aws_iam: deprecate extension and mark for future deletion (#37596)

Fixes #36910

Signed-off-by: Greg Greenway <[email protected]>

api/envoy/config/grpc_credential/v3/BUILD

@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "@com_github_cncf_xds//udpa/annotations:pkg",
     ],

api/envoy/config/grpc_credential/v3/aws_iam.proto

@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package envoy.config.grpc_credential.v3;
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -14,6 +15,11 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: Grpc Credentials AWS IAM]
 // Configuration for AWS IAM Grpc Credentials Plugin
+// .. warning::
+//
+//    This extension is deprecated and will be deleted in a future Envoy release, no
+//    later than Envoy 1.35, but possibly sooner.
+//
 // [#extension: envoy.grpc_credentials.aws_iam]
 
 message AwsIamConfig {
@@ -25,12 +31,16 @@ message AwsIamConfig {
   // of the Grpc endpoint.
   //
   // Example: appmesh
-  string service_name = 1 [(validate.rules).string = {min_len: 1}];
+  string service_name = 1 [
+    deprecated = true,
+    (validate.rules).string = {min_len: 1},
+    (envoy.annotations.deprecated_at_minor_version) = "3.0"
+  ];
 
   // The `region <https://docs.aws.amazon.com/general/latest/gr/rande.html>`_ hosting the Grpc
   // endpoint. If unspecified, the extension will use the value in the ``AWS_REGION`` environment
   // variable.
   //
   // Example: us-west-2
-  string region = 2;
+  string region = 2 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }

changelogs/current.yaml

@@ -341,3 +341,7 @@ deprecated:
   change: |
     metadata :ref:`metadata <envoy_v3_api_field_config.rbac.v3.Permission.metadata>` is now deprecated in the
     favor of :ref:`sourced_metadata <envoy_v3_api_field_config.rbac.v3.Permission.sourced_metadata>`.
+- area: aws_iam
+  change: |
+    The :ref:`aws_iam extension <envoy_v3_api_msg_config.grpc_credential.v3.AwsIamConfig>` is deprecated and will be
+    deleted from Envoy in a future release, no later than Envoy 1.35, but possibly sooner.