[MOVED] feat(aws): Add KMS key inspection

[nevzheng]

Moved to Gravitino Enterprise: datastrato/gravitino-enterprise#901. Apache issue #12131 is now limited to the provider-neutral API/SPI and named-source routing.

What changes were proposed in this pull request?

Add an AWS KMS provider using the official AWS SDK:

• inspect keys with DescribeKey;
• use the default AWS credential chain;
• require a region and support an optional endpoint override;
• normalize missing, enabled, and ENCRYPT_DECRYPT capabilities; and
• register the provider through ServiceLoader.

Why are the changes needed?

AWS key identifiers and state must be validated by AWS while presenting the same normalized contract used by other KMS providers.

This work is now tracked in datastrato/gravitino-enterprise#901. The Apache OSS foundation remains #12132 and #12133.

Does this PR introduce any user-facing change?

Yes. It adds the aws-kms source type and its configuration properties.

How was this patch tested?

• ./gradlew :bundles:aws:test -PskipITs

Migration

• Enterprise epic: datastrato/gravitino-enterprise#899
• Enterprise PR: datastrato/gravitino-enterprise#901
• OSS foundation: [EPIC] Add provider-neutral KMS interfaces #12131, [#12131] feat(kms): Define key inspection API #12132, and [#12131] feat(kms): Configure and route named sources #12133

[nevzheng]

Hi @roryqi and @lasdf1234 — please review this KMS API change (4/11). Previous: #12134. Next: #12136. Epic: #12131.

[github-actions]

Code Coverage Report

Overall Project	67.97% +0.07%	🟢
Files changed	75.09%	🟢

Module	Coverage
aliyun	1.72%	🔴
api	48.25% +0.43%	🟢
authorization-common	85.96%	🟢
aws	51.64% +9.61%	🟢
azure	2.47%	🔴
catalog-common	9.92%	🔴
catalog-fileset	79.74%	🟢
catalog-glue	66.91%	🟢
catalog-hive	79.4%	🟢
catalog-jdbc-common	45.7%	🟢
catalog-jdbc-doris	81.72%	🟢
catalog-jdbc-mysql	79.33%	🟢
catalog-jdbc-postgresql	83.39%	🟢
catalog-jdbc-starrocks	79.16%	🟢
catalog-kafka	77.01%	🟢
catalog-lakehouse-generic	59.18%	🟢
catalog-lakehouse-hudi	79.1%	🟢
catalog-lakehouse-iceberg	85.93%	🟢
catalog-lakehouse-paimon	84.23%	🟢
catalog-model	77.72%	🟢
cli	44.5%	🟢
client-java	78.27%	🟢
common	51.95%	🟢
core	82.67% -0.41%	🟢
filesystem-hadoop3	77.28%	🟢
flink	0.0%	🔴
flink-common	47.09%	🟢
flink-runtime	0.0%	🔴
gcp	14.12%	🔴
hadoop-auth	68.0%	🟢
hadoop-common	12.7%	🔴
hive-metastore-common	53.4%	🟢
iceberg-common	64.65%	🟢
iceberg-rest-server	74.91%	🟢
idp-basic	86.02%	🟢
integration-test-common	0.0%	🔴
jobs	66.17%	🟢
lance-common	20.67%	🔴
lance-rest-server	64.84%	🟢
lineage	53.02%	🟢
optimizer	83.24%	🟢
optimizer-api	21.95%	🔴
server	85.92%	🟢
server-common	76.12%	🟢
spark	28.57%	🔴
spark-common	46.01%	🟢
tencent	69.84%	🟢
transit	90.75%	🟢
trino-connector	40.29%	🟢

Files

Module	File	Coverage
api	KmsApi.java	100.0%	🟢
	KmsClient.java	100.0%	🟢
	KmsReference.java	100.0%	🟢
	KmsAuthenticationException.java	0.0%	🔴
	KmsClientFactory.java	0.0%	🔴
	KmsConfigurationException.java	0.0%	🔴
	KmsKeyProperties.java	0.0%	🔴
aws	AwsKmsClient.java	100.0%	🟢
	AwsKmsKeyProperties.java	100.0%	🟢
	AwsKmsClientFactory.java	93.33%	🟢
core	KmsConfig.java	100.0%	🟢
	KmsClientRegistry.java	98.88%	🟢
	GravitinoEnv.java	20.93%	🔴
transit	OpenBaoTransitKmsKeyProperties.java	100.0%	🟢
	TransitKeyData.java	100.0%	🟢
	TransitReadKeyResponse.java	100.0%	🟢
	VaultTransitKmsKeyProperties.java	100.0%	🟢
	OpenBaoTransitKmsClient.java	97.3%	🟢
	OpenBaoTransitKmsClientFactory.java	91.23%	🟢
	VaultTransitKmsClientFactory.java	91.23%	🟢
	TransitApiClient.java	90.22%	🟢
	TransitReadKeyRequest.java	83.33%	🟢
	VaultTransitKmsClient.java	82.35%	🟢
	FileTokenSupplier.java	81.48%	🟢

[nevzheng]

Moved to datastrato/gravitino-enterprise#901 under enterprise epic #899. Apache OSS scope remains #12132 and #12133 under #12131.