Expose AWS IAM missing param in Hashicorp secret

[pankajastro]

Expose arn_role param in VaultBackend and add boto3 as an additional dependency. This will help authenticate with temporary credentials.

Example config

AIRFLOW__SECRETS__BACKEND_KWARGS='{"kv_engine_version": 1, "mount_point": "kv", "url": "http://35.161.42.91:8200/", "auth_type": "aws_iam", "arn_role": "arn:aws:iam::123456789000:role/hashicorp-aws-iam-role"}'

Expose aws_conn_id param in VaultBackend and add apache-airflow-providers-amazon as dependency

This PR expose below missing param in hashicorp secret for aws auth

- session_token
- header_value
- use_token
- region

https://github.com/hvac/hvac/blob/48027db42c037fe8f6b1c6fd8f6dbf80c1ea8595/hvac/api/auth_methods/aws.py#L734-L743

---

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

[phanikumv]

Wondering if we need docs for this change?

[Lee-W]

I thought there should be some breaking test for this change 🤔 Should we add some tests for hasicorp?

[ReadytoRocc]

@pankajastro - we should consider exposing assume_role_kwargs as a backend_kwarg.

This is currently available as an AWS Connection Extra parameter.

[pankajastro]

Could you please share an example of AIRFLOW__SECRETS__BACKEND_KWARGS?

[ReadytoRocc]

Please see the Request Syntax section for example kwargs.

I imagine it would be a dictionary that you would pass to AIRFLOW__SECRETS__BACKEND_KWARGS, like one does today in the AWS connection.

[pankajastro]

wdyt #39279

AIRFLOW__SECRETS__BACKEND_KWARGS='{"kv_engine_version": 1, "mount_point": "kv", "variables_path": "airflow", "url": "http://127.0.0.0:8200/", "auth_type": "aws_iam", "assume_role_kwargs": {"RoleArn": "arn:aws:iam::1234567890000:role/hashicorp-aws-iam", "RoleSessionName": "airflow", "DurationSeconds": 900}}'

[ReadytoRocc]

Yes that looks good (assuming that it works). You wouldn't need a role_arn arg in this case.

[pankajastro]

It's included in the assume_role_kwargs parameter. I've shared an example for reference ^^

[ReadytoRocc]

Agreed. I am saying you no longer need a dedicated role_arn backend kwarg. It would be a part of assume_role_kwargs.