cloudwatch: Replicate SDK behaviour for WebIdentityRole (#21594)

* Replicate SDK behaviour for WebIdentityRole

Fix #20473

* Use WebIdentityRole in s3 uploader as well

* Use consistent casing

* use WebIdentityRole to assume another role

Co-authored-by: eV <ev@7pr.xyz>

pkg/components/imguploader/s3uploader.go

@@ -10,10 +10,12 @@ import (
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"
 	"github.com/aws/aws-sdk-go/aws/credentials/endpointcreds"
+	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
 	"github.com/aws/aws-sdk-go/aws/defaults"
 	"github.com/aws/aws-sdk-go/aws/ec2metadata"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/s3/s3manager"
+	"github.com/aws/aws-sdk-go/service/sts"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/util"
 )
@@ -57,6 +59,7 @@ func (u *S3Uploader) Upload(ctx context.Context, imageDiskPath string) (string,
 			}},
 			&credentials.EnvProvider{},
 			remoteCredProvider(sess),
+			webIdentityProvider(sess),
 		})
 	cfg := &aws.Config{
 		Region:           aws.String(u.region),
@@ -96,6 +99,15 @@ func (u *S3Uploader) Upload(ctx context.Context, imageDiskPath string) (string,
 	return result.Location, nil
 }
 
+func webIdentityProvider(sess *session.Session) credentials.Provider {
+	svc := sts.New(sess)
+
+	roleARN := os.Getenv("AWS_ROLE_ARN")
+	tokenFilepath := os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")
+	roleSessionName := os.Getenv("AWS_ROLE_SESSION_NAME")
+	return stscreds.NewWebIdentityRoleProvider(svc, roleARN, roleSessionName, tokenFilepath)
+}
+
 func remoteCredProvider(sess *session.Session) credentials.Provider {
 	ecsCredURI := os.Getenv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI")