Add native AWS configuration, secret, and ordinary KV store providers #410

Description

Add independently selected native AWS store providers behind the portable store interfaces. PR #414 now implements AppConfig Agent whole-document configuration, Secrets Manager whole-value secret startup snapshots, and live DynamoDB ordinary KV. The previous description treated DynamoDB only as a possible configuration alternative and missed the published ordinary-KV scope. Main still uses local Axum config/environment secrets (crates/edgezero-adapter-axum/src/dev_server.rs:449).

Steps to reproduce

On accepted #414, select each provider per logical ID, including mixed local/supplied/AWS bindings. Run deterministic loopback SDK and generated-consumer fixtures for startup, raw/envelope/secret fidelity, KV expiry/cursors and denial/failure paths. Real resource/IAM/version/table behavior requires the separately scoped authorized AWS acceptance, not fixture inference.

Expected behavior

Complete per-ID registries are prepared before application initialization/listen. Config/secrets are immutable startup snapshots adopted on restart; DynamoDB ordinary KV is live. Selected unavailable providers fail without development fallback; AWS dependencies stay native/default-off.

Impact

Without reusable provider mechanics each application repeats mapping, credentials, bounded work and failure handling. Fixture success does not certify deployed IAM, capacity, multi-replica identity/CAS semantics or safe application key rotation.

Proposed fix

Review/integrate #414 on accepted #275/#406 contracts. Preserve explicit versioned native bindings and absolute locator, supported workload credential discovery, process-owned clients, shared bounded startup sessions and redacted owned errors. AppConfig Agent maps documents explicitly; Secrets Manager preserves whole string/binary values and version selection.

DynamoDB requires reviewed table/schema/namespace, strong base-table reads/query, logical expiry, bounded cursors/payloads and one-attempt ambiguous-write behavior. Ordinary KV is not Add/CAS, atomic read-modify-write or a Trusted Server identity backend. Required keys/schemas/signing remain app-owned. AWS SDK/dependency DEBUG/TRACE and DynamoDB model Debug can expose resource/item details; document filters rather than claim process-wide suppression. No runtime write grants for config/secrets, automatic reload/rotation, infrastructure provisioning or AWS provider support on WASM.

Done when

• An approved design settles the initial config provider set, AppConfig access path, key/resource mapping, credential bootstrap, snapshot/cache policy, version selection and runtime update behavior.
• Native applications can independently bind AWS configuration and Secrets Manager through the existing portable interfaces.
• Required AWS configuration and app-declared secret resolution complete before readiness, with typed, redacted failures and no silent development fallback.
• Existing raw config values, typed envelopes and nested secret references retain their meanings.
• String/binary secret fidelity and the chosen version/cache policy are covered by regression tests.
• Deterministic tests cover provider protocol, concurrency and failure cases without credentials or network access.
• Authorized AWS acceptance demonstrates real resource mapping, least-privilege access, version/update behavior and cleanup. Record the exact tested revision and environment.
• Documentation includes native setup, IAM/read permissions, resource bindings, local development, limits, startup/update behavior and a clear support matrix. Examples use fictional resources and contain no actual credentials.
• Existing workspace and WASM gates pass with AWS providers disabled; enabled native-provider gates pass as well.
• DynamoDB ordinary KV schema/preflight, strong reads/query, key/value/cursor bounds, logical expiry, denied/stalled calls and ambiguous single-attempt writes have contract/generated-consumer evidence.
• Real DynamoDB resource/IAM/table acceptance is recorded separately; ordinary KV is not presented as downstream identity/CAS certification.

Related

• Parent Make the Axum adapter production-ready for self-hosted deployments #391. Implementation PR Add native AWS store providers #414; prerequisites Implement portable outbound HTTP and request lifecycle contracts #436 / PR feat: implement portable outbound HTTP and request lifecycle contracts #275 and Axum: define a production server lifecycle with bounded graceful shutdown #392/Axum: make production configuration and local storage explicit #396 / PR Add Axum production startup and bounded shutdown #406.
• Add native celld configuration and KV store providers #437 / PR Add native celld config and KV store providers #422 celld stores; Geo Axum: add protected CloudFront Geo metadata provider #432/Axum: follow up with an explicit local GeoIP provider #438 is separate from stores.
• Make ordinary config values readable consistently on Fastly #324 raw config semantics; Add a secrets CLI for typed application configuration #284 secret CLI.
• Downstream Trusted Server #1236, #1141, #843, #1142.