Repository: dapr/components-contrib
Pull request #3863 (2025-06-26 05:32:36)

Coherence store: Fix minor typo in coherence state docker-compose file
# Description

Fix minor typo in coherence state docker compose github workflow file.

## Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: #3862

Note: This doesn't actually affect the testing

## Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

* [x] Code compiles correctly
* [x] Created/updated tests
* [x] Extended the documentation / Created issue in the - N/A



Patch:
diff --git a/.build-tools/component-folders.yaml b/.build-tools/component-folders.yaml
index 437e8f62..87f9aaa4 100644
--- a/.build-tools/component-folders.yaml
+++ b/.build-tools/component-folders.yaml
@@ -9,6 +9,7 @@ componentFolders:
   - secretstores
   - state
   - workflows
+  - conversation
 
 excludeFolders:
   - bindings/alicloud
diff --git a/.build-tools/go.mod b/.build-tools/go.mod
index 8216a5b4..8846058d 100644
--- a/.build-tools/go.mod
+++ b/.build-tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/dapr/components-contrib/build-tools
 
-go 1.24.1
+go 1.24.4
 
 require (
 	github.com/dapr/components-contrib v0.0.0
diff --git a/.build-tools/pkg/metadataschema/schema.go b/.build-tools/pkg/metadataschema/schema.go
index f578ff26..bc7b0f4a 100644
--- a/.build-tools/pkg/metadataschema/schema.go
+++ b/.build-tools/pkg/metadataschema/schema.go
@@ -20,7 +20,7 @@ type ComponentMetadata struct {
 	// Version of the component metadata schema.
 	SchemaVersion string `json:"schemaVersion" yaml:"schemaVersion" jsonschema:"enum=v1"`
 	// Component type, of one of the allowed values.
-	Type string `json:"type" yaml:"type" jsonschema:"enum=bindings,enum=state,enum=secretstores,enum=pubsub,enum=workflows,enum=configuration,enum=lock,enum=middleware,enum=crypto"`
+	Type string `json:"type" yaml:"type" jsonschema:"enum=bindings,enum=state,enum=secretstores,enum=pubsub,enum=workflows,enum=configuration,enum=lock,enum=middleware,enum=crypto,enum=conversation"`
 	// Name of the component (without the inital type, e.g. "http" instead of "bindings.http").
 	Name string `json:"name" yaml:"name"`
 	// Version of the component, with the leading "v", e.g. "v1".
diff --git a/.github/infrastructure/docker-compose-coherence.yml b/.github/infrastructure/docker-compose-coherence.yml
index de9641ca..0d967625 100644
--- a/.github/infrastructure/docker-compose-coherence.yml
+++ b/.github/infrastructure/docker-compose-coherence.yml
@@ -4,7 +4,7 @@ services:
     environment:
       - coherence.management.http=all
       - coherence.management.http.port=30000
-      - Dcoherence.health.http.port=6676
+      - coherence.health.http.port=6676
       - coherence.wka=127.0.0.1
     ports:
       - 30000:30000
diff --git a/bindings/aws/s3/s3.go b/bindings/aws/s3/s3.go
index 5b82b051..0846b929 100644
--- a/bindings/aws/s3/s3.go
+++ b/bindings/aws/s3/s3.go
@@ -24,17 +24,20 @@ import (
 	"net/http"
 	"os"
 	"reflect"
+	"slices"
 	"strings"
 	"time"
 
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
+	awsCommon "github.com/dapr/components-contrib/common/aws"
+	awsCommonAuth "github.com/dapr/components-contrib/common/aws/auth"
+
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/google/uuid"
 
 	"github.com/dapr/components-contrib/bindings"
-	awsAuth "github.com/dapr/components-contrib/common/authentication/aws"
 	commonutils "github.com/dapr/components-contrib/common/utils"
 	"github.com/dapr/components-contrib/metadata"
 	"github.com/dapr/kit/logger"
@@ -60,9 +63,12 @@ const (
 
 // AWSS3 is a binding for an AWS S3 storage bucket.
 type AWSS3 struct {
-	metadata     *s3Metadata
-	authProvider awsAuth.Provider
-	logger       logger.Logger
+	metadata        *s3Metadata
+	logger          logger.Logger
+	s3Client        *s3.Client
+	s3Uploader      *manager.Uploader
+	s3Downloader    *manager.Downloader
+	s3PresignClient *s3.PresignClient
 }
 
 type s3Metadata struct {
@@ -106,10 +112,42 @@ func NewAWSS3(logger logger.Logger) bindings.OutputBinding {
 	return &AWSS3{logger: logger}
 }
 
-func (s *AWSS3) getAWSConfig(opts awsAuth.Options) *aws.Config {
-	cfg := awsAuth.GetConfig(opts).WithS3ForcePathStyle(s.metadata.ForcePathStyle).WithDisableSSL(s.metadata.DisableSSL)
+// Init does metadata parsing and connection creation.
+func (s *AWSS3) Init(ctx context.Context, metadata bindings.Metadata) error {
+	m, err := s.parseMetadata(metadata)
+	if err != nil {
+		return err
+	}
+	s.metadata = m
+
+	authOpts := awsCommonAuth.Options{
+		Logger: s.logger,
+
+		Properties: metadata.Properties,
+
+		Region:       m.Region,
+		Endpoint:     m.Endpoint,
+		AccessKey:    m.AccessKey,
+		SecretKey:    m.SecretKey,
+		SessionToken: m.SessionToken,
+	}
+
+	var configOptions []awsCommon.ConfigOption
+
+	var s3Options []func(options *s3.Options)
+
+	if s.metadata.DisableSSL {
+		s3Options = append(s3Options, func(options *s3.Options) {
+			options.EndpointOptions.DisableHTTPS = true
+		})
+	}
+
+	if !s.metadata.ForcePathStyle {
+		s3Options = append(s3Options, func(options *s3.Options) {
+			options.UsePathStyle = true
+		})
+	}
 
-	// Use a custom HTTP client to allow self-signed certs
 	if s.metadata.InsecureSSL {
 		customTransport := http.DefaultTransport.(*http.Transport).Clone()
 		customTransport.TLSClientConfig = &tls.Config{
@@ -119,44 +157,27 @@ func (s *AWSS3) getAWSConfig(opts awsAuth.Options) *aws.Config {
 		client := &http.Client{
 			Transport: customTransport,
 		}
-		cfg = cfg.WithHTTPClient(client)
+		configOptions = append(configOptions, awsCommon.WithHTTPClient(client))
 
 		s.logger.Infof("aws s3: you are using 'insecureSSL' to skip server config verify which is unsafe!")
 	}
-	return cfg
-}
 
-// Init does metadata parsing and connection creation.
-func (s *AWSS3) Init(ctx context.Context, metadata bindings.Metadata) error {
-	m, err := s.parseMetadata(metadata)
+	awsConfig, err := awsCommon.NewConfig(ctx, authOpts, configOptions...)
 	if err != nil {
-		return err
+		return fmt.Errorf("s3 binding error: failed to create AWS config: %w", err)
 	}
-	s.metadata = m
 
-	opts := awsAuth.Options{
-		Logger:       s.logger,
-		Properties:   metadata.Properties,
-		Region:       m.Region,
-		Endpoint:     m.Endpoint,
-		AccessKey:    m.AccessKey,
-		SecretKey:    m.SecretKey,
-		SessionToken: m.SessionToken,
-	}
-	// extra configs needed per component type
-	provider, err := awsAuth.NewProvider(ctx, opts, s.getAWSConfig(opts))
-	if err != nil {
-		return err
-	}
-	s.authProvider = provider
+	s.s3Client = s3.NewFromConfig(awsConfig, s3Options...)
+
+	s.s3Uploader = manager.NewUploader(s.s3Client)
+	s.s3Downloader = manager.NewDownloader(s.s3Client)
+
+	s.s3PresignClient = s3.NewPresignClient(s.s3Client)
 
 	return nil
 }
 
 func (s *AWSS3) Close() error {
-	if s.authProvider != nil {
-		return s.authProvider.Close()
-	}
 	return nil
 }
 
@@ -215,19 +236,25 @@ func (s *AWSS3) create(ctx context.Context, req *bindings.InvokeRequest) (*bindi
 		r = b64.NewDecoder(b64.StdEncoding, r)
 	}
 
-	var storageClass *string
+	var storageClass types.StorageClass
 	if metadata.StorageClass != "" {
-		storageClass = aws.String(metadata.StorageClass)
+		// assert storageclass exists in the types.storageclass.values() slice
+		storageClass = types.StorageClass(strings.ToUpper(metadata.StorageClass))
+		if !slices.Contains(storageClass.Values(), storageClass) {
+			return nil, fmt.Errorf("s3 binding error: invalid storage class '%s' provided", metadata.StorageClass)
+		}
 	}
 
-	resultUpload, err := s.authProvider.S3().Uploader.UploadWithContext(ctx, &s3manager.UploadInput{
+	s3UploaderPutObjectInput := &s3.PutObjectInput{
 		Bucket:       ptr.Of(metadata.Bucket),
 		Key:          ptr.Of(key),
 		Body:         r,
 		ContentType:  contentType,
 		StorageClass: storageClass,
 		Tagging:      tagging,
-	})
+	}
+
+	resultUpload, err := s.s3Uploader.Upload(ctx, s3UploaderPutObjectInput)
 	if err != nil {
 		return nil, fmt.Errorf("s3 binding error: uploading failed: %w", err)
 	}
@@ -296,16 +323,21 @@ func (s *AWSS3) presignObject(ctx context.Context, bucket, key, ttl string) (str
 	if err != nil {
 		return "", fmt.Errorf("s3 binding error: cannot parse duration %s: %w", ttl, err)
 	}
-	objReq, _ := s.authProvider.S3().S3.GetObjectRequest(&s3.GetObjectInput{
+	s3GetObjectInput := &s3.GetObjectInput{
 		Bucket: ptr.Of(bucket),
 		Key:    ptr.Of(key),
-	})
-	url, err := objReq.Presign(d)
+	}
+
+	presignedObjectRequest, err := s.s3PresignClient.PresignGetObject(
+		ctx,
+		s3GetObjectInput,
+		s3.WithPresignExpires(d),
+	)
 	if err != nil {
 		return "", fmt.Errorf("s3 binding error: failed to presign URL: %w", err)
 	}
 
-	return url, nil
+	return presignedObjectRequest.URL, nil
 }
 
 func (s *AWSS3) get(ctx context.Context, req *bindings.InvokeRequest) (*bindings.InvokeResponse, error) {
@@ -320,7 +352,7 @@ func (s *AWSS3) get(ctx context.Context, req *bindings.InvokeRequest) (*bindings
 	}
 
 	buff := &aws.WriteAtBuffer{}
-	_, err = s.authProvider.S3().Downloader.DownloadWithContext(ctx,
+	_, err = s.s3Downloader.Download(ctx,
 		buff,
 		&s3.GetObjectInput{
 			Bucket: ptr.Of(s.metadata.Bucket),
@@ -328,8 +360,8 @@ func (s *AWSS3) get(ctx context.Context, req *bindings.InvokeRequest) (*bindings
 		},
 	)
 	if err != nil {
-		var awsErr awserr.Error
-		if errors.As(err, &awsErr) && awsErr.Code() == s3.ErrCodeNoSuchKey {
+		var awsErr *types.NoSuchKey
+		if errors.As(err, &awsErr) {
 			return nil, errors.New("object not found")
 		}
 		return nil, fmt.Errorf("s3 binding error: error downloading S3 object: %w", err)
@@ -354,7 +386,7 @@ func (s *AWSS3) delete(ctx context.Context, req *bindings.InvokeRequest) (*bindi
 	if key == "" {
 		return nil, fmt.Errorf("s3 binding error: required metadata '%s' missing", metadataKey)
 	}
-	_, err := s.authProvider.S3().S3.DeleteObjectWithContext(
+	_, err := s.s3Client.DeleteObject(
 		ctx,
 		&s3.DeleteObjectInput{
 			Bucket: ptr.Of(s.metadata.Bucket),
@@ -362,8 +394,8 @@ func (s *AWSS3) delete(ctx context.Context, req *bindings.InvokeRequest) (*bindi
 		},
 	)
 	if err != nil {
-		var awsErr awserr.Error
-		if errors.As(err, &awsErr) && awsErr.Code() == s3.ErrCodeNoSuchKey {
+		var awsErr *types.NoSuchKey
+		if errors.As(err, &awsErr) {
 			return nil, errors.New("object not found")
 		}
 		return nil, fmt.Errorf("s3 binding error: delete operation failed: %w", err)
@@ -383,9 +415,9 @@ func (s *AWSS3) list(ctx context.Context, req *bindings.InvokeRequest) (*binding
 	if payload.MaxResults < 1 {
 		payload.MaxResults = defaultMaxResults
 	}
-	result, err := s.authProvider.S3().S3.ListObjectsWithContext(ctx, &s3.ListObjectsInput{
+	result, err := s.s3Client.ListObjects(ctx, &s3.ListObjectsInput{
 		Bucket:    ptr.Of(s.metadata.Bucket),
-		MaxKeys:   ptr.Of(int64(payload.MaxResults)),
+		MaxKeys:   ptr.Of(payload.MaxResults),
 		Marker:    ptr.Of(payload.Marker),
 		Prefix:    ptr.Of(payload.Prefix),
 		Delimiter: ptr.Of(payload.Delimiter),
diff --git a/bindings/azure/eventhubs/metadata.yaml b/bindings/azure/eventhubs/metadata.yaml
index 7ee38cfe..284a5458 100644
--- a/bindings/azure/eventhubs/metadata.yaml
+++ b/bindings/azure/eventhubs/metadata.yaml
@@ -164,7 +164,7 @@ metadata:
   - name: getAllMessageProperties
     type: bool
     required: false
-    default: false
+    default: "false"
     example: "false"
     binding:
       input: true
diff --git a/bindings/kafka/metadata.yaml b/bindings/kafka/metadata.yaml
index 74331d8f..c37ed9f9 100644
--- a/bindings/kafka/metadata.yaml
+++ b/bindings/kafka/metadata.yaml
@@ -372,3 +372,10 @@ metadata:
       - "range"
       - "sticky"
       - "roundrobin"
+  - name: excludeHeaderMetaRegex
+    type: string
+    required: false
+    description: |
+      A regular expression to exclude keys from being converted to/from headers from/to metadata to avoid unwanted downstream side effects.
+    example: '"^rawPayload|valueSchemaType$"'
+    default: '""'
diff --git a/bindings/zeebe/command/metadata.yaml b/bindings/zeebe/command/metadata.yaml
index 7292ff7f..6c0a3d7d 100644
--- a/bindings/zeebe/command/metadata.yaml
+++ b/bindings/zeebe/command/metadata.yaml
@@ -46,9 +46,10 @@ metadata:
     type: string
   - name: gatewayKeepAlive
     required: false
-    description: Sets how often keep alive messages should be sent to the gateway. Defaults to 45 seconds
+    description: Sets how often keep alive messages should be sent to the gateway.
     example: "45s"
     type: duration
+    default: "45s"
   - name: usePlainTextConnection	
     required: false
     description: Whether to use a plain text connection or not
diff --git a/bindings/zeebe/jobworker/metadata.yaml b/bindings/zeebe/jobworker/metadata.yaml
index e6f533ed..37957a59 100644
--- a/bindings/zeebe/jobworker/metadata.yaml
+++ b/bindings/zeebe/jobworker/metadata.yaml
@@ -20,9 +20,10 @@ metadata:
     type: string
   - name: gatewayKeepAlive
     required: false
-    description: Sets how often keep alive messages should be sent to the gateway. Defaults to 45 seconds
+    description: Sets how often keep alive messages should be sent to the gateway.
     example: "45s"
     type: duration
+    default: "45s"
   - name: usePlainTextConnection	
     required: false
     description: Whether to use a plain text connection or not
@@ -40,7 +41,7 @@ metadata:
     type: string
   - name: workerTimeout
     required: false
-    description: A job returned after this call will not be activated by another call until the timeout has been reached; defaults to 5 minutes
+    description: A job returned after this call will not be activated by another call until the timeout has been reached.
     example: "5m"
     type: duration
   - name: requestTimeout
@@ -48,6 +49,7 @@ metadata:
     description: The request will be completed when at least one job is activated or after the requestTimeout. If the requestTimeout = 0, a default timeout is used. If the requestTimeout < 0, long polling is disabled and the request is completed immediately, even when no job is activated. Defaults to 10 seconds
     example: "30s"
     type: duration
+    default: "10s"
   - name: jobType
     required: true
     description: the job type, as defined in the BPMN process (e.g. <zeebe:taskDefinition type=\"fetch-products\" />)
@@ -55,24 +57,28 @@ metadata:
     type: string
   - name: maxJobsActive
     required: false
-    description: Set the maximum number of jobs which will be activated for this worker at the same time. Defaults to 32
+    description: Set the maximum number of jobs which will be activated for this worker at the same time.
     example: "32"
     type: number
+    default: "32"
   - name: concurrency
     required: false
-    description: The maximum number of concurrent spawned goroutines to complete jobs. Defaults to 4
+    description: The maximum number of concurrent spawned goroutines to complete jobs.
     example: "4"
+    default: "4"
     type: number
   - name: pollInterval
     required: false
-    description: Set the maximal interval between polling for new jobs. Defaults to 100 milliseconds
+    description: Set the maximal interval between polling for new jobs.
     example: "100ms"
     type: duration
+    default: "100ms"
   - name: pollThreshold
     required: false
-    description: Set the threshold of buffered activated jobs before polling for new jobs, i.e. threshold * maxJobsActive. Defaults to 0.3
+    description: Set the threshold of buffered activated jobs before polling for new jobs, i.e. threshold * maxJobsActive.
     example: "0.3"
     type: number
+    default: "0.3"
   - name: fetchVariables
     required: false
     description: A list of variables to fetch as the job variables; if empty, all visible variables at the time of activation for the scope of the job will be returned
diff --git a/common/aws/auth/auth.go b/common/aws/auth/auth.go
new file mode 100644
index 00000000..c33a64bc
--- /dev/null
+++ b/common/aws/auth/auth.go
@@ -0,0 +1,50 @@
+package auth
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+
+	"github.com/dapr/kit/logger"
+)
+
+type ProviderType int
+
+const (
+	StaticProviderTypeStatic ProviderType = iota
+	StaticProviderTypeAssumeRole
+	X509ProviderType
+	ProviderTypeUnknown // Or default
+)
+
+type Options struct {
+	Logger     logger.Logger
+	Properties map[string]string
+
+	Region          string `json:"region" mapstructure:"region" mapstructurealiases:"awsRegion"`
+	AccessKey       string `json:"accessKey" mapstructure:"accessKey"`
+	SecretKey       string `json:"secretKey" mapstructure:"secretKey"`
+	SessionToken    string `json:"sessionToken" mapstructure:"sessionToken"`
+	AssumeRoleArn   string `json:"assumeRoleArn" mapstructure:"assumeRoleArn"`
+	TrustAnchorArn  string `json:"trustAnchorArn" mapstructure:"trustAnchorArn"`
+	TrustProfileArn string `json:"trustProfileArn" mapstructure:"trustProfileArn"`
+
+	Endpoint string `json:"endpoint" mapstructure:"endpoint"`
+}
+
+// CredentialProvider provides an interface for retrieving AWS credentials.
+type CredentialProvider interface {
+	Retrieve(ctx context.Context) (aws.Credentials, error)
+	Type() ProviderType
+}
+
+func NewCredentialProvider(ctx context.Context, opts Options, configOpts []func(*config.LoadOptions) error) (CredentialProvider,
+	error,
+) {
+	// TODO: Refactor this to search the opts structure for the right fields rather than the metadata map
+	if isX509Auth(opts.Properties) {
+		return newAuthX509(ctx, opts)
+	}
+	return newAuthStatic(ctx, opts, configOpts)
+}
diff --git a/common/aws/auth/auth_static.go b/common/aws/auth/auth_static.go
new file mode 100644
index 00000000..13f24a54
--- /dev/null
+++ b/common/aws/auth/auth_static.go
@@ -0,0 +1,76 @@
+package auth
+
+import (
+	"context"
+	"errors"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+
+	"github.com/dapr/kit/logger"
+)
+
+type Static struct {
+	ProviderType  ProviderType
+	Logger        logger.Logger
+	AccessKey     string
+	SecretKey     string
+	SessionToken  string
+	Region        string
+	Endpoint      string
+	AssumeRoleArn string
+
+	CredentialProvider aws.CredentialsProvider
+}
+
+func (a *Static) Retrieve(ctx context.Context) (aws.Credentials, error) {
+	if a.CredentialProvider == nil {
+		return aws.Credentials{}, errors.New("credential provider is not set")
+	}
+	return a.CredentialProvider.Retrieve(ctx)
+}
+
+func (a *Static) Type() ProviderType {
+	return a.ProviderType
+}
+
+func newAuthStatic(ctx context.Context, opts Options, configOpts []func(*config.LoadOptions) error) (CredentialProvider, error) {
+	static := &Static{
+		Logger:        opts.Logger,
+		AccessKey:     opts.AccessKey,
+		SecretKey:     opts.SecretKey,
+		SessionToken:  opts.SessionToken,
+		Region:        opts.Region,
+		Endpoint:      opts.Endpoint,
+		AssumeRoleArn: opts.AssumeRoleArn,
+	}
+
+	switch {
+	case static.AccessKey != "" && static.SecretKey != "" && static.SessionToken != "":
+		static.ProviderType = StaticProviderTypeStatic
+		static.CredentialProvider = credentials.NewStaticCredentialsProvider(opts.AccessKey, opts.SecretKey,
+			opts.SessionToken)
+		static.Logger.Debug("using static credentials provider")
+
+	case static.AssumeRoleArn != "":
+		awsCfg, err := config.LoadDefaultConfig(ctx, configOpts...)
+		if err != nil {
+			return nil, err
+		}
+
+		stsSvc := sts.NewFromConfig(awsCfg)
+		stsProvider := stscreds.NewAssumeRoleProvider(stsSvc, static.AssumeRoleArn)
+		static.ProviderType = StaticProviderTypeAssumeRole
+		static.CredentialProvider = stsProvider
+		static.Logger.Debug("using AssumeRole credentials provider")
+
+	default:
+		static.Logger.Debug("using an undefined credentials provider, this may lead to unexpected behavior")
+		static.ProviderType = ProviderTypeUnknown
+	}
+
+	return static, nil
+}
diff --git a/common/aws/auth/auth_x509.go b/common/aws/auth/auth_x509.go
new file mode 100644
index 00000000..5cd6c383
--- /dev/null
+++ b/common/aws/auth/auth_x509.go
@@ -0,0 +1,199 @@
+package auth
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/x509"
+	"errors"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/mikeee/aws_credential_helper"
+	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
+
+	cryptopem "github.com/dapr/kit/crypto/pem"
+	spiffecontext "github.com/dapr/kit/crypto/spiffe/context"
+	"github.com/dapr/kit/logger"
+	kitmd "github.com/dapr/kit/metadata"
+)
+
+func isX509Auth(m map[string]string) bool {
+	tp := m["trustProfileArn"]
+	ta := m["trustAnchorArn"]
+	ar := m["assumeRoleArn"]
+	return tp != "" && ta != "" && ar != ""
+}
+
+type X509 struct {
+	logger logger.Logger
+
+	x509Cert *x509.Certificate
+
+	region          *string
+	assumeRoleArn   *string
+	trustAnchorArn  *string
+	trustProfileArn *string
+
+	wrappedCredentialProvider *aws_credential_helper.CredentialProvider
+}
+
+func (x *X509) Type() ProviderType {
+	return X509ProviderType
+}
+
+func (x *X509) RefreshX509(ctx context.Context) error {
+	cert, _, signer, err := getCertAndSigner(ctx)
+	if err != nil {
+		return errors.New("failed to refresh X509 cert: " + err.Error())
+	}
+	x.x509Cert = cert
+	if x.wrappedCredentialProvider != nil {
+		if x.region == nil || x.assumeRoleArn == nil || x.trustAnchorArn == nil || x.trustProfileArn == nil {
+			return errors.New("missing required fields: Region, AssumeRoleArn, TrustAnchorArn, TrustProfileArn")
+		}
+
+		credentialProviderInput := aws_credential_helper.CredentialProviderInput{
+			Region:          *x.region,
+			TrustProfileArn: *x.trustProfileArn,
+			TrustAnchorArn:  *x.trustAnchorArn,
+			AssumeRoleArn:   *x.assumeRoleArn,
+			Signer:          *signer,
+		}
+
+		credentialProvider, err := aws_credential_helper.NewCredentialProvider(ctx, credentialProviderInput)
+		if err != nil {
+			return errors.New("failed to create new credential provider: " + err.Error())
+		}
+
+		x.wrappedCredentialProvider = credentialProvider
+	} else {
+		// change signer
+		x.wrappedCredentialProvider.ChangeSigner(*signer)
+	}
+
+	return nil
+}
+
+func (x *X509) Retrieve(ctx context.Context) (aws.Credentials, error) {
+	// Check cert/svid expiry, if expired then refresh
+	if isCertExpired(x.x509Cert) {
+		if err := x.RefreshX509(ctx); err != nil {
+			return aws.Credentials{}, errors.New("failed to refresh X509 cert: " + err.Error())
+		}
+	}
+	return x.wrappedCredentialProvider.Retrieve(ctx)
+}
+
+func getSpiffeX509Svid(ctx context.Context) (*x509svid.SVID, error) {
+	svid, ok := spiffecontext.X509From(ctx)
+	if !ok {
+		return nil, errors.New("invalid SVID: no certs found")
+	}
+
+	return svid.GetX509SVID()
+}
+
+func marshalSvid(svid *x509svid.SVID) ([]byte, []byte, error) {
+	if svid == nil {
+		return nil, nil, errors.New("nil SVID")
+	}
+
+	return svid.Marshal()
+}
+
+func getCertAndSigner(ctx context.Context) (*x509.Certificate, *ecdsa.PrivateKey, *aws_credential_helper.Signer,
+	error,
+) {
+	// obtain certs from spiffe via context
+	x509Svid, err := getSpiffeX509Svid(ctx)
+	if err != nil {
+		panic("failed to get SPIFFE certs: " + err.Error())
+	}
+
+	chain, key, err := marshalSvid(x509Svid)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	certs, err := cryptopem.DecodePEMCertificatesChain(chain)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	pkey, err := cryptopem.DecodePEMPrivateKey(key)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	signer := aws_credential_helper.NewSigner(certs[0], pkey.(*ecdsa.PrivateKey))
+
+	return certs[0], pkey.(*ecdsa.PrivateKey), &signer, nil
+}
+
+func isCertExpired(cert *x509.Certificate) bool {
+	if cert == nil {
+		return true
+	}
+	now := time.Now()
+	return now.After(cert.NotAfter) || now.Before(cert.NotBefore)
+}
+
+type awsRAOpts struct {
+	AssumeRoleArn   *string `json:"assumeRoleArn" mapstructure:"assumeRoleArn"`
+	TrustAnchorArn  *string `json:"trustAnchorArn" mapstructure:"trustAnchorArn"`
+	TrustProfileArn *string `json:"trustProfileArn" mapstructure:"trustProfileArn"`
+}
+
+func newAuthX509(ctx context.Context, opts Options) (*X509, error) {
+	var authOpts awsRAOpts
+	if err := kitmd.DecodeMetadata(opts.Properties, &authOpts); err != nil {
+		return nil, errors.New("failed to decode metadata: " + err.Error())
+	}
+
+	switch {
+	case authOpts.AssumeRoleArn == nil:
+		return nil, errors.New("missing required field: AssumeRoleArn")
+	case authOpts.TrustAnchorArn == nil:
+		return nil, errors.New("missing required field: TrustAnchorArn")
+	case authOpts.TrustProfileArn == nil:
+		return nil, errors.New("missing required field: TrustProfileArn")
+	}
+
+	cert, _, signer, err := getCertAndSigner(ctx)
+	if err != nil {
+		return nil, errors.New("failed to get cert and signer: " + err.Error())
+	}
+
+	// create credential provider
+
+	authInput := aws_credential_helper.CredentialProviderInput{
+		Region: opts.Region,
+
+		AssumeRoleArn:   *authOpts.AssumeRoleArn,
+		TrustAnchorArn:  *authOpts.TrustAnchorArn,
+		TrustProfileArn: *authOpts.TrustProfileArn,
+
+		Signer: *signer,
+	}
+
+	credentialProvider, err := aws_credential_helper.NewCredentialProvider(ctx, authInput)
+	if err != nil {
+		return nil, errors.New("failed to create new credential provider: " + err.Error())
+	}
+
+	// test credentialprovider
+	cred, err := credentialProvider.Retrieve(ctx)
+	if err != nil {
+		return nil, errors.New("failed to retrieve credentials: " + err.Error())
+	}
+
+	if cred.Expires.Before(time.Now()) {
+		return nil, errors.New("credentials are not valid")
+	}
+
+	return &X509{
+		logger:                    nil,
+		x509Cert:                  cert,
+		wrappedCredentialProvider: credentialProvider,
+	}, nil
+}
diff --git a/common/aws/aws.go b/common/aws/aws.go
new file mode 100644
index 00000000..a1f9c0e3
--- /dev/null
+++ b/common/aws/aws.go
@@ -0,0 +1,1 @@
+package aws
diff --git a/common/aws/config.go b/common/aws/config.go
new file mode 100644
index 00000000..df61f744
--- /dev/null
+++ b/common/aws/config.go
@@ -0,0 +1,82 @@
+package aws
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+
+	"github.com/dapr/components-contrib/common/aws/auth"
+)
+
+type ConfigOption func(*ConfigOptions)
+
+type ConfigOptions struct {
+	CredentialProvider aws.CredentialsProvider
+	HTTPClient         *http.Client
+}
+
+// WithCredentialProvider allows for passing a custom credential provider,
+// this is not cached - wrap the credential provider with a NewCredentialCache if you wish.
+func WithCredentialProvider(provider aws.CredentialsProvider) func(*ConfigOptions) {
+	return func(opts *ConfigOptions) {
+		opts.CredentialProvider = provider
+	}
+}
+
+func WithHTTPClient(client *http.Client) func(*ConfigOptions) {
+	return func(opts *ConfigOptions) {
+		opts.HTTPClient = client
+	}
+}
+
+func loadConfigOptions(opts ...ConfigOption) *ConfigOptions {
+	options := &ConfigOptions{}
+	for _, opt := range opts {
+		opt(options)
+	}
+	return options
+}
+
+type ConfigLoadOptions []func(*config.LoadOptions) error
+
+func NewConfig(ctx context.Context, authOptions auth.Options, opts ...ConfigOption) (aws.Config, error) {
+	options := loadConfigOptions(opts...)
+
+	var configLoadOptions ConfigLoadOptions
+
+	// Deal with options
+	if authOptions.Endpoint != "" {
+		configLoadOptions = append(
+			configLoadOptions,
+			config.WithBaseEndpoint(authOptions.Endpoint),
+		)
+	}
+
+	if options.HTTPClient != nil {
+		configLoadOptions = append(
+			configLoadOptions,
+			config.WithHTTPClient(options.HTTPClient),
+		)
+	}
+
+	if options.CredentialProvider != nil {
+		configLoadOptions = append(
+			configLoadOptions,
+			config.WithCredentialsProvider(options.CredentialProvider),
+		)
+	} else {
+		credentialsProvider, err := auth.NewCredentialProvider(ctx, authOptions, configLoadOptions)
+		if err != nil {
+			return aws.Config{}, err
+		} else if credentialsProvider.Type() != auth.ProviderTypeUnknown {
+			configLoadOptions = append(
+				configLoadOptions,
+				config.WithCredentialsProvider(aws.NewCredentialsCache(credentialsProvider)),
+			)
+		}
+		// else use the sdk default external config if possible
+	}
+	return config.LoadDefaultConfig(ctx, configLoadOptions...)
+}
diff --git a/common/aws/doc.go b/common/aws/doc.go
new file mode 100644
index 00000000..a1f9c0e3
--- /dev/null
+++ b/common/aws/doc.go
@@ -0,0 +1,1 @@
+package aws
diff --git a/common/component/kafka/consumer.go b/common/component/kafka/consumer.go
index 487a76f3..a4685c47 100644
--- a/common/component/kafka/consumer.go
+++ b/common/component/kafka/consumer.go
@@ -145,7 +145,7 @@ func (consumer *consumer) doBulkCallback(session sarama.ConsumerGroupSession,
 
 	for i, message := range messages {
 		if message != nil {
-			metadata := GetEventMetadata(message, consumer.k.escapeHeaders)
+			metadata := GetEventMetadata(message, consumer.k)
 			handlerConfig, err := consumer.k.GetTopicHandlerConfig(message.Topic)
 			if err != nil {
 				return err
@@ -205,7 +205,7 @@ func (consumer *consumer) doCallback(session sarama.ConsumerGroupSession, messag
 		Topic: message.Topic,
 		Data:  messageVal,
 	}
-	event.Metadata = GetEventMetadata(message, consumer.k.escapeHeaders)
+	event.Metadata = GetEventMetadata(message, consumer.k)
 
 	err = handlerConfig.Handler(session.Context(), &event)
 	if err == nil {
@@ -214,11 +214,11 @@ func (consumer *consumer) doCallback(session sarama.ConsumerGroupSession, messag
 	return err
 }
 
-func GetEventMetadata(message *sarama.ConsumerMessage, escapeHeaders bool) map[string]string {
+func GetEventMetadata(message *sarama.ConsumerMessage, kafka *Kafka) map[string]string {
 	if message != nil {
 		metadata := make(map[string]string, len(message.Headers)+5)
 		if message.Key != nil {
-			if escapeHeaders {
+			if kafka.escapeHeaders {
 				metadata[keyMetadataKey] = url.QueryEscape(string(message.Key))
 			} else {
 				metadata[keyMetadataKey] = string(message.Key)
@@ -229,7 +229,12 @@ func GetEventMetadata(message *sarama.ConsumerMessage, escapeHeaders bool) map[s
 		metadata[timestampMetadataKey] = strconv.FormatInt(message.Timestamp.UnixMilli(), 10)
 		metadata[partitionMetadataKey] = strconv.FormatInt(int64(message.Partition), 10)
 		for _, header := range message.Headers {
-			if escapeHeaders {
+			// skip headers that are excluded from metadata
+			if kafka.excludeHeaderMetaRegex != nil && kafka.excludeHeaderMetaRegex.MatchString(string(header.Key)) {
+				kafka.logger.Debugf("Skipping header %v that is excluded from metadata", string(header.Key))
+				continue
+			}
+			if kafka.escapeHeaders {
 				metadata[string(header.Key)] = url.QueryEscape(string(header.Value))
 			} else {
 				metadata[string(header.Key)] = string(header.Value)
diff --git a/common/component/kafka/kafka.go b/common/component/kafka/kafka.go
index d8eb51ad..50e6d155 100644
--- a/common/component/kafka/kafka.go
+++ b/common/component/kafka/kafka.go
@@ -19,6 +19,7 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
+	"regexp"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -81,6 +82,8 @@ type Kafka struct {
 	DefaultConsumeRetryEnabled bool
 	consumeRetryEnabled        bool
 	consumeRetryInterval       time.Duration
+
+	excludeHeaderMetaRegex *regexp.Regexp
 }
 
 type SchemaType int
@@ -256,6 +259,10 @@ func (k *Kafka) Init(ctx context.Context, metadata map[string]string) error {
 		return errors.New("component is closed")
 	}
 
+	if meta.ExcludeHeaderMetaRegex != "" {
+		k.excludeHeaderMetaRegex = regexp.MustCompile(meta.ExcludeHeaderMetaRegex)
+	}
+
 	k.logger.Debug("Kafka message bus initialization complete")
 
 	return nil
diff --git a/common/component/kafka/metadata.go b/common/component/kafka/metadata.go
index 91ac7f6d..24530375 100644
--- a/common/component/kafka/metadata.go
+++ b/common/component/kafka/metadata.go
@@ -116,6 +116,9 @@ type KafkaMetadata struct {
 	SchemaRegistryAPISecret     string        `mapstructure:"schemaRegistryAPISecret"`
 	SchemaCachingEnabled        bool          `mapstructure:"schemaCachingEnabled"`
 	SchemaLatestVersionCacheTTL time.Duration `mapstructure:"schemaLatestVersionCacheTTL"`
+
+	// header from/to metadata excluded keys regex
+	ExcludeHeaderMetaRegex string `mapstructure:"excludeHeaderMetaRegex"`
 }
 
 // upgradeMetadata updates metadata properties based on deprecated usage.
@@ -168,6 +171,7 @@ func (k *Kafka) getKafkaMetadata(meta map[string]string) (*KafkaMetadata, error)
 		SchemaCachingEnabled:                         true,
 		SchemaLatestVersionCacheTTL:                  5 * time.Minute,
 		EscapeHeaders:                                false,
+		ExcludeHeaderMetaRegex:                       "",
 	}
 
 	err := metadata.DecodeMetadata(meta, &m)
@@ -347,5 +351,9 @@ func (k *Kafka) getKafkaMetadata(meta map[string]string) (*KafkaMetadata, error)
 		m.ClientConnectionKeepAliveInterval = defaultClientConnectionKeepAliveInterval
 	}
 
+	if val, ok := meta["excludeHeaderMetaRegex"]; ok && val != "" {
+		m.ExcludeHeaderMetaRegex = val
+	}
+
 	return &m, nil
 }
diff --git a/common/component/kafka/producer.go b/common/component/kafka/producer.go
index 97e5a6bb..2868acb4 100644
--- a/common/component/kafka/producer.go
+++ b/common/component/kafka/producer.go
@@ -78,6 +78,11 @@ func (k *Kafka) Publish(_ context.Context, topic string, data []byte, metadata m
 		if msg.Headers == nil {
 			msg.Headers = make([]sarama.RecordHeader, 0, len(metadata))
 		}
+		// skip metadata that is excluded from headers
+		if k.excludeHeaderMetaRegex != nil && k.excludeHeaderMetaRegex.MatchString(name) {
+			k.logger.Debugf("Skipping metadata %v that is excluded from headers", name)
+			continue
+		}
 		msg.Headers = append(msg.Headers, sarama.RecordHeader{
 			Key:   []byte(name),
 			Value: []byte(value),
@@ -141,6 +146,11 @@ func (k *Kafka) BulkPublish(_ context.Context, topic string, entries []pubsub.Bu
 			if msg.Headers == nil {
 				msg.Headers = make([]sarama.RecordHeader, 0, len(metadata))
 			}
+			// skip metadata that is excluded from headers
+			if k.excludeHeaderMetaRegex != nil && k.excludeHeaderMetaRegex.MatchString(name) {
+				k.logger.Debugf("Skipping metadata %v that is excluded from headers", name)
+				continue
+			}
 			msg.Headers = append(msg.Headers, sarama.RecordHeader{
 				Key:   []byte(name),
 				Value: []byte(value),
diff --git a/component-metadata-schema.json b/component-metadata-schema.json
index 25a2d746..1ed919ab 100644
--- a/component-metadata-schema.json
+++ b/component-metadata-schema.json
@@ -213,7 +213,8 @@
         "configuration",
         "lock",
         "middleware",
-        "crypto"
+        "crypto",
+        "conversation"
       ],
       "description": "Component type, of one of the allowed values."
     },
diff --git a/conversation/anthropic/metadata.yaml b/conversation/anthropic/metadata.yaml
index 531be390..729971ca 100644
--- a/conversation/anthropic/metadata.yaml
+++ b/conversation/anthropic/metadata.yaml
@@ -24,9 +24,10 @@ metadata:
   - name: model
     required: false
     description: |
-      The Anthropic LLM to use. Defaults to claude-3-5-sonnet-20240620
+      The Anthropic LLM to use.
     type: string
     example: 'claude-3-5-sonnet-20240620'
+    default: 'claude-3-5-sonnet-20240620'
   - name: cacheTTL
     required: false
     description: |
diff --git a/conversation/deepseek/metadata.yaml b/conversation/deepseek/metadata.yaml
index 0f38a876..e725cf8e 100644
--- a/conversation/deepseek/metadata.yaml
+++ b/conversation/deepseek/metadata.yaml
@@ -25,5 +25,5 @@ metadata:
     required: false
     description: |
       Max tokens for each request
-    type: int
-    example: 2048
+    type: number
+    example: "2048"
diff --git a/conversation/googleai/metadata.yaml b/conversation/googleai/metadata.yaml
index 4a741723..848b864c 100644
--- a/conversation/googleai/metadata.yaml
+++ b/conversation/googleai/metadata.yaml
@@ -24,9 +24,10 @@ metadata:
   - name: model
     required: false
     description: |
-      The GoogleAI LLM to use. Defaults to gemini-1.5-flash
+      The GoogleAI LLM to use.
     type: string
     example: 'gemini-2.0-flash'
+    default: 'gemini-2.0-flash'
   - name: cacheTTL
     required: false
     description: |
diff --git a/conversation/huggingface/metadata.yaml b/conversation/huggingface/metadata.yaml
index b1f7cdad..89ec7d01 100644
--- a/conversation/huggingface/metadata.yaml
+++ b/conversation/huggingface/metadata.yaml
@@ -24,9 +24,10 @@ metadata:
   - name: model
     required: false
     description: |
-      The Huggingface model to use. Uses OpenAI-compatible API. Defaults to deepseek-ai/DeepSeek-R1-Distill-Qwen-32B
+      The Huggingface model to use. Uses OpenAI-compatible API.
     type: string
     example: 'deepseek-ai/DeepSeek-R1-Distill-Qwen-32B'
+    default: 'deepseek-ai/DeepSeek-R1-Distill-Qwen-32B'
   - name: endpoint
     required: false
     description: |
diff --git a/conversation/mistral/metadata.yaml b/conversation/mistral/metadata.yaml
index 5157c7ce..329379dc 100644
--- a/conversation/mistral/metadata.yaml
+++ b/conversation/mistral/metadata.yaml
@@ -24,9 +24,10 @@ metadata:
   - name: model
     required: false
     description: |
-      The Mistral LLM to use. Defaults to open-mistral-7b
+      The Mistral LLM to use.
     type: string
     example: 'open-mistral-7b'
+    default: 'open-mistral-7b'
   - name: cacheTTL
     required: false
     description: |
diff --git a/conversation/ollama/metadata.yaml b/conversation/ollama/metadata.yaml
index b724b333..113c7fbc 100644
--- a/conversation/ollama/metadata.yaml
+++ b/conversation/ollama/metadata.yaml
@@ -12,9 +12,10 @@ metadata:
   - name: model
     required: false
     description: |
-      The Ollama LLM to use. Defaults to llama3.2:latest
+      The Ollama LLM to use.
     type: string
     example: 'llama3.2:latest'
+    default: 'llama3.2:latest'
   - name: cacheTTL
     required: false
     description: |
diff --git a/conversation/openai/metadata.yaml b/conversation/openai/metadata.yaml
index 2adf8071..dcf6cef3 100644
--- a/conversation/openai/metadata.yaml
+++ b/conversation/openai/metadata.yaml
@@ -24,9 +24,10 @@ metadata:
   - name: model
     required: false
     description: |
-      The OpenAI LLM to use. Defaults to gpt-4o
+      The OpenAI LLM to use.
     type: string
     example: 'gpt-4-turbo'
+    default: 'gpt-4o'
   - name: endpoint
     required: false
     description: |
diff --git a/go.mod b/go.mod
index 7b4e4eb3..553eb319 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/dapr/components-contrib
 
-go 1.24.1
+go 1.24.4
 
 require (
 	cloud.google.com/go/datastore v1.20.0
@@ -41,12 +41,18 @@ require (
 	github.com/apache/thrift v0.13.0
 	github.com/aws/aws-msk-iam-sasl-signer-go v1.0.1-0.20241125194140-078c08b8574a
 	github.com/aws/aws-sdk-go v1.55.6
-	github.com/aws/aws-sdk-go-v2 v1.32.4
-	github.com/aws/aws-sdk-go-v2/config v1.28.2
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.43
+	github.com/aws/aws-sdk-go-v2 v1.36.5
+	github.com/aws/aws-sdk-go-v2/config v1.29.17
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.70
+	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.3
 	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.3.10
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.83
 	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.17.3
-	github.com/aws/aws-sdk-go-v2/service/sts v1.32.4
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.4
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0
+	github.com/aws/aws-sdk-go-v2/service/sns v1.34.7
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8
+	github.com/aws/aws-sdk-go-v2/service/sts v1.34.0
 	github.com/aws/rolesanywhere-credential-helper v1.0.4
 	github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874
 	github.com/camunda/zeebe/clients/go/v8 v8.2.12
@@ -92,6 +98,7 @@ require (
 	github.com/machinebox/graphql v0.2.2
 	github.com/matoous/go-nanoid/v2 v2.0.0
 	github.com/microsoft/go-mssqldb v1.6.0
+	github.com/mikeee/aws_credential_helper v0.0.1-alpha.2
 	github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4
 	github.com/mrz1836/postmark v1.6.1
 	github.com/nats-io/nats-server/v2 v2.9.23
@@ -190,16 +197,21 @@ require (
 	github.com/ardielle/ardielle-go v1.5.2 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.5 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.24.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4 // indirect
-	github.com/aws/smithy-go v1.22.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 // indirect
+	github.com/aws/smithy-go v1.22.4 // indirect
 	github.com/awslabs/kinesis-aggregation/go v0.0.0-20210630091500-54e17340d32f // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -286,9 +298,10 @@ require (
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
diff --git a/go.sum b/go.sum
index 5f89ea6d..cdf20509 100644
--- a/go.sum
+++ b/go.sum
@@ -281,49 +281,71 @@ github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk
 github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
 github.com/aws/aws-sdk-go-v2 v1.9.2/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
-github.com/aws/aws-sdk-go-v2 v1.32.4 h1:S13INUiTxgrPueTmrm5DZ+MiAo99zYzHEFh1UNkOxNE=
-github.com/aws/aws-sdk-go-v2 v1.32.4/go.mod h1:2SK5n0a2karNTv5tbP1SjsX0uhttou00v/HpXKM1ZUo=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.5 h1:xDAuZTn4IMm8o1LnBZvmrL8JA1io4o3YWNXgohbf20g=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.5/go.mod h1:wYSv6iDS621sEFLfKvpPE2ugjTuGlAG7iROg0hLOkfc=
+github.com/aws/aws-sdk-go-v2 v1.36.5 h1:0OF9RiEMEdDdZEMqF9MRjevyxAQcf6gY+E7vwBILFj0=
+github.com/aws/aws-sdk-go-v2 v1.36.5/go.mod h1:EYrzvCCN9CMUTa5+6lf6MM4tq3Zjp8UhSGR/cBsjai0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
 github.com/aws/aws-sdk-go-v2/config v1.8.3/go.mod h1:4AEiLtAb8kLs7vgw2ZV3p2VZ1+hBavOc84hqxVNpCyw=
-github.com/aws/aws-sdk-go-v2/config v1.28.2 h1:FLvWA97elBiSPdIol4CXfIAY1wlq3KzoSgkMuZSuSe8=
-github.com/aws/aws-sdk-go-v2/config v1.28.2/go.mod h1:hNmQsKfUqpKz2yfnZUB60GCemPmeqAalVTui0gOxjAE=
+github.com/aws/aws-sdk-go-v2/config v1.29.17 h1:jSuiQ5jEe4SAMH6lLRMY9OVC+TqJLP5655pBGjmnjr0=
+github.com/aws/aws-sdk-go-v2/config v1.29.17/go.mod h1:9P4wwACpbeXs9Pm9w1QTh6BwWwJjwYvJ1iCt5QbCXh8=
 github.com/aws/aws-sdk-go-v2/credentials v1.4.3/go.mod h1:FNNC6nQZQUuyhq5aE5c7ata8o9e4ECGmS4lAXC7o1mQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.43 h1:SEGdVOOE1Wyr2XFKQopQ5GYjym3nYHcphesdt78rNkY=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.43/go.mod h1:3aiza5kSyAE4eujSanOkSkAmX/RnVqslM+GRQ/Xvv4c=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.70 h1:ONnH5CM16RTXRkS8Z1qg7/s2eDOhHhaXVd72mmyv4/0=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.70/go.mod h1:M+lWhhmomVGgtuPOhO85u4pEa3SmssPTdcYpP/5J/xc=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.3 h1:xQYRnbQ+ypDMCLiFlLw5cF7Xd6K+oaL7jco2zwIMqTs=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.3/go.mod h1:X7RC8FFkx0bjNJRBddd3xdoDaDmNLSxICFdIdJ7asqw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.6.0/go.mod h1:gqlclDEZp4aqJOancXK6TN24aKhT0W0Ae9MHk3wzTMM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19 h1:woXadbf0c7enQ2UGCi8gW/WuKmE0xIzxBF/eD94jMKQ=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19/go.mod h1:zminj5ucw7w0r65bP6nhyOd3xL6veAUMc3ElGMoLVb4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 h1:KAXP9JSHO1vKGCr5f4O6WmlVKLFFXgWYAGoJosorxzU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32/go.mod h1:h4Sg6FQdexC1yYG9RDnOvLbW1a/P986++/Y/a+GyEM8=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.3.10 h1:z6fAXB4HSuYjrE/P8RU3NdCaN+EPaeq/+80aisCjuF8=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.3.10/go.mod h1:PoPjOi7j+/DtKIGC58HRfcdWKBPYYXwdKnRG+po+hzo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 h1:A2w6m6Tmr+BNXjDsr7M90zkWjsu4JXHwrzPg235STs4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23/go.mod h1:35EVp9wyeANdujZruvHiQUAo9E3vbhnIO1mTCAxMlY0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 h1:pgYW9FCabt2M25MoHYCfMrVY2ghiiBKYWUVXfwZs+sU=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23/go.mod h1:c48kLgzO19wAu3CPkDWC28JbaJ+hfQlsdl7I2+oqIbk=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.83 h1:08otkOELsIi0toRRGMytlJhOctcN8xfKfKFR2NXz3kE=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.83/go.mod h1:dGsGb2wI8JDWeMAhjVPP+z+dqvYjL6k6o+EujcRNk5c=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36 h1:SsytQyTMHMDPspp+spo7XwXTP44aJZZAC7fBV2C5+5s=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36/go.mod h1:Q1lnJArKRXkenyog6+Y+zr7WDpk4e6XlR6gs20bbeNo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36 h1:i2vNHQiXUvKhs3quBR6aqlgJaiaexz/aNvdCktW/kAM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36/go.mod h1:UdyGa7Q91id/sdyHPwth+043HhmP6yP9MBHgbZM0xo8=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.2.4/go.mod h1:ZcBrrI3zBKlhGFNYWvju0I3TR93I7YIgAfy82Fh4lcQ=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 h1:GMYy2EOWfzdP3wfVAGXBNKY5vK4K8vMET4sYOYltmqs=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36/go.mod h1:gDhdAV6wL3PmPqBhiPbnlS447GoWs8HTTOYef9/9Inw=
 github.com/aws/aws-sdk-go-v2/service/appconfig v1.4.2/go.mod h1:FZ3HkCe+b10uFZZkFdvf98LHW21k49W8o8J366lqVKY=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.17.3 h1:PtP2Zzf3uy94EsVOW+tB7gNt63fFZEHuS9IRWg5q250=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.17.3/go.mod h1:4zuvYEUJm0Vq8tb3gcb2sl04A9I1AA5DKAefbYPA4VM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0 h1:TToQNkvGguu209puTojY/ozlqy2d/SFNcoLIqTFi42g=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0/go.mod h1:0jp+ltwkf+SwG2fm/PKo8t4y8pJSgOCO4D8Lz3k0aHQ=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.4 h1:Rv6o9v2AfdEIKoAa7pQpJ5ch9ji2HevFUvGY6ufawlI=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.4/go.mod h1:mWB0GE1bqcVSvpW7OtFA0sKuHk52+IqtnsYU2jUfYAs=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.6 h1:QHaS/SHXfyNycuu4GiWb+AfW5T3bput6X5E3Ai/Q31M=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.6/go.mod h1:He/RikglWUczbkV+fkdpcV/3GdL/rTRNVy7VaUiezMo=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 h1:CXV68E2dNqhuynZJPB80bhPQwAKqBWVer887figW6Jc=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4/go.mod h1:/xFi9KtvBXP97ppCz1TAEvU1Uf66qvid89rbem3wCzQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 h1:nAP2GYbfh8dd2zGZqFRSMlq+/F6cMPBUuCsGAMkN074=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4/go.mod h1:LT10DsiGjLWh4GbjInf9LQejkYEhBgBCjLG5+lvk4EE=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.17 h1:x187MqiHwBGjMGAed8Y8K1VGuCtFvQvXb24r+bwmSdo=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.17/go.mod h1:mC9qMbA6e1pwEq6X3zDGtZRXMG2YaElJkbJlMVHLs5I=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.3.2/go.mod h1:72HRZDLMtmVQiLG2tLfQcaWLCssELvGl+Zf2WVxMmR8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 h1:tHxQi/XHPK0ctd/wdOw0t7Xrc2OxcRCnVzv8lwWPu0c=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4/go.mod h1:4GQbF1vJzG60poZqWatZlhP31y8PGCCVTvIGPdaaYJ0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17 h1:t0E6FzREdtCsiLIoLCWsYliNsRBgyGD/MCK571qk4MI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17/go.mod h1:ygpklyoaypuyDvOM5ujWGrYWpAK3h7ugnmKCU/76Ys4=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 h1:qcLWgdhq45sDM9na4cvXax9dyLitn8EYBRl8Ak4XtG4=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17/go.mod h1:M+jkjBFZ2J6DJrjMv2+vkBbuht6kxJYtJiwoVgX4p4U=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0 h1:5Y75q0RPQoAbieyOuGLhjV9P3txvYgXv2lg0UwJOfmE=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0/go.mod h1:kUklwasNoCn5YpyAqC/97r6dzTA1SRKJfKq16SXeoDU=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.7 h1:OBuZE9Wt8h2imuRktu+WfjiTGrnYdCIJg8IX92aalHE=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.7/go.mod h1:4WYoZAhHt+dWYpoOQUgkUKfuQbE6Gg/hW4oXE0pKS9U=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 h1:80dpSqWMwx2dAm30Ib7J6ucz1ZHfiv5OCRwN/EnCOXQ=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8/go.mod h1:IzNt/udsXlETCdvBOL0nmyMe2t9cGmXmZgsdoZGYYhI=
 github.com/aws/aws-sdk-go-v2/service/sso v1.4.2/go.mod h1:NBvT9R1MEF+Ud6ApJKM0G+IkPchKS7p7c2YPKwHmBOk=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.4 h1:BqE3NRG6bsODh++VMKMsDmFuJTHrdD4rJZqHjDeF6XI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.4/go.mod h1:wrMCEwjFPms+V86TCQQeOxQF/If4vT44FGIOFiMC2ck=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4 h1:zcx9LiGWZ6i6pjdcoE9oXAB6mUdeyC36Ia/QEiIvYdg=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4/go.mod h1:Tp/ly1cTjRLGBBmNccFumbZ8oqpZlpdhFf80SrRh4is=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 h1:AIRJ3lfb2w/1/8wOOSqYb9fUKGwQbtysJ2H1MofRUPg=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.5/go.mod h1:b7SiVprpU+iGazDUqvRSLf5XmCdn+JtT1on7uNL6Ipc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 h1:BpOxT3yhLwSJ77qIY3DoHAQjZsc4HEGfMCE4NGy3uFg=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3/go.mod h1:vq/GQR1gOFLquZMSrxUK/cpvKCNVYibNyJ1m7JrU88E=
 github.com/aws/aws-sdk-go-v2/service/sts v1.7.2/go.mod h1:8EzeIqfWt2wWT4rJVu3f21TfrhJ8AEMzVybRNSb/b4g=
-github.com/aws/aws-sdk-go-v2/service/sts v1.32.4 h1:yDxvkz3/uOKfxnv8YhzOi9m+2OGIxF+on3KOISbK5IU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.32.4/go.mod h1:9XEUty5v5UAsMiFOBJrNibZgwCeOma73jgGwwhgffa8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.34.0 h1:NFOJ/NXEGV4Rq//71Hs1jC/NvPs1ezajK+yQmkwnPV0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.34.0/go.mod h1:7ph2tGpfQvwzgistp2+zga9f+bCjlQJPkPUmMgDSD7w=
 github.com/aws/rolesanywhere-credential-helper v1.0.4 h1:kHIVVdyQQiFZoKBP+zywBdFilGCS8It+UvW5LolKbW8=
 github.com/aws/rolesanywhere-credential-helper v1.0.4/go.mod h1:QVGNxlDlYhjR0/ZUee7uGl0hNChWidNpe2+GD87Buqk=
 github.com/aws/smithy-go v1.8.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
-github.com/aws/smithy-go v1.22.0 h1:uunKnWlcoL3zO7q+gG2Pk53joueEOsnNB28QdMsmiMM=
-github.com/aws/smithy-go v1.22.0/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
+github.com/aws/smithy-go v1.22.4 h1:uqXzVZNuNexwc/xrh6Tb56u89WDlJY6HS+KC0S4QSjw=
+github.com/aws/smithy-go v1.22.4/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
 github.com/awslabs/kinesis-aggregation/go v0.0.0-20210630091500-54e17340d32f h1:Pf0BjJDga7C98f0vhw+Ip5EaiE07S3lTKpIYPNS0nMo=
 github.com/awslabs/kinesis-aggregation/go v0.0.0-20210630091500-54e17340d32f/go.mod h1:SghidfnxvX7ribW6nHI7T+IBbc9puZ9kk5Tx/88h8P4=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
@@ -945,8 +967,8 @@ github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9
 github.com/hashicorp/go-hclog v0.8.0/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
-github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
@@ -962,6 +984,8 @@ github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn
 github.com/hashicorp/go-plugin v1.4.3/go.mod h1:5fGEH17QVwTTcR0zV7yhDPLLmFX9YSZ38b18Udy6vYQ=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
 github.com/hashicorp/go-retryablehttp v0.5.4/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
+github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
+github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-rootcerts v1.0.1/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
@@ -1233,6 +1257,8 @@ github.com/miekg/dns v1.1.27/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
 github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
 github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
+github.com/mikeee/aws_credential_helper v0.0.1-alpha.2 h1:qhP1AlQCklni6kNbvGVI5lAicAVef4cGP1JVMaWUDqc=
+github.com/mikeee/aws_credential_helper v0.0.1-alpha.2/go.mod h1:ql8URJDxt5h47BSezC1QUi3QWRn/FjVWn858+b1h+xU=
 github.com/minio/highwayhash v1.0.2 h1:Aak5U0nElisjDCfPSG79Tgzkn2gl66NxOMspRrKnA/g=
 github.com/minio/highwayhash v1.0.2/go.mod h1:BQskDq+xkJ12lmlUUi7U0M5Swg3EWR+dLTk+kldvVxY=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
diff --git a/metadata/utils.go b/metadata/utils.go
index 50591061..b5b73b1b 100644
--- a/metadata/utils.go
+++ b/metadata/utils.go
@@ -168,7 +168,8 @@ func (t ComponentType) IsValid() bool {
 		SecretStoreType, PubSubType,
 		LockStoreType, ConfigurationStoreType,
 		MiddlewareType, CryptoType,
-		NameResolutionType, WorkflowType:
+		NameResolutionType, WorkflowType,
+		ConversationType:
 		return true
 	default:
 		return false
diff --git a/pubsub/aws/snssqs/metadata.go b/pubsub/aws/snssqs/metadata.go
index f79ed207..2972172e 100644
--- a/pubsub/aws/snssqs/metadata.go
+++ b/pubsub/aws/snssqs/metadata.go
@@ -37,7 +37,7 @@ type snsSqsMetadata struct {
 	// see: https://aws.amazon.com/blogs/compute/solving-complex-ordering-challenges-with-amazon-sqs-fifo-queues/
 	FifoMessageGroupID string `mapstructure:"fifoMessageGroupID"`
 	// amount of time in seconds that a message is hidden from receive requests after it is sent to a subscriber. Default: 10.
-	MessageVisibilityTimeout int64 `mapstructure:"messageVisibilityTimeout"`
+	MessageVisibilityTimeout int32 `mapstructure:"messageVisibilityTimeout"`
 	// number of times to resend a message after processing of that message fails before removing that message from the queue. Default: 10.
 	MessageRetryLimit int64 `mapstructure:"messageRetryLimit"`
 	// upon reaching the messageRetryLimit, disables the default deletion behaviour of the message from the SQS queue, and resetting the message visibilty on SQS
@@ -47,9 +47,9 @@ type snsSqsMetadata struct {
 	// before it is moved to the dead-letters queue. This value must be smaller than messageRetryLimit.
 	MessageReceiveLimit int64 `mapstructure:"messageReceiveLimit"`
 	// amount of time to await receipt of a message before making another request. Default: 2.
-	MessageWaitTimeSeconds int64 `mapstructure:"messageWaitTimeSeconds"`
+	MessageWaitTimeSeconds int32 `mapstructure:"messageWaitTimeSeconds"`
 	// maximum number of messages to receive from the queue at a time. Default: 10, Maximum: 10.
-	MessageMaxNumber int64 `mapstructure:"messageMaxNumber"`
+	MessageMaxNumber int32 `mapstructure:"messageMaxNumber"`
 	// disable resource provisioning of SNS and SQS.
 	DisableEntityManagement bool `mapstructure:"disableEntityManagement"`
 	// assets creation timeout.
diff --git a/pubsub/aws/snssqs/snssqs.go b/pubsub/aws/snssqs/snssqs.go
index e84dbeb8..37491976 100644
--- a/pubsub/aws/snssqs/snssqs.go
+++ b/pubsub/aws/snssqs/snssqs.go
@@ -25,17 +25,19 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/sns"
-	"github.com/aws/aws-sdk-go/service/sqs"
-	"github.com/aws/aws-sdk-go/service/sts"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sns"
+	snsTypes "github.com/aws/aws-sdk-go-v2/service/sns/types"
+	"github.com/aws/aws-sdk-go-v2/service/sqs"
+	sqsTypes "github.com/aws/aws-sdk-go-v2/service/sqs/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
 
 	"github.com/dapr/kit/retry"
 
 	gonanoid "github.com/matoous/go-nanoid/v2"
 
-	awsAuth "github.com/dapr/components-contrib/common/authentication/aws"
+	awsCommon "github.com/dapr/components-contrib/common/aws"
+	awsCommonAuth "github.com/dapr/components-contrib/common/aws/auth"
 	"github.com/dapr/components-contrib/metadata"
 	"github.com/dapr/components-contrib/pubsub"
 	"github.com/dapr/kit/logger"
@@ -49,7 +51,6 @@ type snsSqs struct {
 	queues map[string]*sqsQueueInfo
 	// key is a composite key of queue ARN and topic ARN mapping to subscription ARN.
 	subscriptions       map[string]string
-	authProvider        awsAuth.Provider
 	metadata            *snsSqsMetadata
 	logger              logger.Logger
 	id                  string
@@ -57,6 +58,11 @@ type snsSqs struct {
 	backOffConfig       retry.Config
 	subscriptionManager SubscriptionManagement
 	closed              atomic.Bool
+
+	stsClient *sts.Client
+
+	sqsClient *sqs.Client
+	snsClient *sns.Client
 }
 
 type sqsQueueInfo struct {
@@ -143,25 +149,30 @@ func (s *snsSqs) Init(ctx context.Context, metadata pubsub.Metadata) error {
 
 	s.metadata = m
 
-	if s.authProvider == nil {
-		opts := awsAuth.Options{
-			Logger:       s.logger,
-			Properties:   metadata.Properties,
-			Region:       m.Region,
-			Endpoint:     m.Endpoint,
-			AccessKey:    m.AccessKey,
-			SecretKey:    m.SecretKey,
-			SessionToken: m.SessionToken,
-		}
-		// extra configs needed per component type
-		var provider awsAuth.Provider
-		provider, err = awsAuth.NewProvider(ctx, opts, awsAuth.GetConfig(opts))
-		if err != nil {
-			return err
-		}
-		s.authProvider = provider
+	configOpts := awsCommonAuth.Options{
+		Logger: s.logger,
+
+		Properties: metadata.Properties,
+
+		Region:       m.Region,
+		Endpoint:     m.Endpoint,
+		AccessKey:    m.AccessKey, // TODO: Remove fields as they should be gleaned from metadata.properties
+		SecretKey:    m.SecretKey,
+		SessionToken: m.SessionToken,
+
+		// TODO: Add assume role provider config options
+	}
+
+	awsConfig, err := awsCommon.NewConfig(ctx, configOpts)
+	if err != nil {
+		return fmt.Errorf("error getting AWS config: %w", err)
 	}
 
+	s.stsClient = sts.NewFromConfig(awsConfig)
+
+	s.sqsClient = sqs.NewFromConfig(awsConfig)
+	s.snsClient = sns.NewFromConfig(awsConfig)
+
 	s.opsTimeout = time.Duration(m.AssetsManagementTimeoutSeconds * float64(time.Second))
 
 	err = s.setAwsAccountIDIfNotProvided(ctx)
@@ -190,7 +201,7 @@ func (s *snsSqs) setAwsAccountIDIfNotProvided(parentCtx context.Context) error {
 		return nil
 	}
 	ctx, cancelFn := context.WithTimeout(parentCtx, s.opsTimeout)
-	callerIDOutput, err := s.authProvider.SnsSqs().Sts.GetCallerIdentityWithContext(ctx, &sts.GetCallerIdentityInput{})
+	callerIDOutput, err := s.stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
 	cancelFn()
 	if err != nil {
 		return fmt.Errorf("error fetching sts caller ID: %w", err)
@@ -208,15 +219,15 @@ func (s *snsSqs) createTopic(parentCtx context.Context, topic string) (string, e
 	sanitizedName := nameToAWSSanitizedName(topic, s.metadata.Fifo)
 	snsCreateTopicInput := &sns.CreateTopicInput{
 		Name: aws.String(sanitizedName),
-		Tags: []*sns.Tag{{Key: aws.String(awsSnsTopicNameKey), Value: aws.String(topic)}},
+		Tags: []snsTypes.Tag{{Key: aws.String(awsSnsTopicNameKey), Value: aws.String(topic)}},
 	}
 
 	if s.metadata.Fifo {
-		attributes := map[string]*string{"FifoTopic": aws.String("true"), "ContentBasedDeduplication": aws.String("true")}
-		snsCreateTopicInput.SetAttributes(attributes)
+		attributes := map[string]string{"FifoTopic": "true", "ContentBasedDeduplication": "true"}
+		snsCreateTopicInput.Attributes = attributes
 	}
 	ctx, cancelFn := context.WithTimeout(parentCtx, s.opsTimeout)
-	createTopicResponse, err := s.authProvider.SnsSqs().Sns.CreateTopicWithContext(ctx, snsCreateTopicInput)
+	createTopicResponse, err := s.snsClient.CreateTopic(ctx, snsCreateTopicInput)
 	cancelFn()
 	if err != nil {
 		return "", fmt.Errorf("error while creating an SNS topic: %w", err)
@@ -228,7 +239,7 @@ func (s *snsSqs) createTopic(parentCtx context.Context, topic string) (string, e
 func (s *snsSqs) getTopicArn(parentCtx context.Context, topic string) (string, error) {
 	ctx, cancelFn := context.WithTimeout(parentCtx, s.opsTimeout)
 	arn := s.buildARN("sns", topic)
-	getTopicOutput, err := s.authProvider.SnsSqs().Sns.GetTopicAttributesWithContext(ctx, &sns.GetTopicAttributesInput{
+	getTopicOutput, err := s.snsClient.GetTopicAttributes(ctx, &sns.GetTopicAttributesInput{
 		TopicArn: &arn,
 	})
 	cancelFn()
@@ -236,7 +247,7 @@ func (s *snsSqs) getTopicArn(parentCtx context.Context, topic string) (string, e
 		return "", fmt.Errorf("error: %w, while getting (sanitized) topic: %v with arn: %v", err, topic, arn)
 	}
 
-	return *getTopicOutput.Attributes["TopicArn"], nil
+	return getTopicOutput.Attributes["TopicArn"], nil
 }
 
 // Get the topic ARN from the topics map. If it doesn't exist in the map, try to fetch it from AWS, if it doesn't exist
@@ -287,24 +298,24 @@ func (s *snsSqs) createQueue(parentCtx context.Context, queueName string) (*sqsQ
 	sanitizedName := nameToAWSSanitizedName(queueName, s.metadata.Fifo)
 	sqsCreateQueueInput := &sqs.CreateQueueInput{
 		QueueName: aws.String(sanitizedName),
-		Tags:      map[string]*string{awsSqsQueueNameKey: aws.String(queueName)},
+		Tags:      map[string]string{awsSqsQueueNameKey: queueName},
 	}
 
 	if s.metadata.Fifo {
-		attributes := map[string]*string{"FifoQueue": aws.String("true"), "ContentBasedDeduplication": aws.String("true")}
-		sqsCreateQueueInput.SetAttributes(attributes)
+		attributes := map[string]string{"FifoQueue": "true", "ContentBasedDeduplication": "true"}
+		sqsCreateQueueInput.Attributes = attributes
 	}
 
 	ctx, cancel := context.WithTimeout(parentCtx, s.opsTimeout)
-	createQueueResponse, err := s.authProvider.SnsSqs().Sqs.CreateQueueWithContext(ctx, sqsCreateQueueInput)
+	createQueueResponse, err := s.sqsClient.CreateQueue(ctx, sqsCreateQueueInput)
 	cancel()
 	if err != nil {
 		return nil, fmt.Errorf("error creaing an SQS queue: %w", err)
 	}
 
 	ctx, cancel = context.WithTimeout(parentCtx, s.opsTimeout)
-	queueAttributesResponse, err := s.authProvider.SnsSqs().Sqs.GetQueueAttributesWithContext(ctx, &sqs.GetQueueAttributesInput{
-		AttributeNames: []*string{aws.String("QueueArn")},
+	queueAttributesResponse, err := s.sqsClient.GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{
+		AttributeNames: []sqsTypes.QueueAttributeName{sqsTypes.QueueAttributeNameQueueArn},
 		QueueUrl:       createQueueResponse.QueueUrl,
 	})
 	cancel()
@@ -313,14 +324,17 @@ func (s *snsSqs) createQueue(parentCtx context.Context, queueName string) (*sqsQ
 	}
 
 	return &sqsQueueInfo{
-		arn: *(queueAttributesResponse.Attributes["QueueArn"]),
+		arn: queueAttributesResponse.Attributes["QueueArn"],
 		url: *(createQueueResponse.QueueUrl),
 	}, nil
 }
 
 func (s *snsSqs) getQueueArn(parentCtx context.Context, queueName string) (*sqsQueueInfo, error) {
 	ctx, cancel := context.WithTimeout(parentCtx, s.opsTimeout)
-	queueURLOutput, err := s.authProvider.SnsSqs().Sqs.GetQueueUrlWithContext(ctx, &sqs.GetQueueUrlInput{QueueName: aws.String(queueName), QueueOwnerAWSAccountId: aws.String(s.metadata.AccountID)})
+	queueURLOutput, err := s.sqsClient.GetQueueUrl(ctx, &sqs.GetQueueUrlInput{
+		QueueName:              aws.String(queueName),
+		QueueOwnerAWSAccountId: aws.String(s.metadata.AccountID),
+	})
 	cancel()
 	if err != nil {
 		return nil, fmt.Errorf("error: %w while getting url of queue: %s", err, queueName)
@@ -328,13 +342,16 @@ func (s *snsSqs) getQueueArn(parentCtx context.Context, queueName string) (*sqsQ
 	url := queueURLOutput.QueueUrl
 
 	ctx, cancel = context.WithTimeout(parentCtx, s.opsTimeout)
-	getQueueOutput, err := s.authProvider.SnsSqs().Sqs.GetQueueAttributesWithContext(ctx, &sqs.GetQueueAttributesInput{QueueUrl: url, AttributeNames: []*string{aws.String("QueueArn")}})
+	getQueueOutput, err := s.sqsClient.GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{
+		QueueUrl:       url,
+		AttributeNames: []sqsTypes.QueueAttributeName{sqsTypes.QueueAttributeNameQueueArn},
+	})
 	cancel()
 	if err != nil {
 		return nil, fmt.Errorf("error: %w while getting information for queue: %s, with url: %s", err, queueName, *url)
 	}
 
-	return &sqsQueueInfo{arn: *getQueueOutput.Attributes["QueueArn"], url: *url}, nil
+	return &sqsQueueInfo{arn: getQueueOutput.Attributes["QueueArn"], url: *url}, nil
 }
 
 func (s *snsSqs) getOrCreateQueue(ctx context.Context, queueName string) (*sqsQueueInfo, error) {
@@ -389,11 +406,11 @@ func (s *snsSqs) getMessageGroupID(req *pubsub.PublishRequest) *string {
 
 func (s *snsSqs) createSnsSqsSubscription(parentCtx context.Context, queueArn, topicArn string) (string, error) {
 	ctx, cancel := context.WithTimeout(parentCtx, s.opsTimeout)
-	subscribeOutput, err := s.authProvider.SnsSqs().Sns.SubscribeWithContext(ctx, &sns.SubscribeInput{
+	subscribeOutput, err := s.snsClient.Subscribe(ctx, &sns.SubscribeInput{
 		Attributes:            nil,
 		Endpoint:              aws.String(queueArn), // create SQS queue per subscription.
 		Protocol:              aws.String("sqs"),
-		ReturnSubscriptionArn: nil,
+		ReturnSubscriptionArn: false, // TODO: Check if this is needed - old value was nil
 		TopicArn:              aws.String(topicArn),
 	})
 	cancel()
@@ -409,7 +426,8 @@ func (s *snsSqs) createSnsSqsSubscription(parentCtx context.Context, queueArn, t
 
 func (s *snsSqs) getSnsSqsSubscriptionArn(parentCtx context.Context, topicArn string) (string, error) {
 	ctx, cancel := context.WithTimeout(parentCtx, s.opsTimeout)
-	listSubscriptionsOutput, err := s.authProvider.SnsSqs().Sns.ListSubscriptionsByTopicWithContext(ctx, &sns.ListSubscriptionsByTopicInput{TopicArn: aws.String(topicArn)})
+	listSubscriptionsOutput, err := s.snsClient.ListSubscriptionsByTopic(ctx,
+		&sns.ListSubscriptionsByTopicInput{TopicArn: aws.String(topicArn)})
 	cancel()
 	if err != nil {
 		return "", fmt.Errorf("error listing subsriptions for topic arn: %v: %w", topicArn, err)
@@ -458,7 +476,7 @@ func (s *snsSqs) getOrCreateSnsSqsSubscription(ctx context.Context, queueArn, to
 
 func (s *snsSqs) acknowledgeMessage(parentCtx context.Context, queueURL string, receiptHandle *string) error {
 	ctx, cancelFn := context.WithCancel(parentCtx)
-	_, err := s.authProvider.SnsSqs().Sqs.DeleteMessageWithContext(ctx, &sqs.DeleteMessageInput{
+	_, err := s.sqsClient.DeleteMessage(ctx, &sqs.DeleteMessageInput{
 		QueueUrl:      aws.String(queueURL),
 		ReceiptHandle: receiptHandle,
 	})
@@ -473,10 +491,10 @@ func (s *snsSqs) acknowledgeMessage(parentCtx context.Context, queueURL string,
 func (s *snsSqs) resetMessageVisibilityTimeout(parentCtx context.Context, queueURL string, receiptHandle *string) error {
 	ctx, cancelFn := context.WithCancel(parentCtx)
 	// reset the timeout to its initial value so that the remaining timeout would be overridden by the initial value for other consumer to attempt processing.
-	_, err := s.authProvider.SnsSqs().Sqs.ChangeMessageVisibilityWithContext(ctx, &sqs.ChangeMessageVisibilityInput{
+	_, err := s.sqsClient.ChangeMessageVisibility(ctx, &sqs.ChangeMessageVisibilityInput{
 		QueueUrl:          aws.String(queueURL),
 		ReceiptHandle:     receiptHandle,
-		VisibilityTimeout: aws.Int64(0),
+		VisibilityTimeout: 0,
 	})
 	cancelFn()
 	if err != nil {
@@ -486,23 +504,25 @@ func (s *snsSqs) resetMessageVisibilityTimeout(parentCtx context.Context, queueU
 	return nil
 }
 
-func (s *snsSqs) parseReceiveCount(message *sqs.Message) (int64, error) {
+func (s *snsSqs) parseReceiveCount(message *sqsTypes.Message) (int64, error) {
 	// if this message has been received > x times, delete from queue, it's borked.
-	recvCount, ok := message.Attributes[sqs.MessageSystemAttributeNameApproximateReceiveCount]
+	recvCount, ok := message.Attributes[string(sqsTypes.MessageSystemAttributeNameApproximateReceiveCount)]
 
 	if !ok {
 		return 0, fmt.Errorf(
 			"no ApproximateReceiveCount returned with response, will not attempt further processing: %v", message)
 	}
 
-	recvCountInt, err := strconv.ParseInt(*recvCount, 10, 32)
+	recvCountInt, err := strconv.ParseInt(recvCount, 10, 32)
 	if err != nil {
 		return 0, fmt.Errorf("error parsing ApproximateReceiveCount from message: %v", message)
 	}
 	return recvCountInt, nil
 }
 
-func (s *snsSqs) validateMessage(ctx context.Context, message *sqs.Message, queueInfo, deadLettersQueueInfo *sqsQueueInfo) error {
+func (s *snsSqs) validateMessage(ctx context.Context, message *sqsTypes.Message, queueInfo,
+	deadLettersQueueInfo *sqsQueueInfo,
+) error {
 	recvCount, err := s.parseReceiveCount(message)
 	if err != nil {
 		return err
@@ -531,16 +551,14 @@ func (s *snsSqs) validateMessage(ctx context.Context, message *sqs.Message, queu
 	// already been moved to the dead-letters queue by SQS. meaning, the below condition should not be reached as SQS would not send
 	// a message if we've already surpassed the messageRetryLimit value.
 	if deadLettersQueueInfo != nil && recvCount > messageRetryLimit {
-		awsErr := fmt.Errorf(
+		return fmt.Errorf(
 			"message received greater than %v times, this message should have been moved without further processing to dead-letters queue: %v", messageRetryLimit, s.metadata.SqsDeadLettersQueueName)
-
-		return awsErr
 	}
 
 	return nil
 }
 
-func (s *snsSqs) callHandler(ctx context.Context, message *sqs.Message, queueInfo *sqsQueueInfo) error {
+func (s *snsSqs) callHandler(ctx context.Context, message *sqsTypes.Message, queueInfo *sqsQueueInfo) error {
 	// otherwise, try to handle the message.
 	var snsMessagePayload snsMessage
 	err := json.Unmarshal([]byte(*(message.Body)), &snsMessagePayload)
@@ -585,19 +603,16 @@ func (s *snsSqs) consumeSubscription(ctx context.Context, queueInfo, deadLetters
 	sqsPullExponentialBackoff := s.backOffConfig.NewBackOffWithContext(ctx)
 
 	receiveMessageInput := &sqs.ReceiveMessageInput{
-		// use this property to decide when a message should be discarded.
-		AttributeNames: []*string{
-			aws.String(sqs.MessageSystemAttributeNameApproximateReceiveCount),
-		},
-		MaxNumberOfMessages: aws.Int64(s.metadata.MessageMaxNumber),
+		AttributeNames:      []sqsTypes.QueueAttributeName{sqsTypes.QueueAttributeNameAll},
+		MaxNumberOfMessages: s.metadata.MessageMaxNumber,
 		QueueUrl:            aws.String(queueInfo.url),
-		VisibilityTimeout:   aws.Int64(s.metadata.MessageVisibilityTimeout),
-		WaitTimeSeconds:     aws.Int64(s.metadata.MessageWaitTimeSeconds),
+		VisibilityTimeout:   s.metadata.MessageVisibilityTimeout,
+		WaitTimeSeconds:     s.metadata.MessageWaitTimeSeconds,
 	}
 
 	// sem is a semaphore used to control the concurrencyLimit.
 	// It is set only when we are in parallel mode and limit is > 0.
-	var sem chan (struct{}) = nil
+	var sem chan struct{} = nil
 	if (s.metadata.ConcurrencyMode == pubsub.Parallel) && s.metadata.ConcurrencyLimit > 0 {
 		sem = make(chan struct{}, s.metadata.ConcurrencyLimit)
 	}
@@ -611,19 +626,15 @@ func (s *snsSqs) consumeSubscription(ctx context.Context, queueInfo, deadLetters
 		// sqs and try pull messages. Since we are iteratively short polling (based on the defined
 		// s.metadata.messageWaitTimeSeconds) the sdk backoff is not effective as it gets reset per each polling
 		// iteration. Therefore, a global backoff (to the internal backoff) is used (sqsPullExponentialBackoff).
-		messageResponse, err := s.authProvider.SnsSqs().Sqs.ReceiveMessageWithContext(ctx, receiveMessageInput)
+		messageResponse, err := s.sqsClient.ReceiveMessage(ctx, receiveMessageInput)
 		if err != nil {
 			if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) || ctx.Err() != nil {
 				s.logger.Warn("context canceled; stopping consuming from queue arn: %v", queueInfo.arn)
 				continue
 			}
 
-			var awsErr awserr.Error
-			if errors.As(err, &awsErr) {
-				s.logger.Errorf("AWS operation error while consuming from queue arn: %v with error: %w. retrying...", queueInfo.arn, awsErr.Error())
-			} else {
-				s.logger.Errorf("error consuming from queue arn: %v with error: %w. retrying...", queueInfo.arn, err)
-			}
+			s.logger.Errorf("error consuming from queue arn: %v with error: %w. retrying...", queueInfo.arn, err)
+
 			time.Sleep(sqsPullExponentialBackoff.NextBackOff())
 
 			continue
@@ -637,12 +648,12 @@ func (s *snsSqs) consumeSubscription(ctx context.Context, queueInfo, deadLetters
 		s.logger.Debugf("%v message(s) received on queue %s", len(messageResponse.Messages), queueInfo.arn)
 
 		for _, message := range messageResponse.Messages {
-			if err := s.validateMessage(ctx, message, queueInfo, deadLettersQueueInfo); err != nil {
+			if err := s.validateMessage(ctx, &message, queueInfo, deadLettersQueueInfo); err != nil {
 				s.logger.Errorf("message is not valid for further processing by the handler. error is: %v", err)
 				continue
 			}
 
-			f := func(message *sqs.Message) {
+			f := func(message *sqsTypes.Message) {
 				if err := s.callHandler(ctx, message, queueInfo); err != nil {
 					s.logger.Errorf("error while handling received message. error is: %v", err)
 				}
@@ -650,7 +661,7 @@ func (s *snsSqs) consumeSubscription(ctx context.Context, queueInfo, deadLetters
 
 			switch s.metadata.ConcurrencyMode {
 			case pubsub.Single:
-				f(message)
+				f(&message)
 			case pubsub.Parallel:
 				// This is the back pressure mechanism.
 				// It will block until another goroutine frees a slot.
@@ -658,13 +669,13 @@ func (s *snsSqs) consumeSubscription(ctx context.Context, queueInfo, deadLetters
 					sem <- struct{}{}
 				}
 
-				go func(message *sqs.Message) {
+				go func(message *sqsTypes.Message) {
 					if sem != nil {
 						defer func() { <-sem }()
 					}
 
 					f(message)
-				}(message)
+				}(&message)
 			}
 		}
 	}
@@ -686,8 +697,8 @@ func (s *snsSqs) createDeadLettersQueueAttributes(queueInfo, deadLettersQueueInf
 
 	sqsSetQueueAttributesInput := &sqs.SetQueueAttributesInput{
 		QueueUrl: &queueInfo.url,
-		Attributes: map[string]*string{
-			sqs.QueueAttributeNameRedrivePolicy: aws.String(string(b)),
+		Attributes: map[string]string{
+			string(sqsTypes.QueueAttributeNameRedrivePolicy): string(b),
 		},
 	}
 
@@ -708,7 +719,7 @@ func (s *snsSqs) setDeadLettersQueueAttributes(parentCtx context.Context, queueI
 		return wrappedErr
 	}
 	ctx, cancelFn := context.WithTimeout(parentCtx, s.opsTimeout)
-	_, derr = s.authProvider.SnsSqs().Sqs.SetQueueAttributesWithContext(ctx, sqsSetQueueAttributesInput)
+	_, derr = s.sqsClient.SetQueueAttributes(ctx, sqsSetQueueAttributesInput)
 	cancelFn()
 	if derr != nil {
 		wrappedErr := fmt.Errorf("error updating queue attributes with dead-letter queue: %w", derr)
@@ -728,9 +739,9 @@ func (s *snsSqs) restrictQueuePublishPolicyToOnlySNS(parentCtx context.Context,
 
 	ctx, cancelFn := context.WithTimeout(parentCtx, s.opsTimeout)
 	// only permit SNS to send messages to SQS using the created subscription.
-	getQueueAttributesOutput, err := s.authProvider.SnsSqs().Sqs.GetQueueAttributesWithContext(ctx, &sqs.GetQueueAttributesInput{
+	getQueueAttributesOutput, err := s.sqsClient.GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{
 		QueueUrl:       &sqsQueueInfo.url,
-		AttributeNames: []*string{aws.String(sqs.QueueAttributeNamePolicy)},
+		AttributeNames: []sqsTypes.QueueAttributeName{sqsTypes.QueueAttributeNamePolicy},
 	})
 	cancelFn()
 	if err != nil {
@@ -738,9 +749,9 @@ func (s *snsSqs) restrictQueuePublishPolicyToOnlySNS(parentCtx context.Context,
 	}
 
 	policy := &policy{Version: "2012-10-17"}
-	if policyStr, ok := getQueueAttributesOutput.Attributes[sqs.QueueAttributeNamePolicy]; ok {
+	if policyStr, ok := getQueueAttributesOutput.Attributes[string(sqsTypes.QueueAttributeNamePolicy)]; ok {
 		// look for the current statement if exists, else add it and store.
-		if err = json.Unmarshal([]byte(*policyStr), policy); err != nil {
+		if err = json.Unmarshal([]byte(policyStr), policy); err != nil {
 			return fmt.Errorf("error unmarshalling sqs policy: %w", err)
 		}
 	}
@@ -755,9 +766,9 @@ func (s *snsSqs) restrictQueuePublishPolicyToOnlySNS(parentCtx context.Context,
 	}
 
 	ctx, cancelFn = context.WithTimeout(parentCtx, s.opsTimeout)
-	_, err = s.authProvider.SnsSqs().Sqs.SetQueueAttributesWithContext(ctx, &(sqs.SetQueueAttributesInput{
-		Attributes: map[string]*string{
-			"Policy": aws.String(string(b)),
+	_, err = s.sqsClient.SetQueueAttributes(ctx, &(sqs.SetQueueAttributesInput{
+		Attributes: map[string]string{
+			"Policy": string(b),
 		},
 		QueueUrl: &sqsQueueInfo.url,
 	}))
@@ -868,7 +879,7 @@ func (s *snsSqs) Publish(ctx context.Context, req *pubsub.PublishRequest) error
 	}
 
 	// sns client has internal exponential backoffs.
-	_, err = s.authProvider.SnsSqs().Sns.PublishWithContext(ctx, snsPublishInput)
+	_, err = s.snsClient.Publish(ctx, snsPublishInput)
 	if err != nil {
 		wrappedErr := fmt.Errorf("error publishing to topic: %s with topic ARN %s: %w", req.Topic, topicArn, err)
 		s.logger.Error(wrappedErr)
@@ -886,9 +897,6 @@ func (s *snsSqs) Close() error {
 		s.subscriptionManager.Close()
 	}
 
-	if s.authProvider != nil {
-		return s.authProvider.Close()
-	}
 	return nil
 }
 
diff --git a/pubsub/kafka/metadata.yaml b/pubsub/kafka/metadata.yaml
index d45a9eb6..04d99550 100644
--- a/pubsub/kafka/metadata.yaml
+++ b/pubsub/kafka/metadata.yaml
@@ -363,3 +363,10 @@ metadata:
         - "range"
         - "sticky"
         - "roundrobin"
+    - name: excludeHeaderMetaRegex
+      type: string
+      required: false
+      description: |
+        A regular expression to exclude keys from being converted to/from headers from/to metadata to avoid unwanted downstream side effects.
+      example: '"^rawPayload|valueSchemaType$"'
+      default: '""'
diff --git a/pubsub/mqtt3/mqtt.go b/pubsub/mqtt3/mqtt.go
index a1da0cec..391ce9bc 100644
--- a/pubsub/mqtt3/mqtt.go
+++ b/pubsub/mqtt3/mqtt.go
@@ -46,6 +46,7 @@ type mqttPubSub struct {
 	logger          logger.Logger
 	topics          map[string]mqttPubSubSubscription
 	subscribingLock sync.RWMutex
+	deletionLock    sync.RWMutex
 	reconnectCh     chan struct{}
 	closeCh         chan struct{}
 	closed          atomic.Bool
@@ -143,11 +144,11 @@ func (m *mqttPubSub) Subscribe(ctx context.Context, req pubsub.SubscribeRequest,
 
 	m.subscribingLock.Lock()
 	defer m.subscribingLock.Unlock()
-
 	// Add the topic then start the subscription
 	m.addTopic(topic, handler)
 
 	token := m.conn.Subscribe(topic, m.metadata.Qos, m.onMessage(ctx))
+
 	var err error
 	select {
 	case <-token.Done():
@@ -180,7 +181,9 @@ func (m *mqttPubSub) Subscribe(ctx context.Context, req pubsub.SubscribeRequest,
 		}
 
 		// Delete the topic from the map first, which stops routing messages to handlers
+		m.deletionLock.Lock()
 		delete(m.topics, topic)
+		m.deletionLock.Unlock()
 
 		// We will call Unsubscribe only if cleanSession is true or if "unsubscribeOnClose" in the request metadata is true
 		// Otherwise, calling this will make the broker lose the position of our subscription, which is not what we want if we are going to reconnect later
diff --git a/pubsub/redis/metadata.yaml b/pubsub/redis/metadata.yaml
index dae86bd6..ed852f20 100644
--- a/pubsub/redis/metadata.yaml
+++ b/pubsub/redis/metadata.yaml
@@ -46,9 +46,10 @@ metadata:
   - name: enableTLS
     required: false
     description: |
-      If the Redis instance supports TLS, can be configured to be enabled or disabled. Defaults to "false".
+      If the Redis instance supports TLS, can be configured to be enabled or disabled.
     example: "false"
     type: bool
+    default: "false"
   - name: clientCert
     required: false
     description: Client certificate for Redis host. No Default. Can be secretKeyRef to use a secret reference
@@ -62,38 +63,44 @@ metadata:
   - name: redeliverInterval
     required: false
     description: |
-      The interval between checking for pending messages to redelivery. Defaults to "60s". "0" disables redelivery.
+      The interval between checking for pending messages to redelivery. "0" disables redelivery.
     example: "30s"
+    default: "60s"
     type: duration
   - name: processingTimeout
     required: false
     description: |
-      The amount time a message must be pending before attempting to redeliver it. Defaults to "15s". "0" disables redelivery.
+      The amount time a message must be pending before attempting to redeliver it. "0" disables redelivery.
     example: "30s"
     type: duration
+    default: "15s"
   - name: queueDepth
     required: false
     description: |
-      The size of the message queue for processing. Defaults to "100".
+      The size of the message queue for processing.
     example: "1000"
+    default: "100"
     type: number
   - name: concurrency
     required: false
     description: |
-      The number of concurrent workers that are processing messages. Defaults to "10".
+      The number of concurrent workers that are processing messages.
     example: "15"
+    default: "10"
     type: number
   - name: redisType
     required: false
     description: |
-      The type of redis. There are two valid values, one is "node" for single node mode, the other is "cluster" for redis cluster mode. Defaults to "node".
+      The type of redis. There are two valid values, one is "node" for single node mode, the other is "cluster" for redis cluster mode.
     example: "cluster"
     type: string
+    default: "node"
   - name: redisDB
     required: false
     description: |
-      Database selected after connecting to redis. If "redisType" is "cluster" this option is ignored. Defaults to "0".
+      Database selected after connecting to redis. If "redisType" is "cluster" this option is ignored.
     example: "0"
+    default: "0"
     type: number
   - name: redisMaxRetries
     required: false
@@ -103,26 +110,30 @@ metadata:
   - name: redisMinRetryInterval
     required: false
     description: |
-      Minimum backoff for redis commands between each retry. Default is "8ms"; "-1" disables backoff.
+      Minimum backoff for redis commands between each retry. "-1" disables backoff.
     example: "8ms"
+    default: "8ms"
     type: duration
   - name: redisMaxRetryInterval
     required: false
     description: |
-      Maximum backoff for redis commands between each retry. Default is "512ms";"-1" disables backoff.
+      Maximum backoff for redis commands between each retry. "-1" disables backoff.
     example: "5s"
+    default: "512ms"
     type: duration
   - name: dialTimeout
     required: false
     description: |
-      Dial timeout for establishing new connections. Defaults to "5s".
+      Dial timeout for establishing new connections.
     example: "5s"
+    default: "5s"
     type: duration
   - name: readTimeout
     required: false
     description: |
-      Timeout for socket reads. If reached, redis commands will fail with a timeout instead of blocking. Defaults to "3s", "-1" for no timeout.
+      Timeout for socket reads. If reached, redis commands will fail with a timeout instead of blocking. "-1" for no timeout.
     example: "3s"
+    default: "3"
     type: duration
   - name: writeTimeout
     required: false
@@ -147,26 +158,30 @@ metadata:
   - name: minIdleConns
     required: false
     description: |
-      Minimum number of idle connections to keep open in order to avoid the performance degradation associated with creating new connections. Defaults to "0".
+      Minimum number of idle connections to keep open in order to avoid the performance degradation associated with creating new connections.
     example: "2"
+    default: "0"
     type: number
   - name: idleCheckFrequency
     required: false
     description: |
-      Frequency of idle checks made by idle connections reaper. Default is "1m". "-1" disables idle connections reaper.
+      Frequency of idle checks made by idle connections reaper. "-1" disables idle connections reaper.
     example: "-1"
+    default: "1m"
     type: duration
   - name: idleTimeout
     required: false
     description: |
-      Amount of time after which the client closes idle connections. Should be less than server's timeout. Default is "5m". "-1" disables idle timeout check.
+      Amount of time after which the client closes idle connections. Should be less than server's timeout. "-1" disables idle timeout check.
     example: "10m"
+    default: "5m"
     type: duration
   - name: failover
     required: false
     description: |
-      Property to enabled failover configuration. Needs sentinelMasterName to be set. Defaults to "false"
+      Property to enabled failover configuration. Needs sentinelMasterName to be set.
     example: "false"
+    default: "false"
     type: bool
   - name: sentinelMasterName
     required: false
diff --git a/secretstores/hashicorp/vault/metadata.yaml b/secretstores/hashicorp/vault/metadata.yaml
index 32f1858b..5253f9a3 100644
--- a/secretstores/hashicorp/vault/metadata.yaml
+++ b/secretstores/hashicorp/vault/metadata.yaml
@@ -12,9 +12,10 @@ metadata:
   - name: vaultAddr
     required: false
     description: |
-      The address of the Vault server. Defaults to "https://127.0.0.1:8200"
+      The address of the Vault server.
     example: "https://127.0.0.1:8200"
     type: string
+    default: "https://127.0.0.1:8200"
   - name: caPem
     required: false
     description: |
@@ -34,8 +35,9 @@ metadata:
     type: string
   - name: skipVerify
     required: false
-    description: Skip TLS verification. Defaults to false
+    description: Skip TLS verification.
     example: "true"
+    default: "false"
     type: string
   - name: tlsServerName
     required: false
@@ -55,8 +57,9 @@ metadata:
   - name: vaultKVPrefix
     required: false
     description: |
-      The prefix in vault. Defaults to "dapr"
+      The prefix in vault.
     example: "myprefix"
+    default: "dapr"
     type: string
   - name: vaultKVUsePrefix
     required: false
@@ -66,12 +69,14 @@ metadata:
   - name: enginePath
     required: false
     description: |
-      The engine path in vault. Defaults to "secret"
+      The engine path in vault.
     example: "kv"
     type: string
+    default: "secret"
   - name: vaultValueType
     required: false
     description: |
-      Vault value type. map means to parse the value into map[string]string, text means to use the value as a string. "map" sets the multipleKeyValuesPerSecret behavior. text makes Vault behave as a secret store with name/value semantics. Defaults to "map"
+      Vault value type. map means to parse the value into map[string]string, text means to use the value as a string. "map" sets the multipleKeyValuesPerSecret behavior. text makes Vault behave as a secret store with name/value semantics.
     example: "map"
+    default: "map"
     type: string
diff --git a/state/aws/dynamodb/dynamodb.go b/state/aws/dynamodb/dynamodb.go
index 81bf74e7..af620165 100644
--- a/state/aws/dynamodb/dynamodb.go
+++ b/state/aws/dynamodb/dynamodb.go
@@ -23,13 +23,17 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/aws/aws-sdk-go/service/dynamodb"
-	"github.com/aws/aws-sdk-go/service/dynamodb/dynamodbattribute"
+	"github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue"
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
+
+	awsCommon "github.com/dapr/components-contrib/common/aws"
+	awsCommonAuth "github.com/dapr/components-contrib/common/aws/auth"
+	"github.com/dapr/components-contrib/metadata"
+
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
 	jsoniterator "github.com/json-iterator/go"
 
-	awsAuth "github.com/dapr/components-contrib/common/authentication/aws"
 	"github.com/dapr/components-contrib/common/utils"
-	"github.com/dapr/components-contrib/metadata"
 	"github.com/dapr/components-contrib/state"
 	"github.com/dapr/kit/logger"
 	kitmd "github.com/dapr/kit/metadata"
@@ -40,11 +44,12 @@ import (
 type StateStore struct {
 	state.BulkStore
 
-	authProvider     awsAuth.Provider
 	logger           logger.Logger
 	table            string
 	ttlAttributeName string
 	partitionKey     string
+
+	dynamodbClient *dynamodb.Client
 }
 
 type dynamoDBMetadata struct {
@@ -61,13 +66,6 @@ type dynamoDBMetadata struct {
 	PartitionKey     string `json:"partitionKey"`
 }
 
-type putData struct {
-	ConditionExpression       *string
-	ExpressionAttributeValues map[string]*dynamodb.AttributeValue
-	Item                      map[string]*dynamodb.AttributeValue
-	TableName                 *string
-}
-
 const (
 	defaultPartitionKeyName = "key"
 	metadataPartitionKey    = "partitionKey"
@@ -89,24 +87,26 @@ func (d *StateStore) Init(ctx context.Context, metadata state.Metadata) error {
 	if err != nil {
 		return err
 	}
-	if d.authProvider == nil {
-		opts := awsAuth.Options{
-			Logger:       d.logger,
-			Properties:   metadata.Properties,
-			Region:       meta.Region,
-			Endpoint:     meta.Endpoint,
-			AccessKey:    meta.AccessKey,
-			SecretKey:    meta.SecretKey,
-			SessionToken: meta.SessionToken,
-		}
-		cfg := awsAuth.GetConfig(opts)
-		provider, err := awsAuth.NewProvider(ctx, opts, cfg)
-		if err != nil {
-			return err
-		}
-		d.authProvider = provider
+
+	configOpts := awsCommonAuth.Options{
+		Logger: d.logger,
+
+		Properties: metadata.Properties,
+
+		Region:       meta.Region,
+		Endpoint:     meta.Endpoint,
+		AccessKey:    meta.AccessKey, // TODO: Remove fields which should be gleaned from metadata.properties
+		SecretKey:    meta.SecretKey,
+		SessionToken: meta.SessionToken,
 	}
 
+	awsConfig, err := awsCommon.NewConfig(ctx, configOpts)
+	if err != nil {
+		return err
+	}
+
+	d.dynamodbClient = dynamodb.NewFromConfig(awsConfig)
+
 	d.table = meta.Table
 	d.ttlAttributeName = meta.TTLAttributeName
 	d.partitionKey = meta.PartitionKey
@@ -124,13 +124,13 @@ func (d *StateStore) validateTableAccess(ctx context.Context) error {
 	input := &dynamodb.GetItemInput{
 		ConsistentRead: ptr.Of(false),
 		TableName:      ptr.Of(d.table),
-		Key: map[string]*dynamodb.AttributeValue{
-			d.partitionKey: {
-				S: ptr.Of(utils.GetRandOrDefaultString("dapr-test-table")),
+		Key: map[string]types.AttributeValue{
+			d.partitionKey: &types.AttributeValueMemberS{
+				Value: utils.GetRandOrDefaultString("dapr-test-table"),
 			},
 		},
 	}
-	_, err := d.authProvider.DynamoDB().DynamoDB.GetItemWithContext(ctx, input)
+	_, err := d.dynamodbClient.GetItem(ctx, input)
 	return err
 }
 
@@ -156,13 +156,13 @@ func (d *StateStore) Get(ctx context.Context, req *state.GetRequest) (*state.Get
 	input := &dynamodb.GetItemInput{
 		ConsistentRead: ptr.Of(req.Options.Consistency == state.Strong),
 		TableName:      ptr.Of(d.table),
-		Key: map[string]*dynamodb.AttributeValue{
-			d.partitionKey: {
-				S: ptr.Of(req.Key),
+		Key: map[string]types.AttributeValue{
+			d.partitionKey: &types.AttributeValueMemberS{
+				Value: req.Key,
 			},
 		},
 	}
-	result, err := d.authProvider.DynamoDB().DynamoDB.GetItemWithContext(ctx, input)
+	result, err := d.dynamodbClient.GetItem(ctx, input)
 	if err != nil {
 		return nil, err
 	}
@@ -171,16 +171,16 @@ func (d *StateStore) Get(ctx context.Context, req *state.GetRequest) (*state.Get
 		return &state.GetResponse{}, nil
 	}
 
-	data, err := unmarshalValue(result.Item["value"])
-	if err != nil {
-		return nil, fmt.Errorf("dynamodb error: failed to unmarshal value for key %s: %w", req.Key, err)
+	var output string
+	if err = attributevalue.Unmarshal(result.Item["value"], &output); err != nil {
+		return nil, err
 	}
 
 	var metadata map[string]string
 	if d.ttlAttributeName != "" {
 		if val, ok := result.Item[d.ttlAttributeName]; ok {
 			var ttl int64
-			if err = dynamodbattribute.Unmarshal(val, &ttl); err != nil {
+			if err = attributevalue.Unmarshal(val, &ttl); err != nil {
 				return nil, err
 			}
 			if ttl <= time.Now().Unix() {
@@ -194,13 +194,13 @@ func (d *StateStore) Get(ctx context.Context, req *state.GetRequest) (*state.Get
 	}
 
 	resp := &state.GetResponse{
-		Data:     data,
+		Data:     []byte(output),
 		Metadata: metadata,
 	}
 
 	if result.Item["etag"] != nil {
 		var etag string
-		err = dynamodbattribute.Unmarshal(result.Item["etag"], &etag)
+		err = attributevalue.Unmarshal(result.Item["etag"], &etag)
 		if err != nil {
 			return nil, err
 		}
@@ -212,15 +212,33 @@ func (d *StateStore) Get(ctx context.Context, req *state.GetRequest) (*state.Get
 
 // Set saves a dynamoDB item.
 func (d *StateStore) Set(ctx context.Context, req *state.SetRequest) error {
-	pd, err := d.createPutData(req)
+	item, err := d.getItemFromReq(req)
 	if err != nil {
 		return err
 	}
 
-	_, err = d.authProvider.DynamoDB().DynamoDB.PutItemWithContext(ctx, pd.ToPutItemInput())
+	input := &dynamodb.PutItemInput{
+		Item:      item,
+		TableName: &d.table,
+	}
+
+	if req.HasETag() {
+		condExpr := "etag = :etag"
+		input.ConditionExpression = &condExpr
+		exprAttrValues := make(map[string]types.AttributeValue)
+		exprAttrValues[":etag"] = &types.AttributeValueMemberS{
+			Value: *req.ETag,
+		}
+		input.ExpressionAttributeValues = exprAttrValues
+	} else if req.Options.Concurrency == state.FirstWrite {
+		condExpr := "attribute_not_exists(etag)"
+		input.ConditionExpression = &condExpr
+	}
+	_, err = d.dynamodbClient.PutItem(ctx, input)
 	if err != nil && req.HasETag() {
-		switch cErr := err.(type) {
-		case *dynamodb.ConditionalCheckFailedException:
+		var cErr *types.ConditionalCheckFailedException
+		switch {
+		case errors.As(err, &cErr):
 			err = state.NewETagError(state.ETagMismatch, cErr)
 		}
 	}
@@ -231,9 +249,9 @@ func (d *StateStore) Set(ctx context.Context, req *state.SetRequest) error {
 // Delete performs a delete operation.
 func (d *StateStore) Delete(ctx context.Context, req *state.DeleteRequest) error {
 	input := &dynamodb.DeleteItemInput{
-		Key: map[string]*dynamodb.AttributeValue{
-			d.partitionKey: {
-				S: ptr.Of(req.Key),
+		Key: map[string]types.AttributeValue{
+			d.partitionKey: &types.AttributeValueMemberS{
+				Value: req.Key,
 			},
 		},
 		TableName: ptr.Of(d.table),
@@ -242,16 +260,17 @@ func (d *StateStore) Delete(ctx context.Context, req *state.DeleteRequest) error
 	if req.HasETag() {
 		condExpr := "etag = :etag"
 		input.ConditionExpression = &condExpr
-		exprAttrValues := make(map[string]*dynamodb.AttributeValue)
-		exprAttrValues[":etag"] = &dynamodb.AttributeValue{
-			S: req.ETag,
+		exprAttrValues := make(map[string]types.AttributeValue)
+		exprAttrValues[":etag"] = &types.AttributeValueMemberS{
+			Value: *req.ETag,
 		}
 		input.ExpressionAttributeValues = exprAttrValues
 	}
-	_, err := d.authProvider.DynamoDB().DynamoDB.DeleteItemWithContext(ctx, input)
+	_, err := d.dynamodbClient.DeleteItem(ctx, input)
 	if err != nil {
-		switch cErr := err.(type) {
-		case *dynamodb.ConditionalCheckFailedException:
+		var cErr *types.ConditionalCheckFailedException
+		switch {
+		case errors.As(err, &cErr):
 			err = state.NewETagError(state.ETagMismatch, cErr)
 		}
 	}
@@ -266,9 +285,6 @@ func (d *StateStore) GetComponentMetadata() (metadataInfo metadata.MetadataMap)
 }
 
 func (d *StateStore) Close() error {
-	if d.authProvider != nil {
-		return d.authProvider.Close()
-	}
 	return nil
 }
 
@@ -282,55 +298,9 @@ func (d *StateStore) getDynamoDBMetadata(meta state.Metadata) (*dynamoDBMetadata
 	return &m, err
 }
 
-// createPutData creates a DynamoDB put request data from a SetRequest.
-func (d *StateStore) createPutData(req *state.SetRequest) (putData, error) {
-	item, err := d.createItem(req)
-	if err != nil {
-		return putData{}, err
-	}
-
-	pd := putData{
-		Item:      item,
-		TableName: ptr.Of(d.table),
-	}
-
-	if req.HasETag() {
-		condExpr := "etag = :etag"
-		pd.ConditionExpression = &condExpr
-		exprAttrValues := make(map[string]*dynamodb.AttributeValue)
-		exprAttrValues[":etag"] = &dynamodb.AttributeValue{
-			S: req.ETag,
-		}
-		pd.ExpressionAttributeValues = exprAttrValues
-	} else if req.Options.Concurrency == state.FirstWrite {
-		condExpr := "attribute_not_exists(etag)"
-		pd.ConditionExpression = &condExpr
-	}
-
-	return pd, nil
-}
-
-func (d putData) ToPutItemInput() *dynamodb.PutItemInput {
-	return &dynamodb.PutItemInput{
-		ConditionExpression:       d.ConditionExpression,
-		ExpressionAttributeValues: d.ExpressionAttributeValues,
-		Item:                      d.Item,
-		TableName:                 d.TableName,
-	}
-}
-
-func (d putData) ToPut() *dynamodb.Put {
-	return &dynamodb.Put{
-		ConditionExpression:       d.ConditionExpression,
-		ExpressionAttributeValues: d.ExpressionAttributeValues,
-		Item:                      d.Item,
-		TableName:                 d.TableName,
-	}
-}
-
-// createItem creates a DynamoDB item from a SetRequest.
-func (d *StateStore) createItem(req *state.SetRequest) (map[string]*dynamodb.AttributeValue, error) {
-	value, err := marshalValue(req.Value)
+// getItemFromReq converts a dapr state.SetRequest into an dynamodb item
+func (d *StateStore) getItemFromReq(req *state.SetRequest) (map[string]types.AttributeValue, error) {
+	value, err := d.marshalToString(req.Value)
 	if err != nil {
 		return nil, fmt.Errorf("dynamodb error: failed to marshal value for key %s: %w", req.Key, err)
 	}
@@ -345,19 +315,21 @@ func (d *StateStore) createItem(req *state.SetRequest) (map[string]*dynamodb.Att
 		return nil, fmt.Errorf("dynamodb error: failed to generate etag: %w", err)
 	}
 
-	item := map[string]*dynamodb.AttributeValue{
-		d.partitionKey: {
-			S: ptr.Of(req.Key),
+	item := map[string]types.AttributeValue{
+		d.partitionKey: &types.AttributeValueMemberS{
+			Value: req.Key,
 		},
-		"value": value,
-		"etag": {
-			S: ptr.Of(strconv.FormatUint(newEtag, 16)),
+		"value": &types.AttributeValueMemberS{
+			Value: value,
+		},
+		"etag": &types.AttributeValueMemberS{
+			Value: strconv.FormatUint(newEtag, 16),
 		},
 	}
 
 	if ttl != nil {
-		item[d.ttlAttributeName] = &dynamodb.AttributeValue{
-			N: ptr.Of(strconv.FormatInt(*ttl, 10)),
+		item[d.ttlAttributeName] = &types.AttributeValueMemberN{
+			Value: strconv.FormatInt(*ttl, 10),
 		}
 	}
 
@@ -374,27 +346,12 @@ func getRand64() (uint64, error) {
 	return binary.LittleEndian.Uint64(randBuf), nil
 }
 
-func marshalValue(v interface{}) (*dynamodb.AttributeValue, error) {
-	if bt, ok := v.([]byte); ok {
-		return &dynamodb.AttributeValue{B: bt}, nil
+func (d *StateStore) marshalToString(v interface{}) (string, error) {
+	if buf, ok := v.([]byte); ok {
+		return string(buf), nil
 	}
 
-	str, err := jsoniterator.ConfigFastest.MarshalToString(v)
-	if err != nil {
-		return nil, err
-	}
-	return &dynamodb.AttributeValue{S: ptr.Of(str)}, nil
-}
-
-func unmarshalValue(value *dynamodb.AttributeValue) ([]byte, error) {
-	if value == nil {
-		return []byte(nil), nil
-	}
-
-	if value.B != nil {
-		return value.B, nil
-	}
-	return []byte(*value.S), nil
+	return jsoniterator.ConfigFastest.MarshalToString(v)
 }
 
 // Parse and process ttlInSeconds.
@@ -430,7 +387,7 @@ func (d *StateStore) Multi(ctx context.Context, request *state.TransactionalStat
 	}
 
 	twinput := &dynamodb.TransactWriteItemsInput{
-		TransactItems: make([]*dynamodb.TransactWriteItem, 0, opns),
+		TransactItems: make([]types.TransactWriteItem, 0, opns),
 	}
 
 	// Note: The following is a DynamoDB logic to avoid errors like following,
@@ -450,28 +407,38 @@ func (d *StateStore) Multi(ctx context.Context, request *state.TransactionalStat
 			continue
 		}
 
-		twi := &dynamodb.TransactWriteItem{}
+		twi := types.TransactWriteItem{}
 		switch req := o.(type) {
 		case state.SetRequest:
-			pd, err := d.createPutData(&req)
+			value, err := d.marshalToString(req.Value)
 			if err != nil {
 				return fmt.Errorf("dynamodb error: failed to marshal value for key %s: %w", req.Key, err)
 			}
-			twi.Put = pd.ToPut()
+			twi.Put = &types.Put{
+				TableName: ptr.Of(d.table),
+				Item: map[string]types.AttributeValue{
+					d.partitionKey: &types.AttributeValueMemberS{
+						Value: req.Key,
+					},
+					"value": &types.AttributeValueMemberS{
+						Value: value,
+					},
+				},
+			}
 
 		case state.DeleteRequest:
-			twi.Delete = &dynamodb.Delete{
+			twi.Delete = &types.Delete{
 				TableName: ptr.Of(d.table),
-				Key: map[string]*dynamodb.AttributeValue{
-					d.partitionKey: {
-						S: ptr.Of(req.Key),
+				Key: map[string]types.AttributeValue{
+					d.partitionKey: &types.AttributeValueMemberS{
+						Value: req.Key,
 					},
 				},
 			}
 		}
 		twinput.TransactItems = append(twinput.TransactItems, twi)
 	}
-	_, err := d.authProvider.DynamoDB().DynamoDB.TransactWriteItemsWithContext(ctx, twinput)
+	_, err := d.dynamodbClient.TransactWriteItems(ctx, twinput)
 
 	return err
 }
diff --git a/state/azure/tablestorage/metadata.yaml b/state/azure/tablestorage/metadata.yaml
index 0b08034f..5210c4f1 100644
--- a/state/azure/tablestorage/metadata.yaml
+++ b/state/azure/tablestorage/metadata.yaml
@@ -34,16 +34,16 @@ metadata:
     type: string
     example: '"table"'
   - name: cosmosDbMode
-    description: "If enabled, connects to Cosmos DB Table API instead of Azure Tables (Storage Accounts). Defaults to `false`."
+    description: "If enabled, connects to Cosmos DB Table API instead of Azure Tables (Storage Accounts)."
     example: '"false"'
     type: bool
-    default: 'false'
+    default: '"false"'
   - name: serviceURL
     description: "The full storage service endpoint URL. Useful for Azure environments other than public cloud."
     example: '"https://mystorageaccount.table.core.windows.net/"'
     type: string
   - name: skipCreateTable
-    description: "Skips the check for and, if necessary, creation of the specified storage table. This is useful when using active directory authentication with minimal privileges. Defaults to `false`."
+    description: "Skips the check for and, if necessary, creation of the specified storage table. This is useful when using active directory authentication with minimal privileges."
     example: '"true"'
     type: bool
-    default: 'false'
\ No newline at end of file
+    default: '"false"'
\ No newline at end of file


Test patch:
diff --git a/common/aws/auth/auth_static_test.go b/common/aws/auth/auth_static_test.go
new file mode 100644
index 00000000..8832b06d
--- /dev/null
+++ b/common/aws/auth/auth_static_test.go
@@ -0,0 +1,1 @@
+package auth
diff --git a/common/component/kafka/metadata_test.go b/common/component/kafka/metadata_test.go
index 141b6949..bdba431a 100644
--- a/common/component/kafka/metadata_test.go
+++ b/common/component/kafka/metadata_test.go
@@ -16,6 +16,7 @@ package kafka
 import (
 	"fmt"
 	"net/url"
+	"regexp"
 	"strconv"
 	"testing"
 	"time"
@@ -513,7 +514,11 @@ func TestGetEventMetadata(t *testing.T) {
 		m := sarama.ConsumerMessage{
 			Headers: nil, Timestamp: ts, Key: []byte("MyKey"), Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
 		}
-		act := GetEventMetadata(&m, false)
+		k := Kafka{
+			escapeHeaders: false,
+			logger:        logger.NewLogger("kafka_test"),
+		}
+		act := GetEventMetadata(&m, &k)
 		require.Len(t, act, 5)
 		require.Equal(t, strconv.FormatInt(ts.UnixMilli(), 10), act["__timestamp"])
 		require.Equal(t, "MyKey", act["__key"])
@@ -530,7 +535,11 @@ func TestGetEventMetadata(t *testing.T) {
 		m := sarama.ConsumerMessage{
 			Headers: headers, Timestamp: ts, Key: []byte("MyKey"), Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
 		}
-		act := GetEventMetadata(&m, false)
+		k := Kafka{
+			escapeHeaders: false,
+			logger:        logger.NewLogger("kafka_test"),
+		}
+		act := GetEventMetadata(&m, &k)
 		require.Len(t, act, 7)
 		require.Equal(t, strconv.FormatInt(ts.UnixMilli(), 10), act["__timestamp"])
 		require.Equal(t, "MyKey", act["__key"])
@@ -545,7 +554,11 @@ func TestGetEventMetadata(t *testing.T) {
 		m := sarama.ConsumerMessage{
 			Headers: nil, Timestamp: ts, Key: nil, Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
 		}
-		act := GetEventMetadata(&m, false)
+		k := Kafka{
+			escapeHeaders: false,
+			logger:        logger.NewLogger("kafka_test"),
+		}
+		act := GetEventMetadata(&m, &k)
 		require.Len(t, act, 4)
 		require.Equal(t, strconv.FormatInt(ts.UnixMilli(), 10), act["__timestamp"])
 		require.Equal(t, "0", act["__partition"])
@@ -554,7 +567,11 @@ func TestGetEventMetadata(t *testing.T) {
 	})
 
 	t.Run("null message", func(t *testing.T) {
-		act := GetEventMetadata(nil, false)
+		k := Kafka{
+			escapeHeaders: false,
+			logger:        logger.NewLogger("kafka_test"),
+		}
+		act := GetEventMetadata(nil, &k)
 		require.Nil(t, act)
 	})
 
@@ -565,7 +582,11 @@ func TestGetEventMetadata(t *testing.T) {
 		m := sarama.ConsumerMessage{
 			Headers: nil, Timestamp: ts, Key: []byte(keyValue), Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
 		}
-		act := GetEventMetadata(&m, true)
+		k := Kafka{
+			escapeHeaders: true,
+			logger:        logger.NewLogger("kafka_test"),
+		}
+		act := GetEventMetadata(&m, &k)
 		require.Equal(t, escapedKeyValue, act[keyMetadataKey])
 	})
 
@@ -575,7 +596,11 @@ func TestGetEventMetadata(t *testing.T) {
 		m := sarama.ConsumerMessage{
 			Headers: nil, Timestamp: ts, Key: []byte(keyValue), Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
 		}
-		act := GetEventMetadata(&m, false)
+		k := Kafka{
+			escapeHeaders: false,
+			logger:        logger.NewLogger("kafka_test"),
+		}
+		act := GetEventMetadata(&m, &k)
 		require.Equal(t, keyValue, act[keyMetadataKey])
 	})
 
@@ -590,7 +615,11 @@ func TestGetEventMetadata(t *testing.T) {
 		m := sarama.ConsumerMessage{
 			Headers: headers, Timestamp: ts, Key: []byte("MyKey"), Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
 		}
-		act := GetEventMetadata(&m, true)
+		k := Kafka{
+			escapeHeaders: true,
+			logger:        logger.NewLogger("kafka_test"),
+		}
+		act := GetEventMetadata(&m, &k)
 		require.Len(t, act, 6)
 		require.Equal(t, escapedHeaderValue, act[headerKey])
 	})
@@ -605,8 +634,50 @@ func TestGetEventMetadata(t *testing.T) {
 		m := sarama.ConsumerMessage{
 			Headers: headers, Timestamp: ts, Key: []byte("MyKey"), Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
 		}
-		act := GetEventMetadata(&m, false)
+		k := Kafka{
+			escapeHeaders: false,
+			logger:        logger.NewLogger("kafka_test"),
+		}
+		act := GetEventMetadata(&m, &k)
 		require.Len(t, act, 6)
 		require.Equal(t, headerValue, act[headerKey])
 	})
+
+	t.Run("header with excluded key gets removed from metadata", func(t *testing.T) {
+		headers := []*sarama.RecordHeader{
+			{Key: []byte("valueSchemaType"), Value: []byte("Avro")},
+			{Key: []byte("rawPayload"), Value: []byte("true")},
+		}
+		k := Kafka{
+			escapeHeaders:          false,
+			excludeHeaderMetaRegex: regexp.MustCompile("^valueSchemaType$"),
+			logger:                 logger.NewLogger("kafka_test"),
+		}
+		m := sarama.ConsumerMessage{
+			Headers: headers, Timestamp: ts, Key: []byte("MyKey"), Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
+		}
+		act := GetEventMetadata(&m, &k)
+		require.Len(t, act, 6)
+		require.NotContains(t, act, "valueSchemaType")
+		require.Contains(t, act, "rawPayload")
+	})
+
+	t.Run("header with excluded multiple keys gets removed from metadata", func(t *testing.T) {
+		headers := []*sarama.RecordHeader{
+			{Key: []byte("valueSchemaType"), Value: []byte("Avro")},
+			{Key: []byte("rawPayload"), Value: []byte("true")},
+		}
+		k := Kafka{
+			escapeHeaders:          false,
+			excludeHeaderMetaRegex: regexp.MustCompile("^valueSchemaType|rawPayload$"),
+			logger:                 logger.NewLogger("kafka_test"),
+		}
+		m := sarama.ConsumerMessage{
+			Headers: headers, Timestamp: ts, Key: []byte("MyKey"), Value: []byte("MyValue"), Partition: 0, Offset: 123, Topic: "TestTopic",
+		}
+		act := GetEventMetadata(&m, &k)
+		require.Len(t, act, 5)
+		require.NotContains(t, act, "valueSchemaType")
+		require.NotContains(t, act, "rawPayload")
+	})
 }
diff --git a/common/component/kafka/producer_test.go b/common/component/kafka/producer_test.go
index 31510385..1bfe5962 100644
--- a/common/component/kafka/producer_test.go
+++ b/common/component/kafka/producer_test.go
@@ -1,6 +1,7 @@
 package kafka
 
 import (
+	"regexp"
 	"testing"
 
 	"github.com/IBM/sarama"
@@ -94,6 +95,30 @@ func TestPublish(t *testing.T) {
 		// assert
 		require.NoError(t, err)
 	})
+
+	t.Run("produce message with excluded headers", func(t *testing.T) {
+		// arrange
+		metadataIn := map[string]string{
+			"a":     "a",
+			"b":     "bVal",
+			"c":     "cVal",
+			"__key": "key",
+		}
+
+		metadataOut := map[string]string{
+			"a":     "a",
+			"__key": "key",
+		}
+		messageAsserter := createMessageAsserter(t, sarama.StringEncoder("key"), metadataOut)
+		k := arrangeKafkaWithAssertions(t, messageAsserter)
+		k.excludeHeaderMetaRegex = regexp.MustCompile("^b|c$")
+
+		// act
+		err := k.Publish(ctx, "a", []byte("a"), metadataIn)
+
+		// assert
+		require.NoError(t, err)
+	})
 }
 
 func TestBulkPublish(t *testing.T) {
@@ -188,4 +213,34 @@ func TestBulkPublish(t *testing.T) {
 		// assert
 		require.NoError(t, err)
 	})
+
+	t.Run("bulk produce messages with excluded headers", func(t *testing.T) {
+		// arrange
+		entries := []pubsub.BulkMessageEntry{
+			{
+				EntryId:     "0",
+				Event:       []byte("a"),
+				ContentType: "a",
+				Metadata:    map[string]string{"__key": "key", "a": "a", "b": "b", "c": "c"},
+			},
+			{
+				EntryId:     "0",
+				Event:       []byte("a"),
+				ContentType: "a",
+				Metadata:    map[string]string{"c": "c"},
+			},
+		}
+		messageAsserters := []saramamocks.MessageChecker{
+			createMessageAsserter(t, sarama.StringEncoder("key"), map[string]string{"__key": "key", "common": "common", "a": "a"}),
+			createMessageAsserter(t, nil, map[string]string{"common": "common"}),
+		}
+		k := arrangeKafkaWithAssertions(t, messageAsserters...)
+		k.excludeHeaderMetaRegex = regexp.MustCompile("^b|c$")
+
+		// act
+		_, err := k.BulkPublish(ctx, "a", entries, metadata)
+
+		// assert
+		require.NoError(t, err)
+	})
 }
diff --git a/pubsub/aws/snssqs/snssqs_test.go b/pubsub/aws/snssqs/snssqs_test.go
index 82f58bcb..20691f30 100644
--- a/pubsub/aws/snssqs/snssqs_test.go
+++ b/pubsub/aws/snssqs/snssqs_test.go
@@ -75,10 +75,10 @@ func Test_getSnsSqsMetadata_AllConfiguration(t *testing.T) {
 	r.Equal("t", md.SessionToken)
 	r.Equal("r", md.Region)
 	r.Equal("q", md.SqsDeadLettersQueueName)
-	r.Equal(int64(2), md.MessageVisibilityTimeout)
+	r.Equal(int32(2), md.MessageVisibilityTimeout)
 	r.Equal(int64(3), md.MessageRetryLimit)
-	r.Equal(int64(4), md.MessageWaitTimeSeconds)
-	r.Equal(int64(5), md.MessageMaxNumber)
+	r.Equal(int32(4), md.MessageWaitTimeSeconds)
+	r.Equal(int32(5), md.MessageMaxNumber)
 	r.Equal(int64(6), md.MessageReceiveLimit)
 }
 
@@ -108,10 +108,10 @@ func Test_getSnsSqsMetadata_defaults(t *testing.T) {
 	r.Equal("r", md.Region)
 	r.Equal(pubsub.Parallel, md.ConcurrencyMode)
 	r.Equal(0, md.ConcurrencyLimit)
-	r.Equal(int64(10), md.MessageVisibilityTimeout)
+	r.Equal(int32(10), md.MessageVisibilityTimeout)
 	r.Equal(int64(10), md.MessageRetryLimit)
-	r.Equal(int64(2), md.MessageWaitTimeSeconds)
-	r.Equal(int64(10), md.MessageMaxNumber)
+	r.Equal(int32(2), md.MessageWaitTimeSeconds)
+	r.Equal(int32(10), md.MessageMaxNumber)
 	r.False(md.DisableEntityManagement)
 	r.EqualValues(float64(5), md.AssetsManagementTimeoutSeconds)
 	r.False(md.DisableDeleteOnRetryLimit)
@@ -140,10 +140,10 @@ func Test_getSnsSqsMetadata_legacyaliases(t *testing.T) {
 	r.Equal("acctId", md.AccessKey)
 	r.Equal("secret", md.SecretKey)
 	r.Equal("region", md.Region)
-	r.Equal(int64(10), md.MessageVisibilityTimeout)
+	r.Equal(int32(10), md.MessageVisibilityTimeout)
 	r.Equal(int64(10), md.MessageRetryLimit)
-	r.Equal(int64(2), md.MessageWaitTimeSeconds)
-	r.Equal(int64(10), md.MessageMaxNumber)
+	r.Equal(int32(2), md.MessageWaitTimeSeconds)
+	r.Equal(int32(10), md.MessageMaxNumber)
 }
 
 func testMetadataParsingShouldFail(t *testing.T, metadata pubsub.Metadata, l logger.Logger) {
diff --git a/state/aws/dynamodb/dynamodb_test.go b/state/aws/dynamodb/dynamodb_test.go
index 23622b58..abd24480 100644
--- a/state/aws/dynamodb/dynamodb_test.go
+++ b/state/aws/dynamodb/dynamodb_test.go
@@ -1,3 +1,6 @@
+// TODO: Migrate mocks
+//go:build legacy
+
 /*
 Copyright 2021 The Dapr Authors
 Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tests/certification/go.mod b/tests/certification/go.mod
index 54a8abec..cfcdb9bf 100644
--- a/tests/certification/go.mod
+++ b/tests/certification/go.mod
@@ -1,8 +1,6 @@
 module github.com/dapr/components-contrib/tests/certification
 
-go 1.24.2
-
-toolchain go1.24.3
+go 1.24.4
 
 require (
 	cloud.google.com/go/pubsub v1.49.0
@@ -86,21 +84,33 @@ require (
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/aws/aws-msk-iam-sasl-signer-go v1.0.1-0.20241125194140-078c08b8574a // indirect
-	github.com/aws/aws-sdk-go-v2 v1.32.4 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.28.2 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.43 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.36.5 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.29.17 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.70 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.3 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.3.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.24.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.32.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.83 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.34.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.34.0 // indirect
 	github.com/aws/rolesanywhere-credential-helper v1.0.4 // indirect
-	github.com/aws/smithy-go v1.22.0 // indirect
+	github.com/aws/smithy-go v1.22.4 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.4.0 // indirect
@@ -187,9 +197,10 @@ require (
 	github.com/hashicorp/consul/api v1.25.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
@@ -229,6 +240,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/microsoft/go-mssqldb v1.6.0 // indirect
 	github.com/miekg/dns v1.1.57 // indirect
+	github.com/mikeee/aws_credential_helper v0.0.1-alpha.2 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4 // indirect
diff --git a/tests/certification/go.sum b/tests/certification/go.sum
index d5eb7375..90dc594b 100644
--- a/tests/certification/go.sum
+++ b/tests/certification/go.sum
@@ -207,45 +207,69 @@ github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk
 github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
 github.com/aws/aws-sdk-go-v2 v1.9.2/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
-github.com/aws/aws-sdk-go-v2 v1.32.4 h1:S13INUiTxgrPueTmrm5DZ+MiAo99zYzHEFh1UNkOxNE=
-github.com/aws/aws-sdk-go-v2 v1.32.4/go.mod h1:2SK5n0a2karNTv5tbP1SjsX0uhttou00v/HpXKM1ZUo=
+github.com/aws/aws-sdk-go-v2 v1.36.5 h1:0OF9RiEMEdDdZEMqF9MRjevyxAQcf6gY+E7vwBILFj0=
+github.com/aws/aws-sdk-go-v2 v1.36.5/go.mod h1:EYrzvCCN9CMUTa5+6lf6MM4tq3Zjp8UhSGR/cBsjai0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
 github.com/aws/aws-sdk-go-v2/config v1.8.3/go.mod h1:4AEiLtAb8kLs7vgw2ZV3p2VZ1+hBavOc84hqxVNpCyw=
-github.com/aws/aws-sdk-go-v2/config v1.28.2 h1:FLvWA97elBiSPdIol4CXfIAY1wlq3KzoSgkMuZSuSe8=
-github.com/aws/aws-sdk-go-v2/config v1.28.2/go.mod h1:hNmQsKfUqpKz2yfnZUB60GCemPmeqAalVTui0gOxjAE=
+github.com/aws/aws-sdk-go-v2/config v1.29.17 h1:jSuiQ5jEe4SAMH6lLRMY9OVC+TqJLP5655pBGjmnjr0=
+github.com/aws/aws-sdk-go-v2/config v1.29.17/go.mod h1:9P4wwACpbeXs9Pm9w1QTh6BwWwJjwYvJ1iCt5QbCXh8=
 github.com/aws/aws-sdk-go-v2/credentials v1.4.3/go.mod h1:FNNC6nQZQUuyhq5aE5c7ata8o9e4ECGmS4lAXC7o1mQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.43 h1:SEGdVOOE1Wyr2XFKQopQ5GYjym3nYHcphesdt78rNkY=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.43/go.mod h1:3aiza5kSyAE4eujSanOkSkAmX/RnVqslM+GRQ/Xvv4c=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.70 h1:ONnH5CM16RTXRkS8Z1qg7/s2eDOhHhaXVd72mmyv4/0=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.70/go.mod h1:M+lWhhmomVGgtuPOhO85u4pEa3SmssPTdcYpP/5J/xc=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.3 h1:xQYRnbQ+ypDMCLiFlLw5cF7Xd6K+oaL7jco2zwIMqTs=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.3/go.mod h1:X7RC8FFkx0bjNJRBddd3xdoDaDmNLSxICFdIdJ7asqw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.6.0/go.mod h1:gqlclDEZp4aqJOancXK6TN24aKhT0W0Ae9MHk3wzTMM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19 h1:woXadbf0c7enQ2UGCi8gW/WuKmE0xIzxBF/eD94jMKQ=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19/go.mod h1:zminj5ucw7w0r65bP6nhyOd3xL6veAUMc3ElGMoLVb4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 h1:KAXP9JSHO1vKGCr5f4O6WmlVKLFFXgWYAGoJosorxzU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32/go.mod h1:h4Sg6FQdexC1yYG9RDnOvLbW1a/P986++/Y/a+GyEM8=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.3.10 h1:z6fAXB4HSuYjrE/P8RU3NdCaN+EPaeq/+80aisCjuF8=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.3.10/go.mod h1:PoPjOi7j+/DtKIGC58HRfcdWKBPYYXwdKnRG+po+hzo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 h1:A2w6m6Tmr+BNXjDsr7M90zkWjsu4JXHwrzPg235STs4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23/go.mod h1:35EVp9wyeANdujZruvHiQUAo9E3vbhnIO1mTCAxMlY0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 h1:pgYW9FCabt2M25MoHYCfMrVY2ghiiBKYWUVXfwZs+sU=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23/go.mod h1:c48kLgzO19wAu3CPkDWC28JbaJ+hfQlsdl7I2+oqIbk=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.83 h1:08otkOELsIi0toRRGMytlJhOctcN8xfKfKFR2NXz3kE=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.83/go.mod h1:dGsGb2wI8JDWeMAhjVPP+z+dqvYjL6k6o+EujcRNk5c=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36 h1:SsytQyTMHMDPspp+spo7XwXTP44aJZZAC7fBV2C5+5s=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36/go.mod h1:Q1lnJArKRXkenyog6+Y+zr7WDpk4e6XlR6gs20bbeNo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36 h1:i2vNHQiXUvKhs3quBR6aqlgJaiaexz/aNvdCktW/kAM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36/go.mod h1:UdyGa7Q91id/sdyHPwth+043HhmP6yP9MBHgbZM0xo8=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.2.4/go.mod h1:ZcBrrI3zBKlhGFNYWvju0I3TR93I7YIgAfy82Fh4lcQ=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 h1:GMYy2EOWfzdP3wfVAGXBNKY5vK4K8vMET4sYOYltmqs=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36/go.mod h1:gDhdAV6wL3PmPqBhiPbnlS447GoWs8HTTOYef9/9Inw=
 github.com/aws/aws-sdk-go-v2/service/appconfig v1.4.2/go.mod h1:FZ3HkCe+b10uFZZkFdvf98LHW21k49W8o8J366lqVKY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0 h1:TToQNkvGguu209puTojY/ozlqy2d/SFNcoLIqTFi42g=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0/go.mod h1:0jp+ltwkf+SwG2fm/PKo8t4y8pJSgOCO4D8Lz3k0aHQ=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.4 h1:Rv6o9v2AfdEIKoAa7pQpJ5ch9ji2HevFUvGY6ufawlI=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.4/go.mod h1:mWB0GE1bqcVSvpW7OtFA0sKuHk52+IqtnsYU2jUfYAs=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.6 h1:QHaS/SHXfyNycuu4GiWb+AfW5T3bput6X5E3Ai/Q31M=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.6/go.mod h1:He/RikglWUczbkV+fkdpcV/3GdL/rTRNVy7VaUiezMo=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 h1:CXV68E2dNqhuynZJPB80bhPQwAKqBWVer887figW6Jc=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4/go.mod h1:/xFi9KtvBXP97ppCz1TAEvU1Uf66qvid89rbem3wCzQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 h1:nAP2GYbfh8dd2zGZqFRSMlq+/F6cMPBUuCsGAMkN074=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4/go.mod h1:LT10DsiGjLWh4GbjInf9LQejkYEhBgBCjLG5+lvk4EE=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.17 h1:x187MqiHwBGjMGAed8Y8K1VGuCtFvQvXb24r+bwmSdo=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.17/go.mod h1:mC9qMbA6e1pwEq6X3zDGtZRXMG2YaElJkbJlMVHLs5I=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.3.2/go.mod h1:72HRZDLMtmVQiLG2tLfQcaWLCssELvGl+Zf2WVxMmR8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 h1:tHxQi/XHPK0ctd/wdOw0t7Xrc2OxcRCnVzv8lwWPu0c=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4/go.mod h1:4GQbF1vJzG60poZqWatZlhP31y8PGCCVTvIGPdaaYJ0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17 h1:t0E6FzREdtCsiLIoLCWsYliNsRBgyGD/MCK571qk4MI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17/go.mod h1:ygpklyoaypuyDvOM5ujWGrYWpAK3h7ugnmKCU/76Ys4=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 h1:qcLWgdhq45sDM9na4cvXax9dyLitn8EYBRl8Ak4XtG4=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17/go.mod h1:M+jkjBFZ2J6DJrjMv2+vkBbuht6kxJYtJiwoVgX4p4U=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0 h1:5Y75q0RPQoAbieyOuGLhjV9P3txvYgXv2lg0UwJOfmE=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0/go.mod h1:kUklwasNoCn5YpyAqC/97r6dzTA1SRKJfKq16SXeoDU=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.7 h1:OBuZE9Wt8h2imuRktu+WfjiTGrnYdCIJg8IX92aalHE=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.7/go.mod h1:4WYoZAhHt+dWYpoOQUgkUKfuQbE6Gg/hW4oXE0pKS9U=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 h1:80dpSqWMwx2dAm30Ib7J6ucz1ZHfiv5OCRwN/EnCOXQ=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8/go.mod h1:IzNt/udsXlETCdvBOL0nmyMe2t9cGmXmZgsdoZGYYhI=
 github.com/aws/aws-sdk-go-v2/service/sso v1.4.2/go.mod h1:NBvT9R1MEF+Ud6ApJKM0G+IkPchKS7p7c2YPKwHmBOk=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.4 h1:BqE3NRG6bsODh++VMKMsDmFuJTHrdD4rJZqHjDeF6XI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.4/go.mod h1:wrMCEwjFPms+V86TCQQeOxQF/If4vT44FGIOFiMC2ck=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4 h1:zcx9LiGWZ6i6pjdcoE9oXAB6mUdeyC36Ia/QEiIvYdg=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4/go.mod h1:Tp/ly1cTjRLGBBmNccFumbZ8oqpZlpdhFf80SrRh4is=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 h1:AIRJ3lfb2w/1/8wOOSqYb9fUKGwQbtysJ2H1MofRUPg=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.5/go.mod h1:b7SiVprpU+iGazDUqvRSLf5XmCdn+JtT1on7uNL6Ipc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 h1:BpOxT3yhLwSJ77qIY3DoHAQjZsc4HEGfMCE4NGy3uFg=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3/go.mod h1:vq/GQR1gOFLquZMSrxUK/cpvKCNVYibNyJ1m7JrU88E=
 github.com/aws/aws-sdk-go-v2/service/sts v1.7.2/go.mod h1:8EzeIqfWt2wWT4rJVu3f21TfrhJ8AEMzVybRNSb/b4g=
-github.com/aws/aws-sdk-go-v2/service/sts v1.32.4 h1:yDxvkz3/uOKfxnv8YhzOi9m+2OGIxF+on3KOISbK5IU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.32.4/go.mod h1:9XEUty5v5UAsMiFOBJrNibZgwCeOma73jgGwwhgffa8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.34.0 h1:NFOJ/NXEGV4Rq//71Hs1jC/NvPs1ezajK+yQmkwnPV0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.34.0/go.mod h1:7ph2tGpfQvwzgistp2+zga9f+bCjlQJPkPUmMgDSD7w=
 github.com/aws/rolesanywhere-credential-helper v1.0.4 h1:kHIVVdyQQiFZoKBP+zywBdFilGCS8It+UvW5LolKbW8=
 github.com/aws/rolesanywhere-credential-helper v1.0.4/go.mod h1:QVGNxlDlYhjR0/ZUee7uGl0hNChWidNpe2+GD87Buqk=
 github.com/aws/smithy-go v1.8.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
-github.com/aws/smithy-go v1.22.0 h1:uunKnWlcoL3zO7q+gG2Pk53joueEOsnNB28QdMsmiMM=
-github.com/aws/smithy-go v1.22.0/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
+github.com/aws/smithy-go v1.22.4 h1:uqXzVZNuNexwc/xrh6Tb56u89WDlJY6HS+KC0S4QSjw=
+github.com/aws/smithy-go v1.22.4/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
@@ -802,8 +826,8 @@ github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9
 github.com/hashicorp/go-hclog v0.8.0/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
-github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
@@ -819,6 +843,8 @@ github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn
 github.com/hashicorp/go-plugin v1.4.3/go.mod h1:5fGEH17QVwTTcR0zV7yhDPLLmFX9YSZ38b18Udy6vYQ=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
 github.com/hashicorp/go-retryablehttp v0.5.4/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
+github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
+github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-rootcerts v1.0.1/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
@@ -1036,6 +1062,8 @@ github.com/miekg/dns v1.1.27/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
 github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
 github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
+github.com/mikeee/aws_credential_helper v0.0.1-alpha.2 h1:qhP1AlQCklni6kNbvGVI5lAicAVef4cGP1JVMaWUDqc=
+github.com/mikeee/aws_credential_helper v0.0.1-alpha.2/go.mod h1:ql8URJDxt5h47BSezC1QUi3QWRn/FjVWn858+b1h+xU=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
diff --git a/tests/e2e/pubsub/jetstream/go.mod b/tests/e2e/pubsub/jetstream/go.mod
index 8429fd94..028deace 100644
--- a/tests/e2e/pubsub/jetstream/go.mod
+++ b/tests/e2e/pubsub/jetstream/go.mod
@@ -1,6 +1,6 @@
 module github.com/dapr/components-contrib/tests/e2e/pubsub/jetstream
 
-go 1.24.1
+go 1.24.4
 
 require (
 	github.com/dapr/components-contrib v1.10.6-0.20230403162214-9ee9d56cb7ea