AWS secrets engine generating session tokens

[robmonte]

This reintroduces the addition of a new credential type session_token to the AWS Secrets Engine, originally provided here.

MFA codes:
When writing a vault role, provide the serial number of the MFA device added to the IAM user like so:

vault write aws/roles/my-mfa-role \
credential_type="session_token" \
mfa_serial_number="arn:aws:iam::<account-id>:mfa/<device-name>"

Then when getting credentials, pass the code like so:

vault read aws/creds/my-mfa-role \
mfa_code="123456"

Closes #12734

[github-actions]

Build Results:
All builds succeeded! ✅

[github-actions]

CI Results:
All Go tests succeeded! ✅

[robmonte]

Hey @grahamc

I wanted to let you know I've had the opportunity to pick this back up. I was unhappy with the poor experience you had with your prior PR and wanted to get the feature added with this opportunity. I'd love to hear if you have any comments on changes I've mad.

At the moment the main change is switching from the use of "security_token" to "session_token" to better align with modern AWS terminology. Do you foresee any problems with this?

[grahamc]

Sounds good!

…

On Mon, Oct 16, 2023, at 10:43 PM, Robert wrote: Hey @grahamc <https://github.com/grahamc> I wanted to let you know I've had the opportunity to pick this back up. I was unhappy with the poor experience you had with your prior PR and wanted to get the feature added with this opportunity. I'd love to hear if you have any comments on changes I've mad. At the moment the main change is switching from the use of `"security_token"` to `"session_token"` to better align with modern AWS terminology. Do you foresee any problems with this? — Reply to this email directly, view it on GitHub <#23690 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAASXLDBQDZ52GL4Y5OGHQ3X7XWEXAVCNFSM6AAAAAA6DAPCEGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONRVGU3DMOJWHE>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[raymonstah]

Is the rename of security_token to session_token a breaking change?

[robmonte]

Is the rename of security_token to session_token a breaking change?

You're right. I think since the goal of this PR is to now support session token generation, it makes sense to adjust the terminology accordingly to match AWS. I've added back security_token in with this commit 7489461 so both it and session_token can exist, while adding a deprecation notice for the security_token field. Let me know your thoughts, and then we can also run this by the wider team.

[austingebauer]

LGTM!

[mladlow]

@robmonte next time please use the correct new feature formatting for new features in the changelog.

[mladlow]

To add some more clarification - this should use the "Feature Name" we'd use in the release notes, and should try to communicate to the user why they would want to learn more about this brand new feature we're introducing in Vault 1.16.