Function StartCredentialRefresh

server/server.go:2316–2388

StartCredentialRefresh starts a background goroutine that periodically refreshes S3 credentials for long-lived DuckDB connections using the credential_chain provider. This prevents credential expiration when running on EC2 with IAM instance roles, STS assume-role, or other temporary credential sourc

(execer sqlExecer, dlCfg DuckLakeConfig, isTxActive ...func() bool)

	if dlCfg.S3Chain != "" {
		secret += fmt.Sprintf(",\n\t\t\tCHAIN '%s'", dlCfg.S3Chain)
	}

	// Add profile if specified (for config chain)
	if dlCfg.S3Profile != "" {
		secret += fmt.Sprintf(",\n\t\t\tPROFILE '%s'", dlCfg.S3Profile)
	}

	// Add region override if specified
	if dlCfg.S3Region != "" {
		secret += fmt.Sprintf(",\n\t\t\tREGION '%s'", dlCfg.S3Region)
	}

	// Set URL style and SSL on the secret itself. duckdb-httpfs only honors
	// these from the secret (or env vars if the env-var-for-secret-settings
	// flag is on) — `SET GLOBAL s3_use_ssl = ...` at the session level is
	// dropped by S3KeyValueReader::TryGetSecretKeyOrSetting because it
	// filters GLOBAL-scope settings unless the env-var path is enabled.
	// Setting it on the secret is the only knob that actually controls the
	// http_proto = use_ssl ? "https://" : "http://" decision in s3fs.cpp.
	if dlCfg.S3Endpoint != "" || dlCfg.HTTPProxy != "" {
		if dlCfg.S3Endpoint != "" {
			secret += fmt.Sprintf(",\n\t\t\tENDPOINT '%s'", dlCfg.S3Endpoint)
		}
		urlStyle, useSSL := resolveS3SecretTransport(dlCfg)
		secret += fmt.Sprintf(",\n\t\t\tURL_STYLE '%s'", urlStyle)
		secret += fmt.Sprintf(",\n\t\t\tUSE_SSL %s", useSSL)
	}

	secret += "\n\t\t)"
	return secret
}

// fetchAWSSDKCredentials uses the Go AWS SDK's default credential chain to retrieve
// temporary credentials. This supports all credential sources that the Go SDK supports,
// including EKS Pod Identity (AWS_CONTAINER_CREDENTIALS_FULL_URI), IRSA, instance
// metadata, environment variables, and config files — unlike DuckDB's built-in
// credential_chain which does not support EKS Pod Identity.
func fetchAWSSDKCredentials(ctx context.Context, region string) (aws.Credentials, error) {
	var opts []func(*awsconfig.LoadOptions) error
	if region != "" {
		opts = append(opts, awsconfig.WithRegion(region))
	}
	cfg, err := awsconfig.LoadDefaultConfig(ctx, opts...)
	if err != nil {
		return aws.Credentials{}, fmt.Errorf("failed to load AWS config: %w", err)
	}
	creds, err := cfg.Credentials.Retrieve(ctx)
	if err != nil {
		return aws.Credentials{}, fmt.Errorf("failed to retrieve AWS credentials: %w", err)
	}
	return creds, nil
}

// buildAWSSdkSecret fetches credentials via the Go AWS SDK and builds a
// CREATE SECRET statement with PROVIDER config using the explicit temporary credentials.
func buildAWSSdkSecret(ctx context.Context, dlCfg DuckLakeConfig) (string, error) {
	creds, err := fetchAWSSDKCredentials(ctx, dlCfg.S3Region)
	if err != nil {