWithWebIdentityCredentialsProvider createCredentialsDelegate(
+        Supplier<WebIdTokenProvider> webIdTokenProvider,
+        String audience,
+        String assumedRoleArn,
+        @Nullable Integer sessionDurationSecs) {
+      return StsAssumeRoleWithWebIdentityCredentialsProvider.builder()
+          .asyncCredentialUpdateEnabled(true)
+          .refreshRequest(
+              () ->
+                  AssumeRoleWithWebIdentityRequest.builder()
+                      .webIdentityToken(webIdTokenProvider.get().resolveTokenValue(audience))
+                      .roleArn(assumedRoleArn)
+                      .roleSessionName("beam-federated-session-" + UUID.randomUUID())
+                      .durationSeconds(
+                          Optional.ofNullable(sessionDurationSecs)
+                              .orElse(DEFAULT_SESSION_DURATION_SECS))
+                      .build())
+          .stsClient(
+              StsClient.builder()
+                  .region(Region.AWS_GLOBAL)
+                  .credentialsProvider(AnonymousCredentialsProvider.create())
+                  .build())
+          .build();
+    }
+  }
+}
diff --git a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/WebIdTokenProvider.java b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/WebIdTokenProvider.java
new file mode 100644
index 000000000000..efdfe540d31c
--- /dev/null
+++ b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/WebIdTokenProvider.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.auth;
+
+import org.apache.beam.sdk.util.InstanceBuilder;
+
+/**
+ * Defines the behavior for a OIDC web identity token provider. Instances of this interface will be
+ * used by an AWS credentials provider which will send the OIDC Token retrieved to dynamically
+ * refresh federated authorized credentials.
+ */
+public interface WebIdTokenProvider {
+  /**
+   * Factory method for OIDC web identity token provider implementations.
+   *
+   * @param providerFQCN The fully qualified class name of an implementation of {@link
+   *     WebIdTokenProvider}.
+   * @return An instance of {@link WebIdTokenProvider}.
+   */
+  static WebIdTokenProvider create(String providerFQCN) {
+    try {
+      return InstanceBuilder.ofType(WebIdTokenProvider.class).fromClassName(providerFQCN).build();
+    } catch (ClassNotFoundException e) {
+      throw new RuntimeException(
+          "Problems while trying to instantiate a dynamic web id token provider class.", e);
+    }
+  }
+
+  /**
+   * Resolves the value for a OIDC web identity token.
+   *
+   * @param audience The audience for the token.
+   * @return The encoded value for the OIDC web identity token.
+   */
+  String resolveTokenValue(String audience);
+}
diff --git a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/package-info.java b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/package-info.java
new file mode 100644
index 000000000000..ff47823d0fad
--- /dev/null
+++ b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/package-info.java
@@ -0,0 +1,20 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** Common code for AWS authentication related functionalities. */
+package org.apache.beam.sdk.io.aws2.auth;
diff --git a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java
index 12ae1abfe446..69331cc05dc1 100644
--- a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java
+++ b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java
@@ -43,8 +43,10 @@
 import com.fasterxml.jackson.databind.util.NameTransformer;
 import com.google.auto.service.AutoService;
 import java.io.IOException;
+import java.util.Optional;
 import java.util.function.Supplier;
 import org.apache.beam.repackaged.core.org.apache.commons.lang3.reflect.FieldUtils;
+import org.apache.beam.sdk.io.aws2.auth.StsAssumeRoleForFederatedCredentialsProvider;
 import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.collect.ImmutableSet;
 import org.checkerframework.checker.nullness.qual.NonNull;
 import software.amazon.awssdk.auth.credentials.AnonymousCredentialsProvider;
@@ -77,6 +79,10 @@ public class AwsModule extends SimpleModule {
   private static final String SECRET_ACCESS_KEY = "secretAccessKey";
   private static final String SESSION_TOKEN = "sessionToken";
   private static final String PROFILE_NAME = "profileName";
+  private static final String ROLE_ARN = "roleArn";
+  private static final String AUDIENCE = "audience";
+  private static final String WEBID_TOKEN_FQCN = "webIdTokenProviderFQCN";
+  private static final String SESSION_DURATION_SECONDS = "durationSeconds";
 
   public AwsModule() {
     super("AwsModule");
@@ -186,6 +192,18 @@ public AwsCredentialsProvider deserializeWithType(
                     .credentialsProvider(AnonymousCredentialsProvider.create())
                     .build())
             .build();
+      } else if (typeName.equals(
+          StsAssumeRoleForFederatedCredentialsProvider.class.getSimpleName())) {
+        return StsAssumeRoleForFederatedCredentialsProvider.builder()
+            .setAudience(getNotNull(json, AUDIENCE, typeName))
+            .setAssumedRoleArn(getNotNull(json, ROLE_ARN, typeName))
+            .setWebIdTokenProviderFQCN(getNotNull(json, WEBID_TOKEN_FQCN, typeName))
+            .setSessionDurationSecs(
+                Optional.ofNullable(json.get(SESSION_DURATION_SECONDS))
+                    .map(JsonNode::asInt)
+                    .orElse(
+                        StsAssumeRoleForFederatedCredentialsProvider.DEFAULT_SESSION_DURATION_SECS))
+            .build();
       } else {
         throw new IOException(
             String.format("AWS credential provider type '%s' is not supported", typeName));
@@ -265,6 +283,16 @@ public void serializeWithType(
             .findValueSerializer(AssumeRoleWithWebIdentityRequest.serializableBuilderClass())
             .unwrappingSerializer(NameTransformer.NOP)
             .serialize(reqSupplier.get().toBuilder(), jsonGenerator, serializer);
+      } else if (credentialsProvider instanceof StsAssumeRoleForFederatedCredentialsProvider) {
+        StsAssumeRoleForFederatedCredentialsProvider provider =
+            (StsAssumeRoleForFederatedCredentialsProvider) credentialsProvider;
+        jsonGenerator.writeStringField(AUDIENCE, provider.audience());
+        jsonGenerator.writeStringField(ROLE_ARN, provider.assumedRoleArn());
+        jsonGenerator.writeStringField(WEBID_TOKEN_FQCN, provider.webIdTokenProviderFQCN());
+        Integer sessionDurationSecs = provider.sessionDurationSecs();
+        if (sessionDurationSecs != null) {
+          jsonGenerator.writeNumberField(SESSION_DURATION_SECONDS, sessionDurationSecs);
+        }
       } else if (!SINGLETON_CREDENTIAL_PROVIDERS.contains(providerClass)) {
         throw new IllegalArgumentException(
             "Unsupported AWS credentials provider type " + providerClass);
diff --git a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsOptions.java b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsOptions.java
index 482e3aa9cc92..aa5965fcaaa0 100644
--- a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsOptions.java
+++ b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsOptions.java
@@ -18,6 +18,8 @@
 package org.apache.beam.sdk.io.aws2.options;
 
 import java.net.URI;
+import org.apache.beam.sdk.io.aws2.auth.StsAssumeRoleForFederatedCredentialsProvider;
+import org.apache.beam.sdk.io.aws2.auth.WebIdTokenProvider;
 import org.apache.beam.sdk.io.aws2.common.ClientBuilderFactory;
 import org.apache.beam.sdk.io.aws2.common.HttpClientConfiguration;
 import org.apache.beam.sdk.options.Default;
@@ -146,6 +148,21 @@ public Region create(PipelineOptions options) {
    *   "durationSeconds": 3600
    * }}</pre>
    *
+   * <li>{@link StsAssumeRoleForFederatedCredentialsProvider}
+   *
+   *     <p>Similar to {@link StsAssumeRoleWithWebIdentityCredentialsProvider} but supporting
+   *     long-running jobs. The configuration expects the FQCN for an implementation of {@link
+   *     WebIdTokenProvider} which will be used to retrieve a fresh token with each STS auth
+   *     request.
+   *
+   *     <pre>{@code --awsCredentialsProvider={
+   *   "@type": "StsAssumeRoleWithDynamicWebIdentityCredentialsProvider",
+   *   "roleArn": "role_arn_Value",
+   *   "audience": "audience_value",
+   *   "webIdTokenProviderFQCN": "fully_qualified_class_name",
+   *   "durationSeconds": 3600
+   * }}</pre>
+   *
    * @see DefaultCredentialsProvider
    */
   @Description(
diff --git a/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProviderTest.java b/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProviderTest.java
new file mode 100644
index 000000000000..649908fbe11f
--- /dev/null
+++ b/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProviderTest.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.auth;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.when;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.AccessToken;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenCredentials;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Splitter;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.collect.Iterables;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+
+@RunWith(MockitoJUnitRunner.class)
+public class GoogleADCIdTokenProviderTest {
+
+  @Mock private IdTokenCredentials idTokenCredentials;
+  @Mock private AccessToken accessToken;
+
+  @Before
+  public void before() throws IOException {
+    String header = "{\"alg\": \"RS256\",\"typ\": \"JWT\"}";
+    String payload =
+        "{\"aud\": \"some-audience\","
+            + "\"azp\": \"some-email@google.com\","
+            + "\"email\": \"some-email@google.com\","
+            + "\"email_verified\": true,"
+            + "\"iss\": \"https://accounts.google.com\"}";
+    String signature = "some-garbled-data-to-be-encoded";
+    String returnedToken =
+        Base64.getUrlEncoder().encodeToString(header.getBytes(StandardCharsets.UTF_8))
+            + "."
+            + Base64.getUrlEncoder().encodeToString(payload.getBytes(StandardCharsets.UTF_8))
+            + "."
+            + Base64.getUrlEncoder().encodeToString(signature.getBytes(StandardCharsets.UTF_8));
+    when(accessToken.getTokenValue()).thenReturn(returnedToken);
+    when(idTokenCredentials.refreshAccessToken()).thenReturn(accessToken);
+  }
+
+  @Test
+  public void retrieveTokenValueWithAudience() {
+    GoogleADCIdTokenProvider provider = spy(new GoogleADCIdTokenProvider());
+    when(provider.createIdTokenWithApplicationDefaultCredentials(anyString()))
+        .thenReturn(idTokenCredentials);
+    String audience = "some-audience";
+
+    String token = provider.resolveTokenValue(audience);
+
+    String decodedToken =
+        new String(
+            Base64.getUrlDecoder().decode(Iterables.get(Splitter.on('.').split(token), 1)),
+            StandardCharsets.UTF_8);
+    assertThat(decodedToken).contains(audience);
+  }
+}
diff --git a/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/auth/StsAssumeRoleForFederatedCredentialsProviderTest.java b/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/auth/StsAssumeRoleForFederatedCredentialsProviderTest.java
new file mode 100644
index 000000000000..9d6e95db3e66
--- /dev/null
+++ b/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/auth/StsAssumeRoleForFederatedCredentialsProviderTest.java
@@ -0,0 +1,97 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.auth;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.when;
+
+import org.apache.beam.sdk.io.aws2.auth.StsAssumeRoleForFederatedCredentialsProvider.CredentialsProviderDelegate;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+import software.amazon.awssdk.auth.credentials.AwsCredentials;
+
+@RunWith(MockitoJUnitRunner.class)
+public class StsAssumeRoleForFederatedCredentialsProviderTest {
+  private static final String AUDIENCE = "some static audience";
+  private static final String ASSUMED_ROLE = "some role";
+  private static final String TEST_WEBTOKEN_PROVIDER =
+      "org.apache.beam.sdk.io.aws2.auth.StsAssumeRoleForFederatedCredentialsProviderTest$TestTokenProvider";
+  private static final String FAKE_ACCESS_KEY = "some-access-key";
+  private static final String FAKE_SECRET_KEY = "some-secret-key";
+
+  @Mock private AwsCredentials mockedCredentials;
+  @Mock private CredentialsProviderDelegate mockedProvider;
+
+  @Before
+  public void before() {
+    when(mockedCredentials.accessKeyId()).thenReturn(FAKE_ACCESS_KEY);
+    when(mockedCredentials.secretAccessKey()).thenReturn(FAKE_SECRET_KEY);
+    when(mockedProvider.resolveCredentials()).thenReturn(mockedCredentials);
+  }
+
+  @Test
+  public void retrieveAwsCredentials() {
+    StsAssumeRoleForFederatedCredentialsProvider provider =
+        StsAssumeRoleForFederatedCredentialsProvider.builder()
+            .setAssumedRoleArn(ASSUMED_ROLE)
+            .setAudience(AUDIENCE)
+            .setWebIdTokenProviderFQCN(TEST_WEBTOKEN_PROVIDER)
+            .setCredentialsProviderDelegate(mockedProvider)
+            .build();
+
+    AwsCredentials credentials = provider.resolveCredentials();
+
+    // make sure we are using the faked credentials, not something set on a local profile.
+    assertThat(credentials.accessKeyId()).isEqualTo(FAKE_ACCESS_KEY);
+    assertThat(credentials.secretAccessKey()).isEqualTo(FAKE_SECRET_KEY);
+  }
+
+  @Test(expected = IllegalStateException.class)
+  public void mustFailWithoutRole() {
+    StsAssumeRoleForFederatedCredentialsProvider.builder()
+        .setAudience(AUDIENCE)
+        .setWebIdTokenProviderFQCN(TEST_WEBTOKEN_PROVIDER)
+        .build();
+  }
+
+  @Test(expected = IllegalStateException.class)
+  public void mustFailWithoutAudience() {
+    StsAssumeRoleForFederatedCredentialsProvider.builder()
+        .setAssumedRoleArn(ASSUMED_ROLE)
+        .setWebIdTokenProviderFQCN(TEST_WEBTOKEN_PROVIDER)
+        .build();
+  }
+
+  @Test(expected = IllegalStateException.class)
+  public void mustFailWithoutIdTokenProvider() {
+    StsAssumeRoleForFederatedCredentialsProvider.builder()
+        .setAssumedRoleArn(ASSUMED_ROLE)
+        .setAudience(AUDIENCE)
+        .build();
+  }
+
+  public static class TestTokenProvider implements WebIdTokenProvider {
+    @Override
+    public String resolveTokenValue(String audience) {
+      return "some token for audience " + audience;
+    }
+  }
+}
diff --git a/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/options/AwsModuleTest.java b/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/options/AwsModuleTest.java
index ce4826109a79..ee265cc50419 100644
--- a/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/options/AwsModuleTest.java
+++ b/sdks/java/io/amazon-web-services2/src/test/java/org/apache/beam/sdk/io/aws2/options/AwsModuleTest.java
@@ -41,6 +41,7 @@
 import java.util.List;
 import java.util.Properties;
 import java.util.function.Supplier;
+import org.apache.beam.sdk.io.aws2.auth.StsAssumeRoleForFederatedCredentialsProvider;
 import org.apache.beam.sdk.testing.ExpectedLogs;
 import org.apache.beam.sdk.util.ThrowingSupplier;
 import org.apache.beam.sdk.util.common.ReflectHelpers;
@@ -279,6 +280,57 @@ public void testStsAssumeRoleWithWebIdentityCredentialsProviderSerDe() throws Ex
     assertThat(requestSupplier.get()).isEqualTo(req);
   }
 
+  @Test
+  public void testStsAssumeRoleWithDynamicWebIdentityCredentialsProviderSerDe() {
+    String roleArn = "roleArn";
+    String audience = "audience";
+    String webTokenProviderFQCN = "some.class.Name";
+    Integer sessionDurationSecs = 30;
+    AwsCredentialsProvider provider =
+        StsAssumeRoleForFederatedCredentialsProvider.builder()
+            .setAssumedRoleArn(roleArn)
+            .setAudience(audience)
+            .setWebIdTokenProviderFQCN(webTokenProviderFQCN)
+            .setSessionDurationSecs(sessionDurationSecs)
+            .build();
+
+    // Deserialize without credentials from system properties
+    AwsCredentialsProvider deserializedProvider = serializeAndDeserialize(provider);
+
+    assertThat(deserializedProvider)
+        .isInstanceOf(StsAssumeRoleForFederatedCredentialsProvider.class);
+    StsAssumeRoleForFederatedCredentialsProvider castedProvider =
+        (StsAssumeRoleForFederatedCredentialsProvider) deserializedProvider;
+    assertThat(castedProvider.assumedRoleArn()).isEqualTo(roleArn);
+    assertThat(castedProvider.audience()).isEqualTo(audience);
+    assertThat(castedProvider.webIdTokenProviderFQCN()).isEqualTo(webTokenProviderFQCN);
+    assertThat(castedProvider.sessionDurationSecs()).isEqualTo(sessionDurationSecs);
+  }
+
+  @Test
+  public void testStsAssumeRoleWithDynamicWebIdentityCredentialsProviderSerDeNoSessionDuration() {
+    String roleArn = "roleArn";
+    String audience = "audience";
+    String webTokenProviderFQCN = "some.class.Name";
+    AwsCredentialsProvider provider =
+        StsAssumeRoleForFederatedCredentialsProvider.builder()
+            .setAssumedRoleArn(roleArn)
+            .setAudience(audience)
+            .setWebIdTokenProviderFQCN(webTokenProviderFQCN)
+            .build();
+
+    // Deserialize without credentials from system properties
+    AwsCredentialsProvider deserializedProvider = serializeAndDeserialize(provider);
+
+    assertThat(deserializedProvider)
+        .isInstanceOf(StsAssumeRoleForFederatedCredentialsProvider.class);
+    StsAssumeRoleForFederatedCredentialsProvider castedProvider =
+        (StsAssumeRoleForFederatedCredentialsProvider) deserializedProvider;
+    assertThat(castedProvider.assumedRoleArn()).isEqualTo(roleArn);
+    assertThat(castedProvider.audience()).isEqualTo(audience);
+    assertThat(castedProvider.webIdTokenProviderFQCN()).isEqualTo(webTokenProviderFQCN);
+  }
+
   @Test
   public void testProxyConfigurationSerDe() {
     ProxyConfiguration proxyConfiguration =


Reviews:
user: login: Abacn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T02:29:49Z
user: login: Abacn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T02:56:20Z
user: login: prodriguezdefino
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T19:25:31Z
user: login: prodriguezdefino
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T19:30:17Z
user: login: Abacn
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-22T15:54:46Z

Review comments:
diff_hunk: @@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.common.auth.providers;
path: sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/auth/providers/GoogleADCIdTokenProvider.java
user: login: Abacn
body: package name is 9 level nested long. Consider put into  .../auth/providers or just under .../auth ?
created_at: 2025-05-09T01:18:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.common.auth.providers;
+
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.GoogleCredentials;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenCredentials;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenProvider;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenProvider.Option;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.annotations.VisibleForTesting;
+
+/**
+ * A OIDC web identity token provider implementation that uses the application default credentials
+ * set by the runtime (container, GCE instance, local environment, etc.).
+ */
+public class GoogleADCIdTokenProvider implements WebIdTokenProvider {
path: sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/auth/providers/GoogleADCIdTokenProvider.java
user: login: Abacn
body: This class is not used. Is it user faced? If so, please elaborate javadoc with instructions and use cases
created_at: 2025-05-09T01:31:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,233 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.common.auth.providers;
+
+import static org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Preconditions.checkState;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.google.auto.value.AutoValue;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.function.Supplier;
+import javax.annotation.Nullable;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Suppliers;
+import software.amazon.awssdk.auth.credentials.AnonymousCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.AwsCredentials;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
+import software.amazon.awssdk.regions.Region;
+import software.amazon.awssdk.services.sts.StsClient;
+import software.amazon.awssdk.services.sts.auth.StsAssumeRoleWithWebIdentityCredentialsProvider;
+import software.amazon.awssdk.services.sts.model.AssumeRoleWithWebIdentityRequest;
+import software.amazon.awssdk.utils.SdkAutoCloseable;
+
+/**
+ * An implementation of AwsCredentialsProvider that periodically sends an {@link
+ * AssumeRoleWithWebIdentityRequest} to the AWS Security Token Service to maintain short-lived
+ * sessions to use for authentication. In particular this class will use a {@link
+ * StsAssumeRoleWithWebIdentityCredentialsProvider} instance as a delegate for the actual
+ * implementation but it takes care of retrieving a refreshed web id token with every credential's
+ * resolution request. This is created using builder().
+ *
+ * @see <a
+ *     href="https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html">API
+ *     reference</a>
+ */
+@AutoValue
+@JsonSubTypes({
+  @JsonSubTypes.Type(
+      value = AutoValue_StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.class,
+      name = "StsAssumeRoleWithDynamicWebIdentityCredentialsProvider")
+})
+public abstract class StsAssumeRoleWithDynamicWebIdentityCredentialsProvider
path: sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/auth/providers/StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.java
user: login: Abacn
body: `StsAssumeRoleWithWebIdentityCredentialsProvider` is already very long naming. This wrapper provider is even longer...
created_at: 2025-05-09T01:58:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,233 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.common.auth.providers;
+
+import static org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Preconditions.checkState;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.google.auto.value.AutoValue;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.function.Supplier;
+import javax.annotation.Nullable;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Suppliers;
+import software.amazon.awssdk.auth.credentials.AnonymousCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.AwsCredentials;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
+import software.amazon.awssdk.regions.Region;
+import software.amazon.awssdk.services.sts.StsClient;
+import software.amazon.awssdk.services.sts.auth.StsAssumeRoleWithWebIdentityCredentialsProvider;
+import software.amazon.awssdk.services.sts.model.AssumeRoleWithWebIdentityRequest;
+import software.amazon.awssdk.utils.SdkAutoCloseable;
+
+/**
+ * An implementation of AwsCredentialsProvider that periodically sends an {@link
+ * AssumeRoleWithWebIdentityRequest} to the AWS Security Token Service to maintain short-lived
+ * sessions to use for authentication. In particular this class will use a {@link
+ * StsAssumeRoleWithWebIdentityCredentialsProvider} instance as a delegate for the actual
+ * implementation but it takes care of retrieving a refreshed web id token with every credential's
+ * resolution request. This is created using builder().
+ *
+ * @see <a
+ *     href="https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html">API
+ *     reference</a>
+ */
+@AutoValue
+@JsonSubTypes({
+  @JsonSubTypes.Type(
+      value = AutoValue_StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.class,
+      name = "StsAssumeRoleWithDynamicWebIdentityCredentialsProvider")
+})
+public abstract class StsAssumeRoleWithDynamicWebIdentityCredentialsProvider
+    implements AwsCredentialsProvider, SdkAutoCloseable {
+
+  public static final Integer DEFAULT_SESSION_DURATION_SECS = 3600;
+
+  abstract CredentialsProviderDelegate credentialsProviderDelegate();
+
+  public abstract String audience();
+
+  public abstract String assumedRoleArn();
+
+  public abstract String webIdTokenProviderFQCN();
+
+  @Nullable
+  public abstract Integer sessionDurationSecs();
+
+  @Override
+  public AwsCredentials resolveCredentials() {
+    return credentialsProviderDelegate().resolveCredentials();
+  }
+
+  @Override
+  public void close() {
+    credentialsProviderDelegate().close();
+  }
+
+  /**
+   * Creates a builder for the type {@link StsAssumeRoleWithDynamicWebIdentityCredentialsProvider}.
+   *
+   * @return an initialized builder instance.
+   */
+  public static StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.Builder builder() {
+    return new AutoValue_StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.Builder();
+  }
+
+  /** Builder class for {@link StsAssumeRoleWithDynamicWebIdentityCredentialsProvider}. */
+  @AutoValue.Builder
+  public abstract static class Builder {
+
+    /**
+     * Sets the role to be assumed by the authentication request.
+     *
+     * @param roleArn the AWS role ARN.
+     * @return this builder instance.
+     */
+    public abstract Builder setAssumedRoleArn(String roleArn);
+
+    /**
+     * Sets the audience to be used for the web id token request.
+     *
+     * @param audience the audience value.
+     * @return this builder instance.
+     */
+    public abstract Builder setAudience(String audience);
+
+    /**
+     * The fully qualified class name for the web id token provider. The class should be accessible
+     * in the classpath.
+     *
+     * @param idTokenProviderFQCN the class name.
+     * @return this builder instance.
+     */
+    public abstract Builder setWebIdTokenProviderFQCN(String idTokenProviderFQCN);
+
+    /**
+     * The session duration in seconds for the authentication request, by default this value is
+     * 3600.
+     *
+     * @param durationSecs the duration in seconds.
+     * @return this builder instance.
+     */
+    public abstract Builder setSessionDurationSecs(@Nullable Integer durationSecs);
+
+    /**
+     * For testing purposes, should not be set in a production setup.
+     *
+     * @param delegate The testing delegate to use.
+     * @return this builder instance.
+     */
+    abstract Builder setCredentialsProviderDelegate(CredentialsProviderDelegate delegate);
+
+    abstract Optional<CredentialsProviderDelegate> credentialsProviderDelegate();
+
+    abstract String assumedRoleArn();
+
+    abstract String audience();
+
+    abstract String webIdTokenProviderFQCN();
+
+    abstract Integer sessionDurationSecs();
+
+    abstract StsAssumeRoleWithDynamicWebIdentityCredentialsProvider autoBuild(); // not public
+
+    /**
+     * Validates and fully initializes a {@link
+     * StsAssumeRoleWithDynamicWebIdentityCredentialsProvider} instance.
+     *
+     * @return the initialized credentials provider instance.
+     */
+    public StsAssumeRoleWithDynamicWebIdentityCredentialsProvider build() {
+      checkState(audience() != null, "Audience value should not be null");
+      checkState(assumedRoleArn() != null, "The role to assume should not be null");
+      checkState(
+          webIdTokenProviderFQCN() != null,
+          "The web id token provider fully qualified class name should not be null");
+      setCredentialsProviderDelegate(
+          credentialsProviderDelegate()
+              .orElse(
+                  CredentialsProviderDelegate.create(
+                      Suppliers.memoize(() -> WebIdTokenProvider.create(webIdTokenProviderFQCN())),
+                      audience(),
+                      assumedRoleArn(),
+                      sessionDurationSecs())));
+      return autoBuild();
+    }
+  }
+
+  /**
+   * Given the {@link StsAssumeRoleWithWebIdentityCredentialsProvider} is final and can not be
+   * easily mocked for testing purposes, this simple delegate container will be used to simplify
+   * unit testing.
+   */
+  static class CredentialsProviderDelegate {
+
+    private final Supplier<StsAssumeRoleWithWebIdentityCredentialsProvider>
+        credentialsProviderDelegate;
+
+    CredentialsProviderDelegate(
+        Supplier<StsAssumeRoleWithWebIdentityCredentialsProvider> credentialsProviderDelegate) {
+      this.credentialsProviderDelegate = credentialsProviderDelegate;
+    }
+
+    public static CredentialsProviderDelegate create(
+        Supplier<WebIdTokenProvider> webIdTokenProvider,
+        String audience,
+        String assumedRoleArn,
+        @Nullable Integer sessionDurationSecs) {
+      return new CredentialsProviderDelegate(
+          Suppliers.memoize(
+              () ->
+                  createCredentialsDelegate(
+                      webIdTokenProvider, audience, assumedRoleArn, sessionDurationSecs)));
+    }
+
+    public AwsCredentials resolveCredentials() {
+      return credentialsProviderDelegate.get().resolveCredentials();
+    }
+
+    public void close() {
+      credentialsProviderDelegate.get().close();
+    }
+
+    static StsAssumeRoleWithWebIdentityCredentialsProvider createCredentialsDelegate(
+        Supplier<WebIdTokenProvider> webIdTokenProvider,
+        String audience,
+        String assumedRoleArn,
+        @Nullable Integer sessionDurationSecs) {
+      return StsAssumeRoleWithWebIdentityCredentialsProvider.builder()
+          .asyncCredentialUpdateEnabled(true)
+          .refreshRequest(
path: sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/auth/providers/StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.java
user: login: Abacn
body: does this "refreshRequest" correspond to the functionality that

> An implementation of AwsCredentialsProvider that periodically sends an {@link
> AssumeRoleWithWebIdentityRequest} to the AWS

If so why we really need this wrapper provider instead of setup a StsAssumeRoleWithWebIdentityCredentialsProvider with refreshRequest ?
created_at: 2025-05-09T02:56:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.common.auth.providers;
+
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.GoogleCredentials;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenCredentials;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenProvider;
+import org.apache.beam.vendor.grpc.v1p69p0.com.google.auth.oauth2.IdTokenProvider.Option;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.annotations.VisibleForTesting;
+
+/**
+ * A OIDC web identity token provider implementation that uses the application default credentials
+ * set by the runtime (container, GCE instance, local environment, etc.).
+ */
+public class GoogleADCIdTokenProvider implements WebIdTokenProvider {
path: sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/auth/providers/GoogleADCIdTokenProvider.java
user: login: prodriguezdefino
body: I will add a usage example, basically this class is what enables the STS assume role with WeebId authentication for AWS resources through a configuration (reflection is used to instantiate it) for Dataflow running workloads.
created_at: 2025-05-19T19:25:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,233 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.beam.sdk.io.aws2.common.auth.providers;
+
+import static org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Preconditions.checkState;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.google.auto.value.AutoValue;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.function.Supplier;
+import javax.annotation.Nullable;
+import org.apache.beam.vendor.guava.v32_1_2_jre.com.google.common.base.Suppliers;
+import software.amazon.awssdk.auth.credentials.AnonymousCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.AwsCredentials;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
+import software.amazon.awssdk.regions.Region;
+import software.amazon.awssdk.services.sts.StsClient;
+import software.amazon.awssdk.services.sts.auth.StsAssumeRoleWithWebIdentityCredentialsProvider;
+import software.amazon.awssdk.services.sts.model.AssumeRoleWithWebIdentityRequest;
+import software.amazon.awssdk.utils.SdkAutoCloseable;
+
+/**
+ * An implementation of AwsCredentialsProvider that periodically sends an {@link
+ * AssumeRoleWithWebIdentityRequest} to the AWS Security Token Service to maintain short-lived
+ * sessions to use for authentication. In particular this class will use a {@link
+ * StsAssumeRoleWithWebIdentityCredentialsProvider} instance as a delegate for the actual
+ * implementation but it takes care of retrieving a refreshed web id token with every credential's
+ * resolution request. This is created using builder().
+ *
+ * @see <a
+ *     href="https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html">API
+ *     reference</a>
+ */
+@AutoValue
+@JsonSubTypes({
+  @JsonSubTypes.Type(
+      value = AutoValue_StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.class,
+      name = "StsAssumeRoleWithDynamicWebIdentityCredentialsProvider")
+})
+public abstract class StsAssumeRoleWithDynamicWebIdentityCredentialsProvider
+    implements AwsCredentialsProvider, SdkAutoCloseable {
+
+  public static final Integer DEFAULT_SESSION_DURATION_SECS = 3600;
+
+  abstract CredentialsProviderDelegate credentialsProviderDelegate();
+
+  public abstract String audience();
+
+  public abstract String assumedRoleArn();
+
+  public abstract String webIdTokenProviderFQCN();
+
+  @Nullable
+  public abstract Integer sessionDurationSecs();
+
+  @Override
+  public AwsCredentials resolveCredentials() {
+    return credentialsProviderDelegate().resolveCredentials();
+  }
+
+  @Override
+  public void close() {
+    credentialsProviderDelegate().close();
+  }
+
+  /**
+   * Creates a builder for the type {@link StsAssumeRoleWithDynamicWebIdentityCredentialsProvider}.
+   *
+   * @return an initialized builder instance.
+   */
+  public static StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.Builder builder() {
+    return new AutoValue_StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.Builder();
+  }
+
+  /** Builder class for {@link StsAssumeRoleWithDynamicWebIdentityCredentialsProvider}. */
+  @AutoValue.Builder
+  public abstract static class Builder {
+
+    /**
+     * Sets the role to be assumed by the authentication request.
+     *
+     * @param roleArn the AWS role ARN.
+     * @return this builder instance.
+     */
+    public abstract Builder setAssumedRoleArn(String roleArn);
+
+    /**
+     * Sets the audience to be used for the web id token request.
+     *
+     * @param audience the audience value.
+     * @return this builder instance.
+     */
+    public abstract Builder setAudience(String audience);
+
+    /**
+     * The fully qualified class name for the web id token provider. The class should be accessible
+     * in the classpath.
+     *
+     * @param idTokenProviderFQCN the class name.
+     * @return this builder instance.
+     */
+    public abstract Builder setWebIdTokenProviderFQCN(String idTokenProviderFQCN);
+
+    /**
+     * The session duration in seconds for the authentication request, by default this value is
+     * 3600.
+     *
+     * @param durationSecs the duration in seconds.
+     * @return this builder instance.
+     */
+    public abstract Builder setSessionDurationSecs(@Nullable Integer durationSecs);
+
+    /**
+     * For testing purposes, should not be set in a production setup.
+     *
+     * @param delegate The testing delegate to use.
+     * @return this builder instance.
+     */
+    abstract Builder setCredentialsProviderDelegate(CredentialsProviderDelegate delegate);
+
+    abstract Optional<CredentialsProviderDelegate> credentialsProviderDelegate();
+
+    abstract String assumedRoleArn();
+
+    abstract String audience();
+
+    abstract String webIdTokenProviderFQCN();
+
+    abstract Integer sessionDurationSecs();
+
+    abstract StsAssumeRoleWithDynamicWebIdentityCredentialsProvider autoBuild(); // not public
+
+    /**
+     * Validates and fully initializes a {@link
+     * StsAssumeRoleWithDynamicWebIdentityCredentialsProvider} instance.
+     *
+     * @return the initialized credentials provider instance.
+     */
+    public StsAssumeRoleWithDynamicWebIdentityCredentialsProvider build() {
+      checkState(audience() != null, "Audience value should not be null");
+      checkState(assumedRoleArn() != null, "The role to assume should not be null");
+      checkState(
+          webIdTokenProviderFQCN() != null,
+          "The web id token provider fully qualified class name should not be null");
+      setCredentialsProviderDelegate(
+          credentialsProviderDelegate()
+              .orElse(
+                  CredentialsProviderDelegate.create(
+                      Suppliers.memoize(() -> WebIdTokenProvider.create(webIdTokenProviderFQCN())),
+                      audience(),
+                      assumedRoleArn(),
+                      sessionDurationSecs())));
+      return autoBuild();
+    }
+  }
+
+  /**
+   * Given the {@link StsAssumeRoleWithWebIdentityCredentialsProvider} is final and can not be
+   * easily mocked for testing purposes, this simple delegate container will be used to simplify
+   * unit testing.
+   */
+  static class CredentialsProviderDelegate {
+
+    private final Supplier<StsAssumeRoleWithWebIdentityCredentialsProvider>
+        credentialsProviderDelegate;
+
+    CredentialsProviderDelegate(
+        Supplier<StsAssumeRoleWithWebIdentityCredentialsProvider> credentialsProviderDelegate) {
+      this.credentialsProviderDelegate = credentialsProviderDelegate;
+    }
+
+    public static CredentialsProviderDelegate create(
+        Supplier<WebIdTokenProvider> webIdTokenProvider,
+        String audience,
+        String assumedRoleArn,
+        @Nullable Integer sessionDurationSecs) {
+      return new CredentialsProviderDelegate(
+          Suppliers.memoize(
+              () ->
+                  createCredentialsDelegate(
+                      webIdTokenProvider, audience, assumedRoleArn, sessionDurationSecs)));
+    }
+
+    public AwsCredentials resolveCredentials() {
+      return credentialsProviderDelegate.get().resolveCredentials();
+    }
+
+    public void close() {
+      credentialsProviderDelegate.get().close();
+    }
+
+    static StsAssumeRoleWithWebIdentityCredentialsProvider createCredentialsDelegate(
+        Supplier<WebIdTokenProvider> webIdTokenProvider,
+        String audience,
+        String assumedRoleArn,
+        @Nullable Integer sessionDurationSecs) {
+      return StsAssumeRoleWithWebIdentityCredentialsProvider.builder()
+          .asyncCredentialUpdateEnabled(true)
+          .refreshRequest(
path: sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/auth/providers/StsAssumeRoleWithDynamicWebIdentityCredentialsProvider.java
user: login: prodriguezdefino
body: See the [configuration serialization](https://github.com/apache/beam/blob/master/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java#L261), it grabs the generated token and serializes it. When the options are propagated to workers the token value is deserialized and used for authentication, this of course works only for a limited period of time (until the provided token value expires). 

All classes in the STS package are final, so we need to rely on delegates to implement the logic we need here (which is generate a new token for every refresh request from the AWS auth framework). 
created_at: 2025-05-19T19:30:16Z
author_association: CONTRIBUTOR

PR comments:
user: login: prodriguezdefino
created_at: 2025-03-26T20:25:06Z
body: fixes #34441 
author_association: CONTRIBUTOR
user: login: prodriguezdefino
created_at: 2025-03-27T00:52:15Z
body: Run Java_Amazon-Web-Services2_IO_Direct PreCommit
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-03-27T01:34:35Z
body: Assigning reviewers. If you would like to opt out of this review, comment `assign to next reviewer`:

R: @m-trieu for label java.
R: @chamikaramj for label io.

Available commands:
- `stop reviewer notifications` - opt out of the automated review tooling
- `remind me after tests pass` - tag the comment author after tests pass
- `waiting on author` - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-04-03T12:14:32Z
body: Reminder, please take a look at this pr: @m-trieu @chamikaramj 
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-04-07T12:14:54Z
body: Assigning new set of reviewers because Pr has gone too long without review. If you would like to opt out of this review, comment `assign to next reviewer`:

R: @ahmedabu98 for label java.
R: @chamikaramj for label io.

Available commands:
- `stop reviewer notifications` - opt out of the automated review tooling
- `remind me after tests pass` - tag the comment author after tests pass
- `waiting on author` - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-04-15T12:14:56Z
body: Reminder, please take a look at this pr: @ahmedabu98 @chamikaramj 
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-04-18T12:14:25Z
body: Assigning new set of reviewers because Pr has gone too long without review. If you would like to opt out of this review, comment `assign to next reviewer`:

R: @Abacn for label java.
R: @chamikaramj for label io.

Available commands:
- `stop reviewer notifications` - opt out of the automated review tooling
- `remind me after tests pass` - tag the comment author after tests pass
- `waiting on author` - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-04-25T12:14:39Z
body: Reminder, please take a look at this pr: @Abacn @chamikaramj 
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-04-29T12:15:50Z
body: Assigning new set of reviewers because Pr has gone too long without review. If you would like to opt out of this review, comment `assign to next reviewer`:

R: @ahmedabu98 for label java.
R: @chamikaramj for label io.

Available commands:
- `stop reviewer notifications` - opt out of the automated review tooling
- `remind me after tests pass` - tag the comment author after tests pass
- `waiting on author` - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)
author_association: CONTRIBUTOR
user: login: kennknowles
created_at: 2025-05-05T15:13:31Z
body: Would @ahmedabu98 or @chamikaramj or @Abacn be a good reviewer? Or someone else?
author_association: MEMBER
user: login: github-actions[bot]
created_at: 2025-05-16T12:15:49Z
body: Reminder, please take a look at this pr: @ahmedabu98 @chamikaramj 
author_association: CONTRIBUTOR
user: login: prodriguezdefino
created_at: 2025-05-19T19:31:50Z
body: @Abacn thanks for the review! 

I will work on the package and class naming recommendations shortly. 
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-22T12:16:10Z
body: Assigning new set of reviewers because Pr has gone too long without review. If you would like to opt out of this review, comment `assign to next reviewer`:

R: @robertwb for label java.
R: @chamikaramj for label io.

Available commands:
- `stop reviewer notifications` - opt out of the automated review tooling
- `remind me after tests pass` - tag the comment author after tests pass
- `waiting on author` - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)
author_association: CONTRIBUTOR