From 156c888e2de3ebe04b68d56fa8104fe07b2585af Mon Sep 17 00:00:00 2001
From: Josh Cullum <joshua.cullum@gmail.com>
Date: Mon, 1 Jun 2026 09:06:18 +0100
Subject: [PATCH] :bug: Add STS dependency for IRSA/web identity token S3 auth
 (#9928)

The S3 storage backend uses DefaultCredentialsProvider which includes
  WebIdentityTokenFileCredentialsProvider in its chain. However, that
  provider requires software.amazon.awssdk/sts on the classpath to call
  AssumeRoleWithWebIdentity. Without it, the provider silently fails and
  credentials cannot be resolved when using IRSA on EKS.

  Closes #9927

  Signed-off-by: Joshua C <joshua.cullum@gmail.com>

Co-authored-by: Joshua C <joshua.c@data-edge.co.uk>
Co-authored-by: Andrey Antukh <niwi@niwi.nz>
---
 backend/deps.edn | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/backend/deps.edn b/backend/deps.edn
index d53cf9a6c2..1025a0760b 100644
--- a/backend/deps.edn
+++ b/backend/deps.edn
@@ -67,7 +67,8 @@
 
   ;; Pretty Print specs
   pretty-spec/pretty-spec {:mvn/version "0.1.4"}
-  software.amazon.awssdk/s3 {:mvn/version "2.44.4"}}
+  software.amazon.awssdk/s3 {:mvn/version "2.44.4"}
+  software.amazon.awssdk/sts {:mvn/version "2.44.4"}}
 
  :paths ["src" "resources" "target/classes"]
  :aliases