fix(objectstore): pass ExternalId when assuming the S3 role (CSA-641)

[ashish-atlan]

Summary

S3Sync assumed the customer's IAM role with only RoleArn and RoleSessionName. Any role whose trust policy has an sts:ExternalId condition rejects that call with a generic 403 AccessDenied. That blocks Asset Import and Asset Export from customer S3 buckets set up this way.

Changes:

• S3Credential reads an optional aws_external_id from the credential's extra. This is the same key the Athena, Glue, SMUS and S3 crawler forms use, and the one used by the Generic Miner fix (atlan-generic-miner-app#10).
• S3Sync takes an optional externalId and sets it on the AssumeRoleRequest only when it is not blank. Request building moved into S3Sync.buildAssumeRoleRequest so it can be unit-tested without calling STS.
• All four S3Sync call sites in Utils pass it through: getInputFile, both getInputFiles branches, and uploadOutputFile.

Impact

• Credentials without an External ID send exactly the same request as before.
• Every package built on package-toolkit-runtime gets the new optional parameter. The value only reaches a tenant once that package's marketplace template points at a rebuilt image.
• The UI field is added separately in marketplace-packages, in the shared csa-connectors-objectstore configmap.
• 🔒 This touches credential handling. Please give it a security review. The External ID value is never logged.

Related

• CSA-641 (Import), CSA-642 (Export), CSA-526 (Export 403 missing ExternalId)
• Overlaps fix(objectstore): pass ExternalId when assuming the S3 export role #2710, which makes the same code change without tests. One of the two should be closed.

Test plan

• New S3ExternalIdTest: 4 cases. The ID is parsed from the credential, it defaults to empty, it is set when provided, and it is left off when blank.
• :package-toolkit:runtime:test: 83 tests pass.
• asset-import and asset-export-basic compile.
• Branch images built through the Merge workflow and tested on a staging tenant with a role that requires an External ID.

🤖 Generated with Claude Code

[linear]

CSA-641