Hi all, I'd like to gather feedback on the Management API change in #5664 [1] before it lands.
The PR adds an optional storageName to SigV4AuthenticationParameters. It references an AWS key pair already configured on the server via polaris.storage.aws.<name>.access-key and polaris.storage.aws.<name>.secret-key, following the same naming convention as RESOLVE_CREDENTIALS_BY_STORAGE_NAME. The catalog stores only the storageName reference. The access andsecret keys are never passed through the API or persisted in thesecrets manager. When storageName is set, roleArn is not required. The server signsrequests directly with the configured keys, without going through STS. Setting both storageName and roleArn is rejected for now. I'veintentionally left that combination out of the spec so it can latersupport using the configured keys as base credentials for assumingthe roleArn. The feature flag is checked both at catalog creation and atcredential vending time. Does this approach sound right? Feedback on the API shape and the validation behaviour would be especially helpful. Thanks, Prithvi [1] https://github.com/apache/polaris/pull/5664
