diff --git a/.github/workflows/docker-publish-lakefs-rclone-export.yaml b/.github/workflows/docker-publish-lakefs-rclone-export.yaml
index 80b02899518..75837bc90ac 100644
--- a/.github/workflows/docker-publish-lakefs-rclone-export.yaml
+++ b/.github/workflows/docker-publish-lakefs-rclone-export.yaml
@@ -32,7 +32,7 @@ jobs:
         id: version
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v3
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
diff --git a/.github/workflows/docker-publish.yaml b/.github/workflows/docker-publish.yaml
index 4b1cbba54e8..29cfebbe252 100644
--- a/.github/workflows/docker-publish.yaml
+++ b/.github/workflows/docker-publish.yaml
@@ -52,7 +52,7 @@ jobs:
           GOLANGCI_LINT_FLAGS: --out-format github-actions
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v3
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
diff --git a/.github/workflows/esti.yaml b/.github/workflows/esti.yaml
index 8f571b1ef5c..39b32cf7cea 100644
--- a/.github/workflows/esti.yaml
+++ b/.github/workflows/esti.yaml
@@ -83,7 +83,7 @@ jobs:
         run: tar -xf /tmp/generated.tar.gz
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v3
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
@@ -116,7 +116,7 @@ jobs:
     if: needs.check-secrets.outputs.secretsavailable == 'true'
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v3
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: us-east-1
@@ -186,7 +186,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v3
         with:
-          go-version: 1.19.2
+          go-version: "1.20.6"
         id: go
 
       - name: Generate uniquifying value
@@ -237,7 +237,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v3
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
diff --git a/.github/workflows/goreleaser.yaml b/.github/workflows/goreleaser.yaml
index ed2693a717e..3c7720afe6b 100644
--- a/.github/workflows/goreleaser.yaml
+++ b/.github/workflows/goreleaser.yaml
@@ -103,7 +103,7 @@ jobs:
           go-version: "1.20.6"
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v3
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
diff --git a/.github/workflows/publish-hadoop-lakefs.yaml b/.github/workflows/publish-hadoop-lakefs.yaml
index 6b7e568a856..3f0f100d190 100644
--- a/.github/workflows/publish-hadoop-lakefs.yaml
+++ b/.github/workflows/publish-hadoop-lakefs.yaml
@@ -49,7 +49,7 @@ jobs:
         run: sed -i.bak 's/<version>.*<\/version><!--MARKER.*/<version>'${{ steps.version.outputs.tag }}'<\/version>/' pom.xml
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v3
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
diff --git a/.secretsignore b/.secretsignore
index 411e6b21b32..327a934fe1c 100644
--- a/.secretsignore
+++ b/.secretsignore
@@ -15,4 +15,4 @@ bPxRfiCYEXAMPLEKEY
 wJalrXUtnFEMI/K3MDENG/bPxRfiCYEXAMPLEKEY
 wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
 zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG
-
+10a718b3f285d89c36e9864494cdd1507f3bc85b342df24736ea81f9a1134bcc
diff --git a/api/swagger.yml b/api/swagger.yml
index 0093fa7e250..bda8a0d83b8 100644
--- a/api/swagger.yml
+++ b/api/swagger.yml
@@ -3739,6 +3739,10 @@ paths:
                   description: Only a single file per upload which must be named "content".
                   type: string
                   format: binary
+          application/octet-stream:
+            schema:
+              type: string
+              format: binary
 
       parameters:
         - in: query
diff --git a/clients/java/README.md b/clients/java/README.md
index 9d8f701f9d9..9b9f76b05c0 100644
--- a/clients/java/README.md
+++ b/clients/java/README.md
@@ -285,6 +285,7 @@ Class | Method | HTTP request | Description
  - [ImportPagination](docs/ImportPagination.md)
  - [ImportStatusResp](docs/ImportStatusResp.md)
  - [IngestRangeCreationResponse](docs/IngestRangeCreationResponse.md)
+ - [InlineObject](docs/InlineObject.md)
  - [InlineObject1](docs/InlineObject1.md)
  - [LoginConfig](docs/LoginConfig.md)
  - [LoginInformation](docs/LoginInformation.md)
diff --git a/clients/java/api/openapi.yaml b/clients/java/api/openapi.yaml
index f596adac701..ad6bd5ebed9 100644
--- a/clients/java/api/openapi.yaml
+++ b/clients/java/api/openapi.yaml
@@ -4113,6 +4113,10 @@ paths:
                   format: binary
                   type: string
               type: object
+          application/octet-stream:
+            schema:
+              format: binary
+              type: string
       responses:
         "201":
           content:
@@ -5633,6 +5637,9 @@ components:
         multipart/form-data:
           schema:
             $ref: '#/components/schemas/inline_object'
+        application/octet-stream:
+          schema:
+            $ref: '#/components/schemas/inline_object'
   responses:
     NotFoundOrNoACL:
       content:
diff --git a/clients/java/docs/InlineObject.md b/clients/java/docs/InlineObject.md
new file mode 100644
index 00000000000..139d6ccbaa5
--- /dev/null
+++ b/clients/java/docs/InlineObject.md
@@ -0,0 +1,13 @@
+
+
+# InlineObject
+
+
+## Properties
+
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**content** | **File** | Only a single file per upload which must be named \&quot;content\&quot;. |  [optional]
+
+
+
diff --git a/clients/java/docs/ObjectsApi.md b/clients/java/docs/ObjectsApi.md
index a6488d371c3..a34aebab0d0 100644
--- a/clients/java/docs/ObjectsApi.md
+++ b/clients/java/docs/ObjectsApi.md
@@ -997,7 +997,7 @@ Name | Type | Description  | Notes
 
 ### HTTP request headers
 
- - **Content-Type**: multipart/form-data
+ - **Content-Type**: multipart/form-data, application/octet-stream
  - **Accept**: application/json
 
 ### HTTP response details
diff --git a/clients/java/src/main/java/io/lakefs/clients/api/ObjectsApi.java b/clients/java/src/main/java/io/lakefs/clients/api/ObjectsApi.java
index 6bed67b4af7..0b00d362385 100644
--- a/clients/java/src/main/java/io/lakefs/clients/api/ObjectsApi.java
+++ b/clients/java/src/main/java/io/lakefs/clients/api/ObjectsApi.java
@@ -1584,7 +1584,7 @@ public okhttp3.Call uploadObjectCall(String repository, String branch, String pa
         }
 
         final String[] localVarContentTypes = {
-            "multipart/form-data"
+            "multipart/form-data", "application/octet-stream"
         };
         final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
         localVarHeaderParams.put("Content-Type", localVarContentType);
diff --git a/clients/java/src/main/java/io/lakefs/clients/api/model/InlineObject.java b/clients/java/src/main/java/io/lakefs/clients/api/model/InlineObject.java
new file mode 100644
index 00000000000..f9119856389
--- /dev/null
+++ b/clients/java/src/main/java/io/lakefs/clients/api/model/InlineObject.java
@@ -0,0 +1,99 @@
+/*
+ * lakeFS API
+ * lakeFS HTTP API
+ *
+ * The version of the OpenAPI document: 0.1.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+package io.lakefs.clients.api.model;
+
+import java.util.Objects;
+import java.util.Arrays;
+import com.google.gson.TypeAdapter;
+import com.google.gson.annotations.JsonAdapter;
+import com.google.gson.annotations.SerializedName;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+import io.swagger.annotations.ApiModel;
+import io.swagger.annotations.ApiModelProperty;
+import java.io.File;
+import java.io.IOException;
+
+/**
+ * InlineObject
+ */
+@javax.annotation.Generated(value = "org.openapitools.codegen.languages.JavaClientCodegen")
+public class InlineObject {
+  public static final String SERIALIZED_NAME_CONTENT = "content";
+  @SerializedName(SERIALIZED_NAME_CONTENT)
+  private File content;
+
+
+  public InlineObject content(File content) {
+    
+    this.content = content;
+    return this;
+  }
+
+   /**
+   * Only a single file per upload which must be named \&quot;content\&quot;.
+   * @return content
+  **/
+  @javax.annotation.Nullable
+  @ApiModelProperty(value = "Only a single file per upload which must be named \"content\".")
+
+  public File getContent() {
+    return content;
+  }
+
+
+  public void setContent(File content) {
+    this.content = content;
+  }
+
+
+  @Override
+  public boolean equals(Object o) {
+    if (this == o) {
+      return true;
+    }
+    if (o == null || getClass() != o.getClass()) {
+      return false;
+    }
+    InlineObject inlineObject = (InlineObject) o;
+    return Objects.equals(this.content, inlineObject.content);
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(content);
+  }
+
+  @Override
+  public String toString() {
+    StringBuilder sb = new StringBuilder();
+    sb.append("class InlineObject {\n");
+    sb.append("    content: ").append(toIndentedString(content)).append("\n");
+    sb.append("}");
+    return sb.toString();
+  }
+
+  /**
+   * Convert the given object to string with each line indented by 4 spaces
+   * (except the first line).
+   */
+  private String toIndentedString(Object o) {
+    if (o == null) {
+      return "null";
+    }
+    return o.toString().replace("\n", "\n    ");
+  }
+
+}
+
diff --git a/clients/java/src/test/java/io/lakefs/clients/api/model/InlineObjectTest.java b/clients/java/src/test/java/io/lakefs/clients/api/model/InlineObjectTest.java
new file mode 100644
index 00000000000..d4f3bb65ed3
--- /dev/null
+++ b/clients/java/src/test/java/io/lakefs/clients/api/model/InlineObjectTest.java
@@ -0,0 +1,52 @@
+/*
+ * lakeFS API
+ * lakeFS HTTP API
+ *
+ * The version of the OpenAPI document: 0.1.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+package io.lakefs.clients.api.model;
+
+import com.google.gson.TypeAdapter;
+import com.google.gson.annotations.JsonAdapter;
+import com.google.gson.annotations.SerializedName;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+import io.swagger.annotations.ApiModel;
+import io.swagger.annotations.ApiModelProperty;
+import java.io.File;
+import java.io.IOException;
+import org.junit.Assert;
+import org.junit.Ignore;
+import org.junit.Test;
+
+
+/**
+ * Model tests for InlineObject
+ */
+public class InlineObjectTest {
+    private final InlineObject model = new InlineObject();
+
+    /**
+     * Model tests for InlineObject
+     */
+    @Test
+    public void testInlineObject() {
+        // TODO: test InlineObject
+    }
+
+    /**
+     * Test the property 'content'
+     */
+    @Test
+    public void contentTest() {
+        // TODO: test content
+    }
+
+}
diff --git a/clients/python/.openapi-generator/FILES b/clients/python/.openapi-generator/FILES
index 47aa8964a5d..fa67a29681a 100644
--- a/clients/python/.openapi-generator/FILES
+++ b/clients/python/.openapi-generator/FILES
@@ -49,6 +49,7 @@ docs/ImportLocation.md
 docs/ImportPagination.md
 docs/ImportStatusResp.md
 docs/IngestRangeCreationResponse.md
+docs/InlineObject.md
 docs/InlineObject1.md
 docs/InternalApi.md
 docs/LoginConfig.md
@@ -174,6 +175,7 @@ lakefs_client/model/import_location.py
 lakefs_client/model/import_pagination.py
 lakefs_client/model/import_status_resp.py
 lakefs_client/model/ingest_range_creation_response.py
+lakefs_client/model/inline_object.py
 lakefs_client/model/inline_object1.py
 lakefs_client/model/login_config.py
 lakefs_client/model/login_information.py
@@ -281,6 +283,7 @@ test/test_import_location.py
 test/test_import_pagination.py
 test/test_import_status_resp.py
 test/test_ingest_range_creation_response.py
+test/test_inline_object.py
 test/test_inline_object1.py
 test/test_internal_api.py
 test/test_login_config.py
diff --git a/clients/python/README.md b/clients/python/README.md
index c3f8eac40c2..c673f9a91ed 100644
--- a/clients/python/README.md
+++ b/clients/python/README.md
@@ -266,6 +266,7 @@ Class | Method | HTTP request | Description
  - [ImportPagination](docs/ImportPagination.md)
  - [ImportStatusResp](docs/ImportStatusResp.md)
  - [IngestRangeCreationResponse](docs/IngestRangeCreationResponse.md)
+ - [InlineObject](docs/InlineObject.md)
  - [InlineObject1](docs/InlineObject1.md)
  - [LoginConfig](docs/LoginConfig.md)
  - [LoginInformation](docs/LoginInformation.md)
diff --git a/clients/python/docs/InlineObject.md b/clients/python/docs/InlineObject.md
new file mode 100644
index 00000000000..09b9f82b365
--- /dev/null
+++ b/clients/python/docs/InlineObject.md
@@ -0,0 +1,12 @@
+# InlineObject
+
+
+## Properties
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**content** | **file_type** | Only a single file per upload which must be named \&quot;content\&quot;. | [optional] 
+**any string name** | **bool, date, datetime, dict, float, int, list, str, none_type** | any string name can be used but the value must be the correct type | [optional]
+
+[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
+
+
diff --git a/clients/python/docs/ObjectsApi.md b/clients/python/docs/ObjectsApi.md
index 3c24e464c1a..7d40325743d 100644
--- a/clients/python/docs/ObjectsApi.md
+++ b/clients/python/docs/ObjectsApi.md
@@ -1210,7 +1210,7 @@ Name | Type | Description  | Notes
 
 ### HTTP request headers
 
- - **Content-Type**: multipart/form-data
+ - **Content-Type**: multipart/form-data, application/octet-stream
  - **Accept**: application/json
 
 
diff --git a/clients/python/lakefs_client/api/objects_api.py b/clients/python/lakefs_client/api/objects_api.py
index 48c73124c65..6545fe54d45 100644
--- a/clients/python/lakefs_client/api/objects_api.py
+++ b/clients/python/lakefs_client/api/objects_api.py
@@ -815,7 +815,8 @@ def __init__(self, api_client=None):
                     'application/json'
                 ],
                 'content_type': [
-                    'multipart/form-data'
+                    'multipart/form-data',
+                    'application/octet-stream'
                 ]
             },
             api_client=api_client
diff --git a/clients/python/lakefs_client/model/inline_object.py b/clients/python/lakefs_client/model/inline_object.py
new file mode 100644
index 00000000000..1abf2d93bbf
--- /dev/null
+++ b/clients/python/lakefs_client/model/inline_object.py
@@ -0,0 +1,256 @@
+"""
+    lakeFS API
+
+    lakeFS HTTP API  # noqa: E501
+
+    The version of the OpenAPI document: 0.1.0
+    Contact: services@treeverse.io
+    Generated by: https://openapi-generator.tech
+"""
+
+
+import re  # noqa: F401
+import sys  # noqa: F401
+
+from lakefs_client.model_utils import (  # noqa: F401
+    ApiTypeError,
+    ModelComposed,
+    ModelNormal,
+    ModelSimple,
+    cached_property,
+    change_keys_js_to_python,
+    convert_js_args_to_python_args,
+    date,
+    datetime,
+    file_type,
+    none_type,
+    validate_get_composed_info,
+)
+from ..model_utils import OpenApiModel
+from lakefs_client.exceptions import ApiAttributeError
+
+
+
+class InlineObject(ModelNormal):
+    """NOTE: This class is auto generated by OpenAPI Generator.
+    Ref: https://openapi-generator.tech
+
+    Do not edit the class manually.
+
+    Attributes:
+      allowed_values (dict): The key is the tuple path to the attribute
+          and the for var_name this is (var_name,). The value is a dict
+          with a capitalized key describing the allowed value and an allowed
+          value. These dicts store the allowed enum values.
+      attribute_map (dict): The key is attribute name
+          and the value is json key in definition.
+      discriminator_value_class_map (dict): A dict to go from the discriminator
+          variable value to the discriminator class name.
+      validations (dict): The key is the tuple path to the attribute
+          and the for var_name this is (var_name,). The value is a dict
+          that stores validations for max_length, min_length, max_items,
+          min_items, exclusive_maximum, inclusive_maximum, exclusive_minimum,
+          inclusive_minimum, and regex.
+      additional_properties_type (tuple): A tuple of classes accepted
+          as additional properties values.
+    """
+
+    allowed_values = {
+    }
+
+    validations = {
+    }
+
+    @cached_property
+    def additional_properties_type():
+        """
+        This must be a method because a model may have properties that are
+        of type self, this must run after the class is loaded
+        """
+        return (bool, date, datetime, dict, float, int, list, str, none_type,)  # noqa: E501
+
+    _nullable = False
+
+    @cached_property
+    def openapi_types():
+        """
+        This must be a method because a model may have properties that are
+        of type self, this must run after the class is loaded
+
+        Returns
+            openapi_types (dict): The key is attribute name
+                and the value is attribute type.
+        """
+        return {
+            'content': (file_type,),  # noqa: E501
+        }
+
+    @cached_property
+    def discriminator():
+        return None
+
+
+    attribute_map = {
+        'content': 'content',  # noqa: E501
+    }
+
+    read_only_vars = {
+    }
+
+    _composed_schemas = {}
+
+    @classmethod
+    @convert_js_args_to_python_args
+    def _from_openapi_data(cls, *args, **kwargs):  # noqa: E501
+        """InlineObject - a model defined in OpenAPI
+
+        Keyword Args:
+            _check_type (bool): if True, values for parameters in openapi_types
+                                will be type checked and a TypeError will be
+                                raised if the wrong type is input.
+                                Defaults to True
+            _path_to_item (tuple/list): This is a list of keys or values to
+                                drill down to the model in received_data
+                                when deserializing a response
+            _spec_property_naming (bool): True if the variable names in the input data
+                                are serialized names, as specified in the OpenAPI document.
+                                False if the variable names in the input data
+                                are pythonic names, e.g. snake case (default)
+            _configuration (Configuration): the instance to use when
+                                deserializing a file_type parameter.
+                                If passed, type conversion is attempted
+                                If omitted no type conversion is done.
+            _visited_composed_classes (tuple): This stores a tuple of
+                                classes that we have traveled through so that
+                                if we see that class again we will not use its
+                                discriminator again.
+                                When traveling through a discriminator, the
+                                composed schema that is
+                                is traveled through is added to this set.
+                                For example if Animal has a discriminator
+                                petType and we pass in "Dog", and the class Dog
+                                allOf includes Animal, we move through Animal
+                                once using the discriminator, and pick Dog.
+                                Then in Dog, we will make an instance of the
+                                Animal class but this time we won't travel
+                                through its discriminator because we passed in
+                                _visited_composed_classes = (Animal,)
+            content (file_type): Only a single file per upload which must be named \"content\".. [optional]  # noqa: E501
+        """
+
+        _check_type = kwargs.pop('_check_type', True)
+        _spec_property_naming = kwargs.pop('_spec_property_naming', False)
+        _path_to_item = kwargs.pop('_path_to_item', ())
+        _configuration = kwargs.pop('_configuration', None)
+        _visited_composed_classes = kwargs.pop('_visited_composed_classes', ())
+
+        self = super(OpenApiModel, cls).__new__(cls)
+
+        if args:
+            raise ApiTypeError(
+                "Invalid positional arguments=%s passed to %s. Remove those invalid positional arguments." % (
+                    args,
+                    self.__class__.__name__,
+                ),
+                path_to_item=_path_to_item,
+                valid_classes=(self.__class__,),
+            )
+
+        self._data_store = {}
+        self._check_type = _check_type
+        self._spec_property_naming = _spec_property_naming
+        self._path_to_item = _path_to_item
+        self._configuration = _configuration
+        self._visited_composed_classes = _visited_composed_classes + (self.__class__,)
+
+        for var_name, var_value in kwargs.items():
+            if var_name not in self.attribute_map and \
+                        self._configuration is not None and \
+                        self._configuration.discard_unknown_keys and \
+                        self.additional_properties_type is None:
+                # discard variable.
+                continue
+            setattr(self, var_name, var_value)
+        return self
+
+    required_properties = set([
+        '_data_store',
+        '_check_type',
+        '_spec_property_naming',
+        '_path_to_item',
+        '_configuration',
+        '_visited_composed_classes',
+    ])
+
+    @convert_js_args_to_python_args
+    def __init__(self, *args, **kwargs):  # noqa: E501
+        """InlineObject - a model defined in OpenAPI
+
+        Keyword Args:
+            _check_type (bool): if True, values for parameters in openapi_types
+                                will be type checked and a TypeError will be
+                                raised if the wrong type is input.
+                                Defaults to True
+            _path_to_item (tuple/list): This is a list of keys or values to
+                                drill down to the model in received_data
+                                when deserializing a response
+            _spec_property_naming (bool): True if the variable names in the input data
+                                are serialized names, as specified in the OpenAPI document.
+                                False if the variable names in the input data
+                                are pythonic names, e.g. snake case (default)
+            _configuration (Configuration): the instance to use when
+                                deserializing a file_type parameter.
+                                If passed, type conversion is attempted
+                                If omitted no type conversion is done.
+            _visited_composed_classes (tuple): This stores a tuple of
+                                classes that we have traveled through so that
+                                if we see that class again we will not use its
+                                discriminator again.
+                                When traveling through a discriminator, the
+                                composed schema that is
+                                is traveled through is added to this set.
+                                For example if Animal has a discriminator
+                                petType and we pass in "Dog", and the class Dog
+                                allOf includes Animal, we move through Animal
+                                once using the discriminator, and pick Dog.
+                                Then in Dog, we will make an instance of the
+                                Animal class but this time we won't travel
+                                through its discriminator because we passed in
+                                _visited_composed_classes = (Animal,)
+            content (file_type): Only a single file per upload which must be named \"content\".. [optional]  # noqa: E501
+        """
+
+        _check_type = kwargs.pop('_check_type', True)
+        _spec_property_naming = kwargs.pop('_spec_property_naming', False)
+        _path_to_item = kwargs.pop('_path_to_item', ())
+        _configuration = kwargs.pop('_configuration', None)
+        _visited_composed_classes = kwargs.pop('_visited_composed_classes', ())
+
+        if args:
+            raise ApiTypeError(
+                "Invalid positional arguments=%s passed to %s. Remove those invalid positional arguments." % (
+                    args,
+                    self.__class__.__name__,
+                ),
+                path_to_item=_path_to_item,
+                valid_classes=(self.__class__,),
+            )
+
+        self._data_store = {}
+        self._check_type = _check_type
+        self._spec_property_naming = _spec_property_naming
+        self._path_to_item = _path_to_item
+        self._configuration = _configuration
+        self._visited_composed_classes = _visited_composed_classes + (self.__class__,)
+
+        for var_name, var_value in kwargs.items():
+            if var_name not in self.attribute_map and \
+                        self._configuration is not None and \
+                        self._configuration.discard_unknown_keys and \
+                        self.additional_properties_type is None:
+                # discard variable.
+                continue
+            setattr(self, var_name, var_value)
+            if var_name in self.read_only_vars:
+                raise ApiAttributeError(f"`{var_name}` is a read-only attribute. Use `from_openapi_data` to instantiate "
+                                     f"class with read only attributes.")
diff --git a/clients/python/lakefs_client/models/__init__.py b/clients/python/lakefs_client/models/__init__.py
index 20ce9907e67..9b1f2e12104 100644
--- a/clients/python/lakefs_client/models/__init__.py
+++ b/clients/python/lakefs_client/models/__init__.py
@@ -49,6 +49,7 @@
 from lakefs_client.model.import_pagination import ImportPagination
 from lakefs_client.model.import_status_resp import ImportStatusResp
 from lakefs_client.model.ingest_range_creation_response import IngestRangeCreationResponse
+from lakefs_client.model.inline_object import InlineObject
 from lakefs_client.model.inline_object1 import InlineObject1
 from lakefs_client.model.login_config import LoginConfig
 from lakefs_client.model.login_information import LoginInformation
diff --git a/clients/python/test/test_inline_object.py b/clients/python/test/test_inline_object.py
new file mode 100644
index 00000000000..4d954584c78
--- /dev/null
+++ b/clients/python/test/test_inline_object.py
@@ -0,0 +1,36 @@
+"""
+    lakeFS API
+
+    lakeFS HTTP API  # noqa: E501
+
+    The version of the OpenAPI document: 0.1.0
+    Contact: services@treeverse.io
+    Generated by: https://openapi-generator.tech
+"""
+
+
+import sys
+import unittest
+
+import lakefs_client
+from lakefs_client.model.inline_object import InlineObject
+
+
+class TestInlineObject(unittest.TestCase):
+    """InlineObject unit test stubs"""
+
+    def setUp(self):
+        pass
+
+    def tearDown(self):
+        pass
+
+    def testInlineObject(self):
+        """Test InlineObject"""
+        # FIXME: construct object with mandatory attributes with example values
+        # model = InlineObject()  # noqa: E501
+        pass
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/cmd/lakectl/cmd/abuse_commit.go b/cmd/lakectl/cmd/abuse_commit.go
index 6760e0cfd8f..2f695938fde 100644
--- a/cmd/lakectl/cmd/abuse_commit.go
+++ b/cmd/lakectl/cmd/abuse_commit.go
@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"fmt"
-	"math/rand"
 	"net/http"
 	"os"
 	"strconv"
@@ -31,7 +30,6 @@ var abuseCommitCmd = &cobra.Command{
 		generator := stress.NewGenerator("commit", 1, stress.WithSignalHandlersFor(os.Interrupt, syscall.SIGTERM))
 
 		// generate randomly selected keys as input
-		rand.Seed(time.Now().Unix())
 		generator.Setup(func(add stress.GeneratorAddFn) {
 			for i := 0; i < amount; i++ {
 				add(strconv.Itoa(i + 1))
diff --git a/cmd/lakectl/cmd/abuse_list.go b/cmd/lakectl/cmd/abuse_list.go
index a36058b423e..9d0cfd76ebe 100644
--- a/cmd/lakectl/cmd/abuse_list.go
+++ b/cmd/lakectl/cmd/abuse_list.go
@@ -1,7 +1,6 @@
 package cmd
 
 import (
-	"math/rand"
 	"net/http"
 	"os"
 	"strconv"
@@ -29,7 +28,6 @@ var abuseListCmd = &cobra.Command{
 		generator := stress.NewGenerator("list", parallelism, stress.WithSignalHandlersFor(os.Interrupt, syscall.SIGTERM))
 
 		// generate randomly selected keys as input
-		rand.Seed(time.Now().Unix())
 		generator.Setup(func(add stress.GeneratorAddFn) {
 			for i := 0; i < amount; i++ {
 				add(strconv.Itoa(i + 1))
diff --git a/cmd/lakectl/cmd/abuse_random_read.go b/cmd/lakectl/cmd/abuse_random_read.go
index ebfcce8d9e8..f1f73ca4b63 100644
--- a/cmd/lakectl/cmd/abuse_random_read.go
+++ b/cmd/lakectl/cmd/abuse_random_read.go
@@ -38,7 +38,6 @@ var abuseRandomReadsCmd = &cobra.Command{
 		generator := stress.NewGenerator("read", parallelism, stress.WithSignalHandlersFor(os.Interrupt, syscall.SIGTERM))
 
 		// generate randomly selected keys as input
-		rand.Seed(time.Now().Unix())
 		generator.Setup(func(add stress.GeneratorAddFn) {
 			for i := 0; i < amount; i++ {
 				//nolint:gosec
diff --git a/cmd/lakectl/cmd/abuse_random_writes.go b/cmd/lakectl/cmd/abuse_random_writes.go
index 1314b1a6110..b623f8ebb3e 100644
--- a/cmd/lakectl/cmd/abuse_random_writes.go
+++ b/cmd/lakectl/cmd/abuse_random_writes.go
@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"fmt"
-	"math/rand"
 	"net/http"
 	"os"
 	"syscall"
@@ -30,7 +29,6 @@ var abuseRandomWritesCmd = &cobra.Command{
 		generator := stress.NewGenerator("stage object", parallelism, stress.WithSignalHandlersFor(os.Interrupt, syscall.SIGTERM))
 
 		// generate randomly selected keys as input
-		rand.Seed(time.Now().Unix())
 		generator.Setup(func(add stress.GeneratorAddFn) {
 			for i := 0; i < amount; i++ {
 				add(fmt.Sprintf("%sfile-%d", prefix, i))
diff --git a/cmd/lakectl/cmd/metastore.go b/cmd/lakectl/cmd/metastore.go
index 40ab3588a30..2c4f5530021 100644
--- a/cmd/lakectl/cmd/metastore.go
+++ b/cmd/lakectl/cmd/metastore.go
@@ -1,12 +1,14 @@
 package cmd
 
 import (
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/glue"
 	"github.com/spf13/cobra"
 	"github.com/treeverse/lakefs/pkg/metastore"
-	"github.com/treeverse/lakefs/pkg/metastore/glue"
+	metastoreglue "github.com/treeverse/lakefs/pkg/metastore/glue"
 	"github.com/treeverse/lakefs/pkg/metastore/hive"
+	"golang.org/x/net/context"
 )
 
 var metastoreCmd = &cobra.Command{
@@ -15,24 +17,27 @@ var metastoreCmd = &cobra.Command{
 	Deprecated: "Upcoming releases of lakectl will no longer support this command.",
 }
 
-func getMetastoreAwsConfig(c *Configuration) *aws.Config {
-	cfg := &aws.Config{
-		Region: aws.String(string(c.Metastore.Glue.Region)),
+func getGlueClient(c *Configuration) *glue.Client {
+	cfg, err := config.LoadDefaultConfig(
+		context.TODO(),
+		config.WithRegion(string(c.Metastore.Glue.Region)),
+		config.WithSharedCredentialsFiles([]string{string(c.Metastore.Glue.CredentialsFile)}),
+		config.WithSharedConfigProfile(string(c.Metastore.Glue.Profile)),
+	)
+	if err != nil {
+		return nil
 	}
-	if c.Metastore.Glue.Profile != "" || c.Metastore.Glue.CredentialsFile != "" {
-		cfg.Credentials = credentials.NewSharedCredentials(
-			string(c.Metastore.Glue.CredentialsFile),
-			string(c.Metastore.Glue.Profile),
-		)
-	}
-	if c.Metastore.Glue.Credentials != nil {
-		cfg.Credentials = credentials.NewStaticCredentials(
-			string(c.Metastore.Glue.Credentials.AccessKeyID),
-			string(c.Metastore.Glue.Credentials.AccessSecretKey),
-			string(c.Metastore.Glue.Credentials.SessionToken),
-		)
-	}
-	return cfg
+
+	client := glue.NewFromConfig(cfg, func(options *glue.Options) {
+		if c.Metastore.Glue.Credentials != nil {
+			options.Credentials = credentials.NewStaticCredentialsProvider(
+				string(c.Metastore.Glue.Credentials.AccessKeyID),
+				string(c.Metastore.Glue.Credentials.AccessSecretKey),
+				string(c.Metastore.Glue.Credentials.SessionToken),
+			)
+		}
+	})
+	return client
 }
 
 func getMetastoreClient(msType, hiveAddress string) (metastore.Client, func()) {
@@ -57,8 +62,8 @@ func getMetastoreClient(msType, hiveAddress string) (metastore.Client, func()) {
 		return hiveClient, deferFunc
 
 	case "glue":
-		awsConfig := getMetastoreAwsConfig(cfg)
-		client, err := glue.NewMSClient(awsConfig, cfg.Metastore.Glue.CatalogID.String(), cfg.Metastore.Glue.DBLocationURI.String())
+		glueClient := getGlueClient(cfg)
+		client, err := metastoreglue.NewMSClient(glueClient, cfg.Metastore.Glue.CatalogID.String(), cfg.Metastore.Glue.DBLocationURI.String())
 		if err != nil {
 			DieErr(err)
 		}
diff --git a/cmd/lakefs-loadtest/cmd/entry.go b/cmd/lakefs-loadtest/cmd/entry.go
index ac9f24c0e61..ecd02ffc3db 100644
--- a/cmd/lakefs-loadtest/cmd/entry.go
+++ b/cmd/lakefs-loadtest/cmd/entry.go
@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"fmt"
-	"math/rand"
 	"os"
 	"strings"
 	"sync"
@@ -49,8 +48,6 @@ var entryCmd = &cobra.Command{
 			os.Exit(1)
 		}
 
-		rand.Seed(time.Now().UTC().UnixNano()) // make it special
-
 		ctx := cmd.Context()
 
 		conf, err := config.NewConfig("")
diff --git a/cmd/lakefs/cmd/run.go b/cmd/lakefs/cmd/run.go
index 4b01736af6e..c327629ebe7 100644
--- a/cmd/lakefs/cmd/run.go
+++ b/cmd/lakefs/cmd/run.go
@@ -168,6 +168,7 @@ var runCmd = &cobra.Command{
 		if err != nil {
 			logger.WithError(err).Fatal("Failed to create block adapter")
 		}
+
 		bufferedCollector.SetRuntimeCollector(blockStore.RuntimeStats)
 		// send metadata
 		bufferedCollector.CollectMetadata(metadata)
diff --git a/docs/assets/js/swagger.yml b/docs/assets/js/swagger.yml
index 0093fa7e250..bda8a0d83b8 100644
--- a/docs/assets/js/swagger.yml
+++ b/docs/assets/js/swagger.yml
@@ -3739,6 +3739,10 @@ paths:
                   description: Only a single file per upload which must be named "content".
                   type: string
                   format: binary
+          application/octet-stream:
+            schema:
+              type: string
+              format: binary
 
       parameters:
         - in: query
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index c7712c3b040..0adc8ff3ecd 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -129,8 +129,6 @@ This reference uses `.` to denote the nesting of values.
 * `blockstore.s3.credentials.session_token` `(string : )` - If specified, will be used as a static session token
 * `blockstore.s3.endpoint` `(string : )` - If specified, custom endpoint for the AWS S3 API (https://s3_compatible_service_endpoint:port)
 * `blockstore.s3.force_path_style` `(bool : false)` - When true, use path-style S3 URLs (https://<host>/<bucket> instead of https://<bucket>.<host>)
-* `blockstore.s3.streaming_chunk_size` `(int : 1048576)` - Object chunk size to buffer before streaming to blockstore (use a lower value for less reliable networks). Minimum is 8192.
-* `blockstore.s3.streaming_chunk_timeout` `(time duration : "60s")` - Per object chunk timeout for blockstore streaming operations (use a larger value for less reliable networks).
 * `blockstore.s3.discover_bucket_region` `(bool : true)` - (Can be turned off if the underlying S3 bucket doesn't support the GetBucketRegion API).
 * `blockstore.s3.skip_verify_certificate_test_only` `(boolean : false)` - Skip certificate verification while connecting to the storage endpoint. Should be used only for testing.
 * `blockstore.s3.server_side_encryption` `(string : )` - Server side encryption format used (Example on AWS using SSE-KMS while passing "aws:kms")
@@ -138,6 +136,8 @@ This reference uses `.` to denote the nesting of values.
 * `blockstore.s3.pre_signed_expiry` `(time duration : "15m")` - Expiry of pre-signed URL.
 * `blockstore.s3.disable_pre_signed` `(bool : false)` - Disable use of pre-signed URL.
 * `blockstore.s3.disable_pre_signed_ui` `(bool : true)` - Disable use of pre-signed URL in the UI.
+* `blockstore.s3.client_log_request` `(bool : false)` - Set SDK logging bit to log requests
+* `blockstore.s3.client_log_retries` `(bool : false)` - Set SDK logging bit to log retries
 * `graveler.reposiory_cache.size` `(int : 1000)` - How many items to store in the repository cache.
 * `graveler.reposiory_cache.ttl` `(time duration : "5s")` - How long to store an item in the repository cache.
 * `graveler.reposiory_cache.jitter` `(time duration : "2s")` - A random amount of time between 0 and this value is added to each item's TTL.
@@ -236,7 +236,7 @@ logging:
 
 auth:
   encrypt:
-    secret_key: "10a718b3f285d89c36e9864494cdd1507f3bc85b342df24736ea81f9a1134bcc09e90b6641"
+    secret_key: "10a718b3f285d89c36e9864494cdd1507f3bc85b342df24736ea81f9a1134bcc"
 
 blockstore:
   type: local
diff --git a/esti/commit_test.go b/esti/commit_test.go
index e8794bddc43..0588cdd4010 100644
--- a/esti/commit_test.go
+++ b/esti/commit_test.go
@@ -20,8 +20,8 @@ func TestCommitSingle(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			ctx, _, repo := setupTest(t)
 			defer tearDownTest(repo)
-			objPath := "1.txt"
 
+			const objPath = "1.txt"
 			_, objContent := uploadFileRandomData(ctx, t, repo, mainBranch, objPath, direct)
 			commitResp, err := client.CommitWithResponse(ctx, repo, mainBranch, &apigen.CommitParams{}, apigen.CommitJSONRequestBody{
 				Message: "singleCommit",
@@ -36,7 +36,7 @@ func TestCommitSingle(t *testing.T) {
 				"failed to get object repo %s branch %s path %s", repo, mainBranch, objPath)
 
 			body := string(getObjResp.Body)
-			require.Equal(t, objContent, body, fmt.Sprintf("path: %s, expected: %s, actual:%s", objPath, objContent, body))
+			require.Equalf(t, objContent, body, "path: %s, expected: %s, actual:%s", objPath, objContent, body)
 		})
 	}
 }
diff --git a/esti/delete_objects_test.go b/esti/delete_objects_test.go
index f35c2bc8b00..a732be8da3f 100644
--- a/esti/delete_objects_test.go
+++ b/esti/delete_objects_test.go
@@ -5,14 +5,14 @@ import (
 	"strconv"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/treeverse/lakefs/pkg/api/apigen"
-	"github.com/treeverse/lakefs/pkg/api/apiutil"
+	"github.com/treeverse/lakefs/pkg/testutil"
 )
 
 func TestDeleteObjects(t *testing.T) {
@@ -20,17 +20,17 @@ func TestDeleteObjects(t *testing.T) {
 	defer tearDownTest(repo)
 	const numOfObjects = 10
 
-	identifiers := make([]*s3.ObjectIdentifier, 0, numOfObjects)
+	identifiers := make([]types.ObjectIdentifier, 0, numOfObjects)
 
 	for i := 1; i <= numOfObjects; i++ {
 		file := strconv.Itoa(i) + ".txt"
-		identifiers = append(identifiers, &s3.ObjectIdentifier{
+		identifiers = append(identifiers, types.ObjectIdentifier{
 			Key: aws.String(mainBranch + "/" + file),
 		})
 		_, _ = uploadFileRandomData(ctx, t, repo, mainBranch, file, false)
 	}
 
-	listOut, err := svc.ListObjects(&s3.ListObjectsInput{
+	listOut, err := svc.ListObjects(ctx, &s3.ListObjectsInput{
 		Bucket: aws.String(repo),
 		Prefix: aws.String(mainBranch + "/"),
 	})
@@ -38,9 +38,9 @@ func TestDeleteObjects(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Len(t, listOut.Contents, numOfObjects)
 
-	deleteOut, err := svc.DeleteObjects(&s3.DeleteObjectsInput{
+	deleteOut, err := svc.DeleteObjects(ctx, &s3.DeleteObjectsInput{
 		Bucket: aws.String(repo),
-		Delete: &s3.Delete{
+		Delete: &types.Delete{
 			Objects: identifiers,
 		},
 	})
@@ -48,7 +48,7 @@ func TestDeleteObjects(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Len(t, deleteOut.Deleted, numOfObjects)
 
-	listOut, err = svc.ListObjects(&s3.ListObjectsInput{
+	listOut, err = svc.ListObjects(ctx, &s3.ListObjectsInput{
 		Bucket: aws.String(repo),
 		Prefix: aws.String(mainBranch + "/"),
 	})
@@ -81,27 +81,22 @@ func TestDeleteObjects_Viewer(t *testing.T) {
 
 	resCreateCreds, err := client.CreateCredentialsWithResponse(ctx, "del-viewer")
 	require.NoError(t, err, "Failed to create credentials")
-	require.Equal(t, http.StatusCreated, resCreateCreds.StatusCode(), "CreateCredentials unexpectedly status code")
+	require.NotNil(t, resCreateCreds.JSON201, "CreateCredentials unexpectedly empty response")
 
 	// client with viewer user credentials
-	creds := resCreateCreds.JSON201
-	newSession := session.Must(session.NewSession())
-	newConfig := aws.NewConfig()
-	newConfig.MergeIn(&svc.Config)
-	svcViewer := s3.New(newSession, newConfig.WithCredentials(
-		credentials.NewCredentials(
-			&credentials.StaticProvider{
-				Value: credentials.Value{
-					AccessKeyID:     creds.AccessKeyId,
-					SecretAccessKey: creds.SecretAccessKey,
-				},
-			})))
+	key := resCreateCreds.JSON201.AccessKeyId
+	secret := resCreateCreds.JSON201.SecretAccessKey
+	s3Endpoint := viper.GetString("s3_endpoint")
+	s3Client, err := testutil.SetupTestS3Client(s3Endpoint, key, secret)
+	require.NoError(t, err)
 
 	// delete objects using viewer
-	deleteOut, err := svcViewer.DeleteObjects(&s3.DeleteObjectsInput{
+	deleteOut, err := s3Client.DeleteObjects(ctx, &s3.DeleteObjectsInput{
 		Bucket: aws.String(repo),
-		Delete: &s3.Delete{
-			Objects: []*s3.ObjectIdentifier{{Key: apiutil.Ptr(mainBranch + "/" + filename)}},
+		Delete: &types.Delete{
+			Objects: []types.ObjectIdentifier{
+				{Key: aws.String(mainBranch + "/" + filename)},
+			},
 		},
 	})
 	// make sure we got an error we fail to delete the file
@@ -110,11 +105,11 @@ func TestDeleteObjects_Viewer(t *testing.T) {
 	assert.Len(t, deleteOut.Deleted, 0, "no file should be deleted")
 
 	// verify that viewer can't delete the file
-	listOut, err := svc.ListObjects(&s3.ListObjectsInput{
+	listOut, err := svc.ListObjects(ctx, &s3.ListObjectsInput{
 		Bucket: aws.String(repo),
 		Prefix: aws.String(mainBranch + "/"),
 	})
 	assert.NoError(t, err)
 	assert.Len(t, listOut.Contents, 1, "list should find 'delete-me' file")
-	assert.Equal(t, aws.StringValue(listOut.Contents[0].Key), mainBranch+"/"+filename)
+	assert.Equal(t, aws.ToString(listOut.Contents[0].Key), mainBranch+"/"+filename)
 }
diff --git a/esti/main_test.go b/esti/main_test.go
index 816d80f44eb..48d95fd9a1a 100644
--- a/esti/main_test.go
+++ b/esti/main_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/hashicorp/go-multierror"
 	"github.com/spf13/viper"
 	"github.com/treeverse/lakefs/pkg/api/apigen"
@@ -34,7 +34,7 @@ var (
 	logger      logging.Logger
 	client      apigen.ClientWithResponsesInterface
 	endpointURL string
-	svc         *s3.S3
+	svc         *s3.Client
 	server      *webhookServer
 
 	testDirectDataAccess = Booleans{false}
@@ -288,13 +288,12 @@ func TestMain(m *testing.M) {
 
 	setupLakeFS := viper.GetBool("setup_lakefs")
 	if !setupLakeFS && *cleanupEnv {
-		logger.
-			WithFields(logging.Fields{
-				"repositories": repositoriesToKeep,
-				"groups":       groupsToKeep,
-				"users":        usersToKeep,
-				"policies":     policiesToKeep,
-			}).Info("Deleting repositories, groups, users and policies before Esti run")
+		logger.WithFields(logging.Fields{
+			"repositories": repositoriesToKeep,
+			"groups":       groupsToKeep,
+			"users":        usersToKeep,
+			"policies":     policiesToKeep,
+		}).Info("Deleting repositories, groups, users and policies before Esti run")
 		err := envCleanup(client, repositoriesToKeep, groupsToKeep, usersToKeep, policiesToKeep)
 		if err != nil {
 			logger.WithError(err).Fatal("env cleanup")
diff --git a/esti/multipart_test.go b/esti/multipart_test.go
index 9f569c1e27a..dbbca738189 100644
--- a/esti/multipart_test.go
+++ b/esti/multipart_test.go
@@ -2,12 +2,16 @@ package esti
 
 import (
 	"bytes"
+	"context"
 	"net/http"
 	"sync"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/thanhpk/randstr"
@@ -30,7 +34,7 @@ func TestMultipartUpload(t *testing.T) {
 		Key:    aws.String(path),
 	}
 
-	resp, err := svc.CreateMultipartUpload(input)
+	resp, err := svc.CreateMultipartUpload(ctx, input)
 	require.NoError(t, err, "failed to create multipart upload")
 	logger.Info("Created multipart upload request")
 
@@ -41,12 +45,11 @@ func TestMultipartUpload(t *testing.T) {
 		partsConcat = append(partsConcat, parts[i]...)
 	}
 
-	completedParts := uploadMultipartParts(t, logger, resp, parts, 0)
-
-	completeResponse, err := uploadMultipartComplete(svc, resp, completedParts)
+	completedParts := uploadMultipartParts(t, ctx, logger, resp, parts, 0)
+	completeResponse, err := uploadMultipartComplete(ctx, svc, resp, completedParts)
 	require.NoError(t, err, "failed to complete multipart upload")
 
-	logger.WithField("key", aws.StringValue(completeResponse.Key)).Info("Completed multipart request successfully")
+	logger.WithField("key", aws.ToString(completeResponse.Key)).Info("Completed multipart request successfully")
 
 	getResp, err := client.GetObjectWithResponse(ctx, repo, mainBranch, &apigen.GetObjectParams{Path: file})
 	require.NoError(t, err, "failed to get object")
@@ -66,7 +69,7 @@ func TestMultipartUploadAbort(t *testing.T) {
 			Bucket: aws.String(repo),
 			Key:    aws.String(objPath),
 		}
-		createResp, err := svc.CreateMultipartUploadWithContext(ctx, createInput)
+		createResp, err := svc.CreateMultipartUpload(ctx, createInput)
 		require.NoError(t, err, "CreateMultipartUpload")
 
 		abortInput := &s3.AbortMultipartUploadInput{
@@ -74,8 +77,8 @@ func TestMultipartUploadAbort(t *testing.T) {
 			Key:      aws.String(objPath),
 			UploadId: createResp.UploadId,
 		}
-		_, err = svc.AbortMultipartUploadWithContext(ctx, abortInput)
-		require.NoError(t, err, "AbortMultipartUploadWithContext")
+		_, err = svc.AbortMultipartUpload(ctx, abortInput)
+		require.NoError(t, err, "AbortMultipartUpload")
 	})
 
 	t.Run("unknown_upload_id", func(t *testing.T) {
@@ -84,10 +87,10 @@ func TestMultipartUploadAbort(t *testing.T) {
 			Bucket: aws.String(repo),
 			Key:    aws.String(objPath),
 		}
-		createResp, err := svc.CreateMultipartUploadWithContext(ctx, createInput)
+		createResp, err := svc.CreateMultipartUpload(ctx, createInput)
 		require.NoError(t, err, "CreateMultipartUpload")
 
-		uploadID := aws.StringValue(createResp.UploadId)
+		uploadID := aws.ToString(createResp.UploadId)
 		// reverse the upload id to get valid unknown upload id
 		unknownUploadID := reverse(uploadID)
 
@@ -96,8 +99,8 @@ func TestMultipartUploadAbort(t *testing.T) {
 			Key:      aws.String(objPath),
 			UploadId: aws.String(unknownUploadID),
 		}
-		_, err = svc.AbortMultipartUploadWithContext(ctx, abortInput)
-		require.Error(t, err, "AbortMultipartUploadWithContext should fail with unknown upload id")
+		_, err = svc.AbortMultipartUpload(ctx, abortInput)
+		require.Error(t, err, "AbortMultipartUpload should fail with unknown upload id")
 	})
 
 	t.Run("unknown_key", func(t *testing.T) {
@@ -106,7 +109,7 @@ func TestMultipartUploadAbort(t *testing.T) {
 			Bucket: aws.String(repo),
 			Key:    aws.String(objPath),
 		}
-		createResp, err := svc.CreateMultipartUploadWithContext(ctx, createInput)
+		createResp, err := svc.CreateMultipartUpload(ctx, createInput)
 		require.NoError(t, err, "CreateMultipartUpload")
 
 		abortInput := &s3.AbortMultipartUploadInput{
@@ -114,8 +117,8 @@ func TestMultipartUploadAbort(t *testing.T) {
 			Key:      aws.String(mainBranch + "/unknown_file"),
 			UploadId: createResp.UploadId,
 		}
-		_, err = svc.AbortMultipartUploadWithContext(ctx, abortInput)
-		require.Error(t, err, "AbortMultipartUploadWithContext should fail with unknown key")
+		_, err = svc.AbortMultipartUpload(ctx, abortInput)
+		require.Error(t, err, "AbortMultipartUpload should fail with unknown key")
 	})
 }
 
@@ -127,9 +130,9 @@ func reverse(s string) string {
 	return string(runes)
 }
 
-func uploadMultipartParts(t *testing.T, logger logging.Logger, resp *s3.CreateMultipartUploadOutput, parts [][]byte, firstIndex int) []*s3.CompletedPart {
+func uploadMultipartParts(t *testing.T, ctx context.Context, logger logging.Logger, resp *s3.CreateMultipartUploadOutput, parts [][]byte, firstIndex int) []types.CompletedPart {
 	count := len(parts)
-	completedParts := make([]*s3.CompletedPart, count)
+	completedParts := make([]types.CompletedPart, count)
 	errs := make([]error, count)
 	var wg sync.WaitGroup
 	wg.Add(count)
@@ -137,52 +140,52 @@ func uploadMultipartParts(t *testing.T, logger logging.Logger, resp *s3.CreateMu
 		go func(i int) {
 			defer wg.Done()
 			partNumber := firstIndex + i + 1
-			completedParts[i], errs[i] = uploadMultipartPart(logger, svc, resp, parts[i], partNumber)
+			completedParts[i], errs[i] = uploadMultipartPart(ctx, logger, svc, resp, parts[i], partNumber)
 		}(i)
 	}
 	wg.Wait()
 
 	// verify upload completed successfully
 	for i, err := range errs {
-		partNumber := int64(firstIndex + i + 1)
+		partNumber := int32(firstIndex + i + 1)
 		assert.NoErrorf(t, err, "error while upload part number %d", partNumber)
 		// verify part number
-		assert.Equal(t, partNumber, *(completedParts[i].PartNumber), "inconsistent part number")
+		assert.Equal(t, partNumber, completedParts[i].PartNumber, "inconsistent part number")
 	}
 	return completedParts
 }
 
-func uploadMultipartComplete(svc *s3.S3, resp *s3.CreateMultipartUploadOutput, completedParts []*s3.CompletedPart) (*s3.CompleteMultipartUploadOutput, error) {
+func uploadMultipartComplete(ctx context.Context, svc *s3.Client, resp *s3.CreateMultipartUploadOutput, completedParts []types.CompletedPart) (*s3.CompleteMultipartUploadOutput, error) {
 	completeInput := &s3.CompleteMultipartUploadInput{
 		Bucket:   resp.Bucket,
 		Key:      resp.Key,
 		UploadId: resp.UploadId,
-		MultipartUpload: &s3.CompletedMultipartUpload{
+		MultipartUpload: &types.CompletedMultipartUpload{
 			Parts: completedParts,
 		},
 	}
-	return svc.CompleteMultipartUpload(completeInput)
+	return svc.CompleteMultipartUpload(ctx, completeInput)
 }
 
-func uploadMultipartPart(logger logging.Logger, svc *s3.S3, resp *s3.CreateMultipartUploadOutput, fileBytes []byte, partNumber int) (*s3.CompletedPart, error) {
+func uploadMultipartPart(ctx context.Context, logger logging.Logger, svc *s3.Client, resp *s3.CreateMultipartUploadOutput, fileBytes []byte, partNumber int) (types.CompletedPart, error) {
 	partInput := &s3.UploadPartInput{
 		Body:          bytes.NewReader(fileBytes),
 		Bucket:        resp.Bucket,
 		Key:           resp.Key,
-		PartNumber:    aws.Int64(int64(partNumber)),
+		PartNumber:    int32(partNumber),
 		UploadId:      resp.UploadId,
-		ContentLength: aws.Int64(int64(len(fileBytes))),
+		ContentLength: int64(len(fileBytes)),
 	}
 
-	uploadResult, err := svc.UploadPart(partInput)
+	uploadResult, err := svc.UploadPart(ctx, partInput)
 	if err != nil {
-		return nil, err
+		return types.CompletedPart{}, err
 	}
 
 	logger.WithField("partNumber", partNumber).Info("Uploaded part successfully")
 
-	return &s3.CompletedPart{
+	return types.CompletedPart{
 		ETag:       uploadResult.ETag,
-		PartNumber: aws.Int64(int64(partNumber)),
+		PartNumber: int32(partNumber),
 	}, nil
 }
diff --git a/esti/ugc_test.go b/esti/ugc_test.go
index 5d75280d59c..0e266495f60 100644
--- a/esti/ugc_test.go
+++ b/esti/ugc_test.go
@@ -14,9 +14,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/config"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/rs/xid"
 	"github.com/treeverse/lakefs/pkg/api/apigen"
 	"github.com/treeverse/lakefs/pkg/block"
@@ -236,10 +238,10 @@ func validateUncommittedGC(t *testing.T, durObjects []string) {
 	}
 
 	bucket, key := s3Adapter.ExtractParamsFromQK(qk)
-	s3Client := newDefaultS3Client()
+	s3Client := newDefaultS3Client(t)
 	runID := getLastUGCRunID(t, ctx, s3Client, bucket, key)
 	reportPath := fmt.Sprintf("%s_lakefs/retention/gc/uncommitted/%s/summary.json", key, runID)
-	cutoffTime, err := getReportCutoffTime(s3Client, bucket, reportPath)
+	cutoffTime, err := getReportCutoffTime(ctx, s3Client, bucket, reportPath)
 	if err != nil {
 		t.Fatalf("Failed to get start list time from ugc report %s", err)
 	}
@@ -284,17 +286,17 @@ func listRepositoryUnderlyingStorage(t *testing.T, ctx context.Context, repo str
 	}
 
 	bucket, key := s3Adapter.ExtractParamsFromQK(qk)
-	s3Client := newDefaultS3Client()
+	s3Client := newDefaultS3Client(t)
 	objects := listUnderlyingStorage(t, ctx, s3Client, bucket, key)
 	return objects, qk
 }
 
-func listUnderlyingStorage(t *testing.T, ctx context.Context, s3Client *s3.S3, bucket, prefix string) []Object {
+func listUnderlyingStorage(t *testing.T, ctx context.Context, s3Client *s3.Client, bucket, prefix string) []Object {
 	listInput := &s3.ListObjectsInput{
 		Bucket: aws.String(bucket),
 		Prefix: aws.String(prefix),
 	}
-	listOutput, err := s3Client.ListObjectsWithContext(ctx, listInput)
+	listOutput, err := s3Client.ListObjects(ctx, listInput)
 	if err != nil {
 		t.Fatalf("Failed to list objects (bucket: %s, prefix: %s): %s", bucket, prefix, err)
 	}
@@ -303,8 +305,8 @@ func listUnderlyingStorage(t *testing.T, ctx context.Context, s3Client *s3.S3, b
 	var objects []Object
 	for _, obj := range listOutput.Contents {
 		objects = append(objects, Object{
-			Key:          fmt.Sprintf("s3://%s/%s", bucket, aws.StringValue(obj.Key)),
-			LastModified: aws.TimeValue(obj.LastModified),
+			Key:          fmt.Sprintf("s3://%s/%s", bucket, aws.ToString(obj.Key)),
+			LastModified: aws.ToTime(obj.LastModified),
 		})
 	}
 	return objects
@@ -315,23 +317,25 @@ type Object struct {
 	LastModified time.Time
 }
 
-func newDefaultS3Client() *s3.S3 {
-	// setup new s3 client for direct access to the underlying storage
-	mySession := session.Must(session.NewSession())
-	s3Client := s3.New(mySession, aws.NewConfig().WithRegion("us-east-1"))
-	return s3Client
+// newDefaultS3Client setup new s3 client for direct access to the underlying storage
+func newDefaultS3Client(t *testing.T) *s3.Client {
+	cfg, err := config.LoadDefaultConfig(context.Background(), config.WithRegion("us-east-1"))
+	if err != nil {
+		t.Fatalf("Failed to create aws config: %s", err)
+	}
+	return s3.NewFromConfig(cfg)
 }
 
-func getLastUGCRunID(t *testing.T, ctx context.Context, s3Client *s3.S3, bucket, prefix string) string {
+func getLastUGCRunID(t *testing.T, ctx context.Context, s3Client *s3.Client, bucket, prefix string) string {
 	runIDPrefix := prefix + "_lakefs/retention/gc/uncommitted/"
 	listSize := int64(1)
 	listInput := &s3.ListObjectsInput{
 		Bucket:    aws.String(bucket),
 		Prefix:    aws.String(runIDPrefix),
 		Delimiter: aws.String("/"),
-		MaxKeys:   aws.Int64(listSize),
+		MaxKeys:   int32(listSize),
 	}
-	listOutput, err := s3Client.ListObjectsWithContext(ctx, listInput)
+	listOutput, err := s3Client.ListObjects(ctx, listInput)
 	if err != nil {
 		t.Fatalf("Failed to list objects (bucket: %s, prefix: %s): %s", bucket, runIDPrefix, err)
 	}
@@ -357,8 +361,8 @@ func uploadAndDeleteSafeTestData(t *testing.T, ctx context.Context, repository s
 	return addr
 }
 
-func getReportCutoffTime(s3Client *s3.S3, bucket, reportPath string) (time.Time, error) {
-	res, err := s3Client.GetObject(&s3.GetObjectInput{
+func getReportCutoffTime(ctx context.Context, s3Client *s3.Client, bucket, reportPath string) (time.Time, error) {
+	res, err := s3Client.GetObject(ctx, &s3.GetObjectInput{
 		Bucket: aws.String(bucket),
 		Key:    aws.String(reportPath),
 	})
diff --git a/go.mod b/go.mod
index 01cd535a325..82e7543aed1 100644
--- a/go.mod
+++ b/go.mod
@@ -1,15 +1,13 @@
 module github.com/treeverse/lakefs
 
-go 1.19
+go 1.20
 
 require (
 	cloud.google.com/go v0.110.0 // indirect
 	cloud.google.com/go/storage v1.28.1
 	github.com/apache/thrift v0.14.1
-	github.com/aws/aws-sdk-go v1.44.56
 	github.com/cockroachdb/pebble v0.0.0-20230106151110-65ff304d3d7a
 	github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8
-	github.com/cznic/mathutil v0.0.0-20180504122225-ca4c9f2c1369
 	github.com/davecgh/go-spew v1.1.1
 	github.com/deepmap/oapi-codegen v1.5.6
 	github.com/dgraph-io/ristretto v0.1.0
@@ -26,20 +24,18 @@ require (
 	github.com/hnlq715/golang-lru v0.3.0
 	github.com/jamiealquiza/tachymeter v2.0.0+incompatible
 	github.com/jedib0t/go-pretty/v6 v6.2.4
-	github.com/johannesboyne/gofakes3 v0.0.0-20210217223559-02ffa763be97
 	github.com/manifoldco/promptui v0.8.0
 	github.com/matoous/go-nanoid/v2 v2.0.0
-	github.com/minio/minio-go/v7 v7.0.13
+	github.com/minio/minio-go/v7 v7.0.34
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/ory/dockertest/v3 v3.10.0
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.16.0
-	github.com/rs/xid v1.2.1
+	github.com/rs/xid v1.4.0
 	github.com/schollz/progressbar/v3 v3.13.1
-	github.com/scritchley/orc v0.0.0-20201124122313-cba38e582ef9
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/cast v1.5.1
+	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.16.0
@@ -48,7 +44,7 @@ require (
 	github.com/tsenart/vegeta/v12 v12.8.4
 	github.com/vbauerster/mpb/v5 v5.4.0
 	github.com/xitongsys/parquet-go v1.6.0
-	github.com/xitongsys/parquet-go-source v0.0.0-20201108113611-f372b7d813be
+	github.com/xitongsys/parquet-go-source v0.0.0-20230607234618-40034c8066df
 	golang.org/x/crypto v0.11.0
 	golang.org/x/oauth2 v0.8.0
 	golang.org/x/term v0.10.0
@@ -74,6 +70,18 @@ require (
 	github.com/Shopify/go-lua v0.0.0-20221004153744-91867de107cf
 	github.com/alitto/pond v1.8.2
 	github.com/antonmedv/expr v1.12.5
+	github.com/aws/aws-sdk-go v1.43.31
+	github.com/aws/aws-sdk-go-v2 v1.21.0
+	github.com/aws/aws-sdk-go-v2/config v1.18.36
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.35
+	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.39
+	github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.4.66
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.80
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.21.5
+	github.com/aws/aws-sdk-go-v2/service/glue v1.61.2
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.38.5
+	github.com/aws/aws-sdk-go-v2/service/sts v1.21.5
+	github.com/aws/smithy-go v1.14.2
 	github.com/benburkert/dns v0.0.0-20190225204957-d356cf78cdfc
 	github.com/dgraph-io/badger/v3 v3.2103.2
 	github.com/georgysavva/scany/v2 v2.0.0
@@ -98,6 +106,20 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.2.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 // indirect
 	github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.42 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.15.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.35 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.13.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.5 // indirect
 	github.com/getsentry/sentry-go v0.16.0 // indirect
 	github.com/go-sql-driver/mysql v1.7.0 // indirect
 	github.com/golang/glog v1.1.0 // indirect
@@ -107,6 +129,7 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb // indirect
 	github.com/jackc/puddle/v2 v2.2.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.1.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77 // indirect
@@ -162,7 +185,6 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/juju/ansiterm v0.0.0-20180109212912-720a0952cc2a // indirect
 	github.com/klauspost/compress v1.15.14 // indirect
-	github.com/klauspost/cpuid v1.3.1 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/lunixbochs/vtclean v1.0.0 // indirect
@@ -172,8 +194,8 @@ require (
 	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/minio/md5-simd v1.1.0 // indirect
-	github.com/minio/sha256-simd v0.1.1 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
+	github.com/minio/sha256-simd v1.0.0 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -186,8 +208,6 @@ require (
 	github.com/prometheus/common v0.44.0 // indirect
 	github.com/prometheus/procfs v0.11.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 // indirect
-	github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63 // indirect
 	github.com/spf13/afero v1.9.5 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/subosito/gotenv v1.4.2 // indirect
@@ -198,7 +218,7 @@ require (
 	go.uber.org/atomic v1.11.0
 	golang.org/x/exp v0.0.0-20230725093048-515e97ebf090
 	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/net v0.12.0 // indirect
+	golang.org/x/net v0.12.0
 	golang.org/x/sys v0.10.0 // indirect
 	golang.org/x/text v0.11.0 // indirect
 	golang.org/x/tools v0.11.0 // indirect
diff --git a/go.sum b/go.sum
index c2d6147637f..5a70f3b7ad4 100644
--- a/go.sum
+++ b/go.sum
@@ -17,6 +17,20 @@ cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHOb
 cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
 cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
 cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
+cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
+cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
+cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
+cloud.google.com/go v0.82.0/go.mod h1:vlKccHJGuFBFufnAnuB08dfEH9Y3H7dzDzRECFdC2TA=
+cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
+cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
+cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
+cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
+cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
+cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
+cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
+cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
+cloud.google.com/go v0.100.1/go.mod h1:fs4QogzfH5n2pBXBP9vRiU+eCny7lD2vmFZy79Iuw1U=
+cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
 cloud.google.com/go v0.110.0 h1:Zc8gqp3+a9/Eyph2KDmcGaPtbKRIoqq4YTlL4NMD0Ys=
 cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@@ -25,57 +39,99 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
+cloud.google.com/go/compute v1.2.0/go.mod h1:xlogom/6gr8RJGBe7nT2eGsQYAFUbbv8dbC29qE3Xmw=
+cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJWM7YD99wM=
+cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
 cloud.google.com/go/compute v1.19.0 h1:+9zda3WGgW1ZSTlVppLCYFIr48Pa35q1uG2N1itbCEQ=
 cloud.google.com/go/compute v1.19.0/go.mod h1:rikpw2y+UMidAe9tISo04EHNOIf42RLYF/q8Bs93scU=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
+cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c=
+cloud.google.com/go/iam v0.1.1/go.mod h1:CKqrcnI/suGpybEHxZ7BMehL0oA4LpdyJdUlTl9jVMw=
+cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
 cloud.google.com/go/iam v0.13.0 h1:+CmB+K0J/33d0zSQ9SlFWUeCCEn5XJA0ZMZ3pHE9u8k=
 cloud.google.com/go/iam v0.13.0/go.mod h1:ljOg+rcNfzZ5d6f1nAUJ8ZIxOaZUVoS14bKCtaLZ/D0=
+cloud.google.com/go/kms v1.1.0/go.mod h1:WdbppnCDMDpOvoYBMn1+gNmOeEoZYqAv+HeuKARGCXI=
+cloud.google.com/go/kms v1.4.0/go.mod h1:fajBHndQ+6ubNw6Ss2sSd+SWvjL26RNo/dr7uxsnnOA=
 cloud.google.com/go/longrunning v0.4.1 h1:v+yFJOfKC3yZdY6ZUI933pIYdhyhV8S3NpWrXWmg7jM=
+cloud.google.com/go/monitoring v1.1.0/go.mod h1:L81pzz7HKn14QCMaCs6NTQkdBnE87TElyanS95vIcl4=
+cloud.google.com/go/monitoring v1.4.0/go.mod h1:y6xnxfwI3hTFWOdkOaD7nfJVlwuC3/mS/5kvtT131p4=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/pubsub v1.19.0/go.mod h1:/O9kmSe9bb9KRnIAWkzmqhPjHo6LtzGOBYd/kr06XSs=
+cloud.google.com/go/secretmanager v1.3.0/go.mod h1:+oLTkouyiYiabAQNugCeTS3PAArGiMJuBqvJnJsyH+U=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
+cloud.google.com/go/storage v1.21.0/go.mod h1:XmRlxkgPjlBONznT2dDUU/5XlpU2OjMnKuqnZI01LAA=
 cloud.google.com/go/storage v1.28.1 h1:F5QDG5ChchaAVQhINh24U99OWHURqrW8OmQcGKXcbgI=
 cloud.google.com/go/storage v1.28.1/go.mod h1:Qnisd4CqDdo6BGs2AD5LLnEsmSQ80wQ5ogcBBKhU86Y=
+cloud.google.com/go/trace v1.0.0/go.mod h1:4iErSByzxkyHWzzlAj63/Gmjz0NH1ASqhJguHpGcr6A=
+cloud.google.com/go/trace v1.2.0/go.mod h1:Wc8y/uYyOhPy12KEnXG9XGrvfMz5F5SrYecQlbW1rwM=
+contrib.go.opencensus.io/exporter/aws v0.0.0-20200617204711-c478e41e60e9/go.mod h1:uu1P0UCM/6RbsMrgPa98ll8ZcHM858i/AD06a9aLRCA=
+contrib.go.opencensus.io/exporter/stackdriver v0.13.10/go.mod h1:I5htMbyta491eUxufwwZPQdcKvvgzMB4O9ni41YnIM8=
+contrib.go.opencensus.io/integrations/ocsql v0.1.7/go.mod h1:8DsSdjz3F+APR+0z0WkU1aRorQCFfRxvqjUUPMbF3fE=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 github.com/AndreasBriese/bbloom v0.0.0-20190306092124-e2d15f34fcf9/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8=
-github.com/Azure/azure-pipeline-go v0.2.2/go.mod h1:4rQ/NZncSvGqNkkOsNpOU1tgoNuIlp9AfUH5G1tvCHc=
+github.com/Azure/azure-amqp-common-go/v3 v3.2.1/go.mod h1:O6X1iYHP7s2x7NjUKsXVhkwWrQhxrd+d8/3rRadj4CI=
+github.com/Azure/azure-amqp-common-go/v3 v3.2.2/go.mod h1:O6X1iYHP7s2x7NjUKsXVhkwWrQhxrd+d8/3rRadj4CI=
 github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
+github.com/Azure/azure-sdk-for-go v51.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/azure-sdk-for-go v59.3.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.0.0/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.1.1/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0 h1:rTnT/Jrcm+figWlYz4Ixzt0SJVR2cMC8lvZcimipiEY=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0/go.mod h1:ON4tFdPTwRcgWEaVDrN3584Ef+b7GgSJaXxe5fW9t4M=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.0.0/go.mod h1:+6sju8gk8FRmSajX3Oz4G5Gm7P+mbqE9FVaXXFYTkCM=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0 h1:QkAcEIAKbNL4KoFr4SathZPhDhF4mVwpBMFlYjyAqy8=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0/go.mod h1:bhXu1AjYL+wutSL/kpSq6s7733q2Rb0yuot9Zgfqa/0=
 github.com/Azure/azure-sdk-for-go/sdk/data/azcosmos v0.3.5 h1:qS0Bp4do0cIvnuQgSGeO6ZCu/q/HlRKl4NPfv1eJ2p0=
 github.com/Azure/azure-sdk-for-go/sdk/data/azcosmos v0.3.5/go.mod h1:Beh5cHIXJ0oWEDWk9lNFtuklCojLLQ5hl+LqSNTTs0I=
+github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.2.0 h1:leh5DwKv6Ihwi+h60uHtn6UWAxBbZ0q8DwQVMzf61zw=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.2.0/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.4.1/go.mod h1:eZ4g6GUvXiGulfIbbhh1Xr4XwUYaYaWMqzGD/284wCA=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.6.1 h1:YvQv9Mz6T8oR5ypQOL6erY0Z5t71ak1uHV4QFokCOZk=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.6.1/go.mod h1:c6WvOhtmjNUWbLfOG1qxM/q0SPvQNSVJvolm+C52dIU=
-github.com/Azure/azure-storage-blob-go v0.10.0/go.mod h1:ep1edmW+kNQx4UfWM9heESNmQdijykocJ0YOxmMX8SE=
+github.com/Azure/azure-service-bus-go v0.11.5/go.mod h1:MI6ge2CuQWBVq+ly456MY7XqNLJip5LO1iSFodbNLbU=
+github.com/Azure/azure-storage-blob-go v0.14.0/go.mod h1:SMqIBi+SuiQH32bvyjngEewEeXoPfKMgWlBDaYf6fck=
+github.com/Azure/go-amqp v0.16.0/go.mod h1:9YJ3RhxRT1gquYnzpZO1vcYMMpAdJT+QEg6fwmw9Zlg=
+github.com/Azure/go-amqp v0.16.4/go.mod h1:9YJ3RhxRT1gquYnzpZO1vcYMMpAdJT+QEg6fwmw9Zlg=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
-github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
-github.com/Azure/go-autorest/autorest/adal v0.8.3/go.mod h1:ZjhuQClTqx435SRJ2iMlOxPYt3d2C/T/7TiQCVZSn3Q=
-github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
-github.com/Azure/go-autorest/autorest/date v0.2.0/go.mod h1:vcORJHLJEh643/Ioh9+vPmf1Ij9AEBM5FuBIXLmIy0g=
-github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
-github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
-github.com/Azure/go-autorest/autorest/mocks v0.3.0/go.mod h1:a8FDP3DYzQ4RYfVAxAN3SVSiiO77gL2j2ronKKP0syM=
-github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
-github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
+github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
+github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
+github.com/Azure/go-autorest/autorest v0.11.19/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
+github.com/Azure/go-autorest/autorest v0.11.22/go.mod h1:BAWYUWGPEtKPzjVkp0Q6an0MJcJDsoh5Z1BFAEFs4Xs=
+github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
+github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
+github.com/Azure/go-autorest/autorest/adal v0.9.14/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
+github.com/Azure/go-autorest/autorest/adal v0.9.17/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
+github.com/Azure/go-autorest/autorest/azure/auth v0.5.9/go.mod h1:hg3/1yw0Bq87O3KvvnJoAh34/0zbP7SFizX/qN5JvjU=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.2/go.mod h1:7qkJkT+j6b+hIpzMOwPChJhTqS8VbsqqgULzMNRugoM=
+github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
+github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
+github.com/Azure/go-autorest/autorest/validation v0.3.1/go.mod h1:yhLgjC0Wda5DYXl6JAsWyUe4KVNffhoDhG0zVzUMo3E=
+github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
+github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
+github.com/AzureAD/microsoft-authentication-library-for-go v0.4.0/go.mod h1:Vt9sXTKwMyGcOxSmLDMnGPgqsUg7m8pe215qMLrDXw4=
+github.com/AzureAD/microsoft-authentication-library-for-go v0.5.1/go.mod h1:Vt9sXTKwMyGcOxSmLDMnGPgqsUg7m8pe215qMLrDXw4=
 github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 h1:VgSJlZH5u0k2qxSpqyghcFQKmvYckj46uymKK5XzkBM=
 github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0/go.mod h1:BDJ5qMFKx9DugEg3+uQSDCdbYPr5s9vBTrL9P8TpqOU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -88,10 +144,12 @@ github.com/CloudyKit/jet v2.1.3-0.20180809161101-62edd43e4f88+incompatible/go.mo
 github.com/CloudyKit/jet/v3 v3.0.0/go.mod h1:HKQPgSJmdK8hdoAbKUUWajkHyHo4RaU5rMdUywE7VMo=
 github.com/DataDog/zstd v1.5.2 h1:vUG4lAyuPCXO0TLbXvPv7EB7cNK1QV/luu55UHLrrn8=
 github.com/DataDog/zstd v1.5.2/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
+github.com/GoogleCloudPlatform/cloudsql-proxy v1.29.0/go.mod h1:spvB9eLJH9dutlbPSRmHvSXXHOwGRyeXh1jVdquA2G8=
 github.com/IBM/pgxpoolprometheus v1.1.1 h1:xkWNUe87TIuBj/ypdSiDgNYktsuM7MoZCT8a+kjhh2s=
 github.com/IBM/pgxpoolprometheus v1.1.1/go.mod h1:GFJDkHbidFfB2APbhBTSy2X4PKH3bLWsEMBhmzK1ipo=
 github.com/Joker/hpp v1.0.0/go.mod h1:8x5n+M1Hp5hC0g8okX3sR3vFQwynaX/UgSOM9MeBKzY=
 github.com/Joker/jade v1.0.1-0.20190614124447-d475f43051e7/go.mod h1:6E6s8o2AE4KhCrqr6GRJjdC/gNfTdxkIXvuGZZda2VM=
+github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
@@ -120,23 +178,100 @@ github.com/apache/thrift v0.13.1-0.20201008052519-daf620915714/go.mod h1:cp2SuWM
 github.com/apache/thrift v0.14.1 h1:Yh8v0hpCj63p5edXOLaqTJW0IJ1p+eMW6+YSOqw1d6s=
 github.com/apache/thrift v0.14.1/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
-github.com/aws/aws-sdk-go v1.17.4/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
+github.com/aws/aws-sdk-go v1.15.27/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
 github.com/aws/aws-sdk-go v1.30.19/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
-github.com/aws/aws-sdk-go v1.44.56 h1:bT+lExwagH7djxb6InKUVkEKGPAj5aAPnV85/m1fKro=
-github.com/aws/aws-sdk-go v1.44.56/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go v1.37.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
+github.com/aws/aws-sdk-go v1.43.31 h1:yJZIr8nMV1hXjAvvOLUFqZRJcHV7udPQBfhJqawDzI0=
+github.com/aws/aws-sdk-go v1.43.31/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go-v2 v1.16.2/go.mod h1:ytwTPBG6fXTZLxxeeCCWj2/EMYp/xDUgX+OET6TLNNU=
+github.com/aws/aws-sdk-go-v2 v1.20.3/go.mod h1:/RfNgGmRxI+iFOB1OeJUyxiU+9s88k3pfHvDagGEp0M=
+github.com/aws/aws-sdk-go-v2 v1.21.0 h1:gMT0IW+03wtYJhRqTVYn0wLzwdnK9sRMcxmtfGzRdJc=
+github.com/aws/aws-sdk-go-v2 v1.21.0/go.mod h1:/RfNgGmRxI+iFOB1OeJUyxiU+9s88k3pfHvDagGEp0M=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.1/go.mod h1:n8Bs1ElDD2wJ9kCRTczA83gYbBmjSwZp3umc6zF4EeM=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13 h1:OPLEkmhXf6xFPiz0bLeDArZIDx1NNS4oJyG4nv3Gct0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13/go.mod h1:gpAbvyDGQFozTEmlTFO8XcQKHzubdq0LzRyJpG6MiXM=
+github.com/aws/aws-sdk-go-v2/config v1.15.3/go.mod h1:9YL3v07Xc/ohTsxFXzan9ZpFpdTOFl4X65BAKYaz8jg=
+github.com/aws/aws-sdk-go-v2/config v1.18.36 h1:mLNA12PWU1Y+ueOO79QgQfKIPhc1MYKl44RmvASkJ7Q=
+github.com/aws/aws-sdk-go-v2/config v1.18.36/go.mod h1:8AnEFxW9/XGKCbjYDCJy7iltVNyEI9Iu9qC21UzhhgQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.11.2/go.mod h1:j8YsY9TXTm31k4eFhspiQicfXPLZ0gYXA50i4gxPE8g=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.35 h1:QpsNitYJu0GgvMBLUIYu9H4yryA5kMksjeIVQfgXrt8=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.35/go.mod h1:o7rCaLtvK0hUggAGclf76mNGGkaG5a9KWlp+d9IpcV8=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.39 h1:DX/r3aNL7pIVn0K5a+ESL0Fw9ti7Rj05pblEiIJtPmQ=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.39/go.mod h1:oTk09orqXlwSKnKf+UQhy+4Ci7aCo9x8hn0ZvPCLrns=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.4.66 h1:DFYIZszf0vsrvC5JjiEK7cmY1sILFF8GlJNJsAMewGc=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.4.66/go.mod h1:G8zHK3ouHuARBTgMjv5e4QvR9qFtujU5cewhDks4vm0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.3/go.mod h1:uk1vhHHERfSVCUnqSqz8O48LBYDSC+k6brng09jcMOk=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11 h1:uDZJF1hu0EVT/4bogChk8DyjSF6fof6uL/0Y26Ma7Fg=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11/go.mod h1:TEPP4tENqBGO99KwVpV9MlOX4NSrSLP8u3KRy2CDwA8=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.3/go.mod h1:0dHuD2HZZSiwfJSy1FO5bX1hQ1TxVV1QXXjpn3XUE44=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.80 h1:UrlTIXE+X+u/680ZIPkuM5QYg1D5+bWjlOGlOfHCptU=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.80/go.mod h1:57ALQch4qLc5kVWTHloB61HfmMc8ZlAgia3xEO2Bolc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.9/go.mod h1:AnVH5pvai0pAF4lXRq0bmhbes1u9R8wTE+g+183bZNM=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.40/go.mod h1:5kKmFhLeOVy6pwPDpDNA6/hK/d6URC98pqDDqHgdBx4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41 h1:22dGT7PneFMx4+b3pz7lMTRyN8ZKH7M2cW4GP9yUS2g=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41/go.mod h1:CrObHAuPneJBlfEJ5T3szXOUkLEThaGfvnhTf33buas=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.3/go.mod h1:ssOhaLpRlh88H3UmEcsBoVKq309quMvm3Ds8e9d4eJM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.34/go.mod h1:RZP0scceAyhMIQ9JvFp7HvkpcgqjL4l/4C+7RAeGbuM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35 h1:SijA0mgjV8E+8G45ltVHs0fvKpTj8xmZJ3VwhGKtUSI=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35/go.mod h1:SJC1nEVVva1g3pHAIdCp7QsRIkMmLAgoDquQ9Rr8kYw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.10/go.mod h1:8DcYQcz0+ZJaSxANlHIsbbi6S+zMwjwdDqwW3r9AzaE=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.42 h1:GPUcE/Yq7Ur8YSUk6lVkoIMWnJNO0HT18GUzCWCgCI0=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.42/go.mod h1:rzfdUlfA+jdgLDmPKjd3Chq9V7LVLYo1Nz++Wb91aRo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4 h1:6lJvvkQ9HmbHZ4h/IEwclwv2mrTW8Uq1SOB/kXy0mfw=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4/go.mod h1:1PrKYwxTM+zjpw9Y41KFtoJCQrJ34Z47Y4VgVbfndjo=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.21.5 h1:EeNQ3bDA6hlx3vifHf7LT/l9dh9w7D2XgCdaD11TRU4=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.21.5/go.mod h1:X3ThW5RPV19hi7bnQ0RMAiBjZbzxj4rZlj+qdctbMWY=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.15.5 h1:xoalM/e1YsT6jkLKl6KA9HUiJANwn2ypJsM9lhW2WP0=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.15.5/go.mod h1:7QtKdGj66zM4g5hPgxHRQgFGLGal4EgwggTw5OZH56c=
+github.com/aws/aws-sdk-go-v2/service/glue v1.61.2 h1:RvjHFsrOKPAWhFCqI4e3aVnL5aAvc2DSa0PR/simTnc=
+github.com/aws/aws-sdk-go-v2/service/glue v1.61.2/go.mod h1:sgxCKVpTicr8N9fbV27u5Qcd+tF0k6z/SloLqoWeFac=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.1/go.mod h1:GeUru+8VzrTXV/83XyMJ80KpH8xO89VPoUileyNQ+tc=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14 h1:m0QTSI6pZYJTk5WSKx3fm5cNW/DCicVzULBgU/6IyD0=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14/go.mod h1:dDilntgHy9WnHXsh7dDtUPgHKEfTJIBUTHM8OWm0f/0=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.3/go.mod h1:Seb8KNmD6kVTjwRjVEgOT5hPin6sq+v4C2ycJQDwuH8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36 h1:eev2yZX7esGRjqRbnVk1UxMLw4CyVZDpZXRCcy75oQk=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36/go.mod h1:lGnOkH9NJATw0XEPcAknFBj3zzNTEGRHtSw+CwC1YTg=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.35 h1:UKjpIDLVF90RfV88XurdduMoTxPqtGHZMIDYZQM7RO4=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.35/go.mod h1:B3dUg0V6eJesUTi+m27NUkj7n8hdDKYUpxj8f4+TqaQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.3/go.mod h1:wlY6SVjuwvh3TVRpTqdy4I1JpBFLX4UGeKZdWntaocw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35 h1:CdzPW9kKitgIiLV1+MHobfR5Xg25iYnyzWZhyQuSlDI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35/go.mod h1:QGF2Rs33W5MaN9gYdEQOBBFPLwTZkEhRwI33f7KIG0o=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.3/go.mod h1:Bm/v2IaN6rZ+Op7zX+bOUMdL4fsrYZiD0dsjLhNKwZc=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4 h1:v0jkRigbSD6uOdwcaUQmgEwG1BkPfAPDqaeNt/29ghg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4/go.mod h1:LhTyt8J04LL+9cIt7pYJ5lbS/U98ZmXovLOR/4LUsk8=
+github.com/aws/aws-sdk-go-v2/service/kms v1.16.3/go.mod h1:QuiHPBqlOFCi4LqdSskYYAWpQlx3PKmohy+rE2F+o5g=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.26.3/go.mod h1:g1qvDuRsJY+XghsV6zg00Z4KJ7DtFFCx8fJD2a491Ak=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.38.5 h1:A42xdtStObqy7NGvzZKpnyNXvoOmm+FENobZ0/ssHWk=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.38.5/go.mod h1:rDGMZA7f4pbmTtPOk5v5UM2lmX6UAbRnMDJeDvnH7AM=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.15.4/go.mod h1:PJc8s+lxyU8rrre0/4a0pn2wgwiDvOEzoOjcJUBr67o=
+github.com/aws/aws-sdk-go-v2/service/sns v1.17.4/go.mod h1:kElt+uCcXxcqFyc+bQqZPFD9DME/eC6oHBXvFzQ9Bcw=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.18.3/go.mod h1:skmQo0UPvsjsuYYSYMVmrPc1HWCbHUJyrCEp+ZaLzqM=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.24.1/go.mod h1:NR/xoKjdbRJ+qx0pMR4mI+N/H1I1ynHwXnO6FowXJc0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.11.3/go.mod h1:7UQ/e69kU7LDPtY40OyoHYgRmgfGM4mgsLYtcObdveU=
+github.com/aws/aws-sdk-go-v2/service/sso v1.13.5 h1:oCvTFSDi67AX0pOX3PuPdGFewvLRU2zzFSrTsgURNo0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.13.5/go.mod h1:fIAwKQKBFu90pBxx07BFOMJLpRUGu8VOzLJakeY+0K4=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.5 h1:dnInJb4S0oy8aQuri1mV6ipLlnZPfnsDNB9BGO9PDNY=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.5/go.mod h1:yygr8ACQRY2PrEcy3xsUI357stq2AxnFM6DIsR9lij4=
+github.com/aws/aws-sdk-go-v2/service/sts v1.16.3/go.mod h1:bfBj0iVmsUyUg4weDB4NxktD9rDGeKSVWnjTnwbx9b8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.21.5 h1:CQBFElb0LS8RojMJlxRSo/HXipvTZW2S44Lt9Mk2aYQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.21.5/go.mod h1:VC7JDqsqiwXukYEDjoHh9U0fOJtNWh04FPQz4ct4GGU=
+github.com/aws/smithy-go v1.11.2/go.mod h1:3xHYmszWVx2c0kIwQeEVf9uSm4fYZt67FBJnwub1bgM=
+github.com/aws/smithy-go v1.14.2 h1:MJU9hqBGbvWZdApzpvoF2WAIJDbtjK2NDJSiJP7HblQ=
+github.com/aws/smithy-go v1.14.2/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/aymerick/raymond v2.0.3-0.20180322193309-b565731e1464+incompatible/go.mod h1:osfaiScAUVup+UC9Nfq76eWqDhXlp+4UYaA8uhTBO6g=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benburkert/dns v0.0.0-20190225204957-d356cf78cdfc h1:eyDlmf21vuKN61WoxV2cQLDH/PBDyyjIhUI4kT2o1yM=
 github.com/benburkert/dns v0.0.0-20190225204957-d356cf78cdfc/go.mod h1:6ul4nJKqsreAIBK5lUkibcUn2YBU6CvDzlKDH+dtZsQ=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b h1:AP/Y7sqYicnjGDfD5VcY4CIfh1hRXBUavxrvELjTiOE=
 github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b/go.mod h1:ac9efd0D1fsDb3EJvhqgXRbFx7bs2wqZ10HQPeU8U/Q=
-github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/c2h5oh/datasize v0.0.0-20171227191756-4eba002a5eae/go.mod h1:S/7n9copUssQ56c7aAgHqftWO4LTf4xY6CGWt8Bc+3M=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -153,9 +288,11 @@ github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGX
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
 github.com/cockroachdb/cockroach-go/v2 v2.2.0 h1:/5znzg5n373N/3ESjHF5SMLxiW4RKB05Ql//KWfeTFs=
 github.com/cockroachdb/datadriven v1.0.1-0.20211007161720-b558070c3be0/go.mod h1:5Ib8Meh+jk1RlHIXej6Pzevx/NLlNvQB9pmSBZErGA4=
 github.com/cockroachdb/datadriven v1.0.1-0.20220214170620-9913f5bc19b7/go.mod h1:hi0MtSY3AYDQNDi83kDkMH5/yqM/CsIrsOITkSoH7KI=
@@ -179,20 +316,24 @@ github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1A
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
-github.com/cznic/mathutil v0.0.0-20180504122225-ca4c9f2c1369 h1:XNT/Zf5l++1Pyg08/HV04ppB0gKxAqtZQBRYiYrUuYk=
-github.com/cznic/mathutil v0.0.0-20180504122225-ca4c9f2c1369/go.mod h1:e6NPNENfs9mPDVNRekM7lKScauxd5kXTr1Mfyig6TDM=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/deepmap/oapi-codegen v1.5.6 h1:hlUtA13SL2HNoC/5vXDFdGm2AaN1j9/rUu7zedjBiqg=
 github.com/deepmap/oapi-codegen v1.5.6/go.mod h1:NoliSkZp7cRAkisw65+PUtvgy56f21QQesX1tVUzS8g=
+github.com/denisenkom/go-mssqldb v0.12.0/go.mod h1:iiK0YP1ZeepvmBQk/QpLEhhTNJgfzrpArPY/aFvc9yU=
+github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
 github.com/dgraph-io/badger v1.6.0/go.mod h1:zwt7syl517jmP8s94KqSxTlM6IMsdhYy6psNgSztDR4=
 github.com/dgraph-io/badger/v3 v3.2103.2 h1:dpyM5eCJAtQCBcMCZcT4UBZchuTJgCywerHHgmxfxM8=
 github.com/dgraph-io/badger/v3 v3.2103.2/go.mod h1:RHo4/GmYcKKh5Lxu63wLEMHJ70Pac2JqZRYGhlyAo2M=
@@ -205,7 +346,11 @@ github.com/dgryski/go-gk v0.0.0-20140819190930-201884a44051/go.mod h1:qm+vckxRlD
 github.com/dgryski/go-gk v0.0.0-20200319235926-a69029f61654 h1:XOPLOMn/zT4jIgxfxSsoXPxkrzz0FaCHwp33x5POJ+Q=
 github.com/dgryski/go-gk v0.0.0-20200319235926-a69029f61654/go.mod h1:qm+vckxRlDt0aOla0RYJJVeqHZlWfOm2UIxHaqPB46E=
 github.com/dgryski/go-lttb v0.0.0-20180810165845-318fcdf10a77/go.mod h1:Va5MyIzkU0rAM92tn3hb3Anb7oz7KcnixF49+2wOMe4=
-github.com/dnaeon/go-vcr v1.1.0 h1:ReYa/UBrRyQdant9B4fNHGoCNKw6qh6P0fsdGmZpR7c=
+github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
+github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
+github.com/dnaeon/go-vcr v1.1.0/go.mod h1:M7tiix8f0r6mKKJ3Yq/kqU1OYf3MnfmBWVbPx/yU9ko=
+github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
 github.com/docker/cli v23.0.6+incompatible h1:CScadyCJ2ZKUDpAMZta6vK8I+6/m60VIjGIV7Wg/Eu4=
 github.com/docker/cli v23.0.6+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker v23.0.6+incompatible h1:aBD4np894vatVX99UTx/GyOUOK4uEcROwA3+bQhEcoU=
@@ -223,6 +368,7 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/etcd-io/bbolt v1.3.3/go.mod h1:ZF2nL25h33cCyBtcyWeZ2/I3HQOfTP+0PIEvHjkjCrw=
@@ -234,9 +380,12 @@ github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga
 github.com/flosch/pongo2 v0.0.0-20190707114632-bbf5a6c351f4/go.mod h1:T9YF2M40nIgbVgp3rreNmTged+9HrbNTIQf1PsaIiTA=
 github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/fzipp/gocyclo v0.3.1/go.mod h1:DJHO6AUmbdqj2ET4Z9iArSuwWgYDRryYt2wASxc7x3E=
@@ -252,7 +401,10 @@ github.com/getsentry/sentry-go v0.16.0/go.mod h1:ZXCloQLj0pG7mja5NK6NPf2V4A88YJ4
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/sse v0.0.0-20190301062529-5545eab6dad3/go.mod h1:VJ0WA2NBN22VlZ2dKZQPAPnyWw5XTlK1KymzLKsr59s=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.4.0/go.mod h1:OW2EZn3DO8Ln9oIKOvM++LBO+5UPHJJDH72/q/3rZdM=
+github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
+github.com/gin-gonic/gin v1.7.3/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY=
 github.com/go-check/check v0.0.0-20180628173108-788fd7840127/go.mod h1:9ES+weclKsC9YodN5RgxqK/VD9HM9JsCSh7rNhMZE98=
 github.com/go-chi/chi/v5 v5.0.0 h1:DBPx88FjZJH3FsICfDAfIfnb7XxKIYVGG6lOPlhENAg=
 github.com/go-chi/chi/v5 v5.0.0/go.mod h1:BBug9lr0cqtdAhsu6R4AAdvufI0/XBzAQSsUqJpoZOs=
@@ -267,16 +419,26 @@ github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmn
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-ini/ini v1.25.4/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab/go.mod h1:/P9AEU963A2AYjv4d1V5eVL1CQbEJq6aCNHDDjibzu8=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng=
 github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
+github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
+github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
+github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc=
 github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M=
 github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
@@ -284,7 +446,9 @@ github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJA
 github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
 github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
+github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/googleapis v0.0.0-20180223154316-0cd9801be74a/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
 github.com/gogo/googleapis v1.4.1/go.mod h1:2lpHqI5OcWCtVElxXnPt+s8oJvMpySlOyM6xDCrzib4=
 github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -292,10 +456,16 @@ github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXP
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gogo/status v1.1.0/go.mod h1:BFv9nrluPLmrS0EmGVvLaPNmRosr9KapBYd5/hpY1WM=
+github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
+github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
+github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
+github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.4.3 h1:Hxl6lhQFj4AnOX6MLrsCb/+7tCj7DxP7VA+2rDIq5AU=
 github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/sqlexp v0.0.0-20170517235910-f1bb20e5a188/go.mod h1:vXjM/+wXQnTPR4KqTKDgJukSZ6amVRtWMPEjE6sQoK8=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
@@ -312,6 +482,7 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -330,6 +501,7 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
@@ -365,15 +537,23 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
+github.com/google/go-replayers/grpcreplay v1.1.0/go.mod h1:qzAvJ8/wi57zq7gWqaE6AwLM6miiXUQwP1S+I9icmhk=
+github.com/google/go-replayers/httpreplay v1.1.1/go.mod h1:gN9GeLIs7l6NUoVaSSnv2RiqK1NiwAmD0MrKeC9IIks=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/martian v2.1.1-0.20190517191504-25dcb96d9e51+incompatible h1:xmapqc1AyLoB+ddYT6r04bD9lIjlOqGaREovi0SzFaE=
+github.com/google/martian v2.1.1-0.20190517191504-25dcb96d9e51+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
+github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -384,19 +564,31 @@ github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210506205249-923b5ab0fc1a/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.3 h1:FAgZmpLl/SXurPEZyCMPBIiiYeTbqfjlbdnCNTAkbGE=
 github.com/google/s2a-go v0.1.3/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/wire v0.5.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
 github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9aurXEpJX+U6FLtpYTdC3R06k=
 github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
+github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
+github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
 github.com/googleapis/gax-go/v2 v2.8.0 h1:UBtEZqx1bjXtOQ5BVTkuYghXrr3N4V123VKJK67vJZc=
 github.com/googleapis/gax-go/v2 v2.8.0/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38/qKbhSAKP6QI=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
@@ -409,6 +601,8 @@ github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/z
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/hanwen/go-fuse v1.0.0/go.mod h1:unqXarDXqzAk0rt98O2tVndEPIpUgLD9+rwFisZH3Ok=
+github.com/hanwen/go-fuse/v2 v2.1.0/go.mod h1:oRyA5eK+pvJyv5otpO/DgccS8y/RvYMaO00GgRLGryc=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -455,12 +649,49 @@ github.com/iris-contrib/i18n v0.0.0-20171121225848-987a633949d0/go.mod h1:pMCz62
 github.com/iris-contrib/jade v1.1.3/go.mod h1:H/geBymxJhShH5kecoiOCSssPX7QWYH7UaeZTSWddIk=
 github.com/iris-contrib/pongo2 v0.0.1/go.mod h1:Ssh+00+3GAZqSQb30AvBRNxBx7rf0GqwkjqxNd0u65g=
 github.com/iris-contrib/schema v0.0.1/go.mod h1:urYA3uvUNG1TIIjOSCzHr9/LmbQo8LrOcOqfqxa4hXw=
+github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
+github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
+github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
+github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
+github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
+github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
+github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
+github.com/jackc/pgconn v1.11.0/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
+github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
+github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
+github.com/jackc/pgmock v0.0.0-20201204152224-4fe30f7445fd/go.mod h1:hrBW0Enj2AZTNpt/7Y5rr2xe/9Mn757Wtb2xeBzPv2c=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.2.0/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
+github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
+github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
+github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
+github.com/jackc/pgtype v1.10.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
+github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
+github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
+github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
+github.com/jackc/pgx/v4 v4.15.0/go.mod h1:D/zyOyXiaM1TmVWnOM18p0xdDtdakRBa0RsVGI3U3bw=
 github.com/jackc/pgx/v5 v5.3.1 h1:Fcr8QJ1ZeLi5zsPZqQeUZhNhxfkkKBOgJuYkJHoBOtU=
 github.com/jackc/pgx/v5 v5.3.1/go.mod h1:t3JDKnCBlYIc0ewLF0Q7B8MXmoIaBOZj/ic7iHozM/8=
+github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.2.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle/v2 v2.2.0 h1:RdcDk92EJBuBS55nQMMYFXTxwstHug4jkhT5pq8VxPk=
 github.com/jackc/puddle/v2 v2.2.0/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jamiealquiza/tachymeter v2.0.0+incompatible h1:mGiF1DGo8l6vnGT8FXNNcIXht/YmjzfraiUprXYwJ6g=
@@ -469,19 +700,17 @@ github.com/jcmturner/gofork v0.0.0-20180107083740-2aebee971930/go.mod h1:MK8+TM0
 github.com/jedib0t/go-pretty/v6 v6.2.4 h1:wdaj2KHD2W+mz8JgJ/Q6L/T5dB7kyqEFI16eLq7GEmk=
 github.com/jedib0t/go-pretty/v6 v6.2.4/go.mod h1:+nE9fyyHGil+PuISTCrp7avEdo6bqoMwqZnuiK2r2a0=
 github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
-github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/johannesboyne/gofakes3 v0.0.0-20210217223559-02ffa763be97 h1:HmtrCKYPylfghNFL/VYQo/Eq82ErJDyZPd8kP5EEwUA=
-github.com/johannesboyne/gofakes3 v0.0.0-20210217223559-02ffa763be97/go.mod h1:J4FxOevfdoOz0ZKqoWO3l2QSQqrNpWLBRQCxU/t8R00=
+github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
@@ -511,23 +740,32 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.8.2/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.9.0/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.9.7/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
+github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.10.5/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
+github.com/klauspost/compress v1.15.1/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
 github.com/klauspost/compress v1.15.14 h1:i7WCKDToww0wA+9qrUZ1xOjp218vfFo3nTU6UHp+gOc=
 github.com/klauspost/compress v1.15.14/go.mod h1:QPwzmACJjUTFsnSHH934V6woptycfrDDJnH7hvFVbGM=
 github.com/klauspost/cpuid v1.2.1/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
-github.com/klauspost/cpuid v1.2.3/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
-github.com/klauspost/cpuid v1.3.1 h1:5JNjFYYQrZeKRJ0734q51WCEEn2huer72Dc7K+R/b6s=
-github.com/klauspost/cpuid v1.3.1/go.mod h1:bYW4mA6ZgKPob1/Dlai2LviZJO7KGI3uoWLd42rAQw4=
+github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.1.0 h1:eyi1Ad2aNJMW95zcSbmGg7Cg6cq3ADwLpMAP96d8rF0=
+github.com/klauspost/cpuid/v2 v2.1.0/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/labstack/echo/v4 v4.1.11/go.mod h1:i541M3Fj6f76NZtHSj7TXnyM8n2gaodfvfxNnFqi74g=
@@ -536,6 +774,12 @@ github.com/labstack/echo/v4 v4.5.0/go.mod h1:czIriw4a0C1dFun+ObrXp7ok03xON0N1awS
 github.com/labstack/echo/v4 v4.9.0 h1:wPOF1CE6gvt/kmbMR4dGzWvHMPT+sAEUJOwOTtvITVY=
 github.com/labstack/gommon v0.3.0/go.mod h1:MULnywXg0yavhxWKc+lOruYdAhDwPK9wf0OL7NoOu+k=
 github.com/labstack/gommon v0.3.1 h1:OomWaJXm7xR6L1HmEtGyQf26TEn7V6X88mktX9kee9o=
+github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
+github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.4/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lunixbochs/vtclean v0.0.0-20180621232353-2d01aacdc34a/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
@@ -557,16 +801,18 @@ github.com/matoous/go-nanoid/v2 v2.0.0 h1:d19kur2QuLeHmJBkvYkFdhFBzLoo1XVm2GgTpL
 github.com/matoous/go-nanoid/v2 v2.0.0/go.mod h1:FtS4aGPVfEkxKxhdWPAspZpZSh1cOjtM7Ej/So3hR0g=
 github.com/matryer/moq v0.0.0-20190312154309-6cfb0558e1bd/go.mod h1:9ELz6aaclSIGnZBoaSLZ3NAl1VTufbOrXBPvtcy6WiQ=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.7/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.11/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-ieproxy v0.0.0-20190702010315-6dee0af9227d/go.mod h1:31jz6HNzdxOmlERGGEc4v/dMssOfmp2p5bT/okiKFFc=
 github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
@@ -589,12 +835,12 @@ github.com/mediocregopher/radix/v3 v3.3.0/go.mod h1:EmfVyvspXz1uZEyPBMyGK+kjWiKQ
 github.com/mediocregopher/radix/v3 v3.4.2/go.mod h1:8FL3F6UQRXHXIBSPUs5h0RybMF8i4n7wVopoX3x7Bv8=
 github.com/microcosm-cc/bluemonday v1.0.2/go.mod h1:iVP4YcDBq+n/5fb23BhYFvIMq/leAFZyRl6bYmGDlGc=
 github.com/miekg/dns v1.1.17/go.mod h1:WgzbA6oji13JREwiNsRDNfl7jYdPnmz+VEuLrA+/48M=
-github.com/minio/md5-simd v1.1.0 h1:QPfiOqlZH+Cj9teu0t9b1nTBfPbyTl16Of5MeuShdK4=
-github.com/minio/md5-simd v1.1.0/go.mod h1:XpBqgZULrMYD3R+M28PcmP0CkI7PEMzB3U77ZrKZ0Gw=
-github.com/minio/minio-go/v7 v7.0.13 h1:rYCca0+8ciW4wFY/vsO5CEMBVL0iabA2D0iq9gOWDjM=
-github.com/minio/minio-go/v7 v7.0.13/go.mod h1:S23iSP5/gbMwtxeY5FM71R+TkAYyzEdoNEDDwpt8yWs=
-github.com/minio/sha256-simd v0.1.1 h1:5QHSlgo3nt5yKOJrC7W8w7X+NFl8cMPZm96iu8kKUJU=
-github.com/minio/sha256-simd v0.1.1/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM=
+github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
+github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
+github.com/minio/minio-go/v7 v7.0.34 h1:JMfS5fudx1mN6V2MMNyCJ7UMrjEzZzIvMgfkWc1Vnjk=
+github.com/minio/minio-go/v7 v7.0.34/go.mod h1:nCrRzjoSUQh8hgKKtu3Y708OLvRLtuASMg2/nvmbarw=
+github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo6g=
+github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -602,6 +848,8 @@ github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrk
 github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77 h1:7GoSOOW2jpsfkntVKaS2rAr1TJqfcxotyaUcuxoZSzg=
 github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
@@ -613,6 +861,8 @@ github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
+github.com/montanaflynn/stats v0.6.6/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
 github.com/moul/http2curl v1.0.0/go.mod h1:8UbvGypXm98wA/IqH45anm5Y2Z6ep6O31QGOAZ3H0fQ=
 github.com/nats-io/jwt v0.3.0/go.mod h1:fRYCDE99xlTsqUzISS1Bi75UBJ6ljOJQOAAu5VglpSg=
 github.com/nats-io/nats.go v1.8.1/go.mod h1:BrFz9vVn0fU3AcH9Vn4Kd7W0NpJ651tD5omQ3M8LwxM=
@@ -647,6 +897,7 @@ github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2
 github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
 github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4=
 github.com/pingcap/errors v0.11.4/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
+github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
 github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4 h1:Qj1ukM4GlMWXNdMBuXcXfz/Kw9s1qm0CLY32QxuSImI=
 github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4/go.mod h1:N6UoU20jOqggOuDwUaBQpluzLNDqif3kq9z2wpdYEfQ=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -680,26 +931,28 @@ github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
-github.com/rs/xid v1.2.1 h1:mhH9Nq+C1fY2l1XIpgxIiUOfNpRBYH1kKcr+qfKgjRc=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
+github.com/rs/xid v1.4.0 h1:qd7wPTDkN6KQx2VmMBLrpHkiyQwgFXRnkOLacUiaSNY=
+github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
+github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
 github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 h1:GHRpF1pTW19a8tTFrMLUcfWwyC0pnifVo2ClaLq+hP8=
-github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46/go.mod h1:uAQ5PCi+MFsC7HjREoAz1BU+Mq60+05gifQSsHSDG/8=
+github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/schollz/closestmatch v2.1.0+incompatible/go.mod h1:RtP1ddjLong6gTkbtmuhtR2uUrrJOpYzYRvbcPAid+g=
 github.com/schollz/progressbar/v3 v3.13.1 h1:o8rySDYiQ59Mwzy2FELeHY5ZARXZTVJC7iHD6PEFUiE=
 github.com/schollz/progressbar/v3 v3.13.1/go.mod h1:xvrbki8kfT1fzWzBT/UZd9L6GA+jdL7HAgq2RFnO6fQ=
 github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
-github.com/scritchley/orc v0.0.0-20201124122313-cba38e582ef9 h1:rl1nPtym0Ce2syK7v9biRYjMsf9dZt0Mbr9PgyjKJZc=
-github.com/scritchley/orc v0.0.0-20201124122313-cba38e582ef9/go.mod h1:U4h1RViHcbDQl9stSaImdd7N3/ZnUkZ2yombj5cSgEY=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63 h1:J6qvD6rbmOil46orKqJaRPG+zTpoGlBTUdyv8ki63L0=
-github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63/go.mod h1:n+VKSARF5y/tS9XFSP7vWDfS+GUC5vs/YT7M5XDTUEM=
+github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
@@ -708,7 +961,6 @@ github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasO
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
-github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
 github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
@@ -730,6 +982,8 @@ github.com/spf13/viper v1.16.0/go.mod h1:yg78JgCJcbrQOvV9YLXgkLaZqUidkY9K+Dd1Fof
 github.com/streadway/quantile v0.0.0-20150917103942-b0c588724d25 h1:7z3LSn867ex6VSaahyKadf4WtSsJIgne6A1WLOAGM8A=
 github.com/streadway/quantile v0.0.0-20150917103942-b0c588724d25/go.mod h1:lbP8tGiBjZ5YWIc2fzuRpTaz0b/53vT6PEs3QuAWzuU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -779,8 +1033,8 @@ github.com/xitongsys/parquet-go v1.6.0 h1:j6YrTVZdQx5yywJLIOklZcKVsCoSD1tqOVRXyT
 github.com/xitongsys/parquet-go v1.6.0/go.mod h1:pheqtXeHQFzxJk45lRQ0UIGIivKnLXvialZSFWs81A8=
 github.com/xitongsys/parquet-go-source v0.0.0-20190524061010-2b72cbee77d5/go.mod h1:xxCx7Wpym/3QCo6JhujJX51dzSXrwmb0oH6FQb39SEA=
 github.com/xitongsys/parquet-go-source v0.0.0-20200817004010-026bad9b25d0/go.mod h1:HYhIKsdns7xz80OgkbgJYrtQY7FjHWHKH6cvN7+czGE=
-github.com/xitongsys/parquet-go-source v0.0.0-20201108113611-f372b7d813be h1:33jqDHcXK6vfgtLossgwZmTXyLCdPZU3/KZ3988bk3Q=
-github.com/xitongsys/parquet-go-source v0.0.0-20201108113611-f372b7d813be/go.mod h1:SQSSW1CBj/egoUhnaTXihUlDayvpp01Fn8qwuEpK5bY=
+github.com/xitongsys/parquet-go-source v0.0.0-20230607234618-40034c8066df h1:7S73eWYfEXugzxtutQDV70wBYjUpPK4gyVEFWJdsGGA=
+github.com/xitongsys/parquet-go-source v0.0.0-20230607234618-40034c8066df/go.mod h1:d87JD+hvj9dzdbZNd9zJb9ThSLQfoUNx50KQ6nuf9Wg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yalp/jsonpath v0.0.0-20180802001716-5cc68e5049a0/go.mod h1:/LWChgwKmvncFJFHJ7Gvn9wZArjbV5/FppcK2fKk/tI=
 github.com/yudai/gojsondiff v1.0.0/go.mod h1:AY32+k2cwILAkW1fbgxQ5mUmMiZFgLIV+FBNExI05xg=
@@ -792,38 +1046,66 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
+go.opencensus.io v0.15.0/go.mod h1:UffZAU+4sDEINUGP/B7UfBBkq4fqLu9zXAX7ke6CHW0=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
+go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.8.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
 go.uber.org/ratelimit v0.2.0 h1:UQE2Bgi7p2B85uP5dC2bbRtig0C+OeNRnNEafLjsLPA=
 go.uber.org/ratelimit v0.2.0/go.mod h1:YYBV4e4naJvhpitQrWJu1vCpgB7CboMe0qhltKt6mUg=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
+go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
+go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
+gocloud.dev v0.26.0/go.mod h1:mkUgejbnbLotorqDyvedJO20XcZNTynmSeVSQS9btVg=
 golang.org/x/crypto v0.0.0-20180723164146-c126467f60eb/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190829043050-9756ffdc2472/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20191227163750-53104e6ec876/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20211115234514-b4de73f9ece8/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220511200225-c6db032c6c88/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
 golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
@@ -875,6 +1157,7 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -884,7 +1167,6 @@ golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190310074541-c10a0554eabf/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190327091125-710a502c58a2/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -894,6 +1176,7 @@ golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -911,6 +1194,7 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
@@ -918,10 +1202,18 @@ golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211008194852-3b03d305991f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211020060615-d418f374d309/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220401154927-543a649e0bdd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
 golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
@@ -934,6 +1226,17 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210427180440-81ed05c6b58c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
+golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -952,14 +1255,16 @@ golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180816055513-1c9583448a9c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190310054646-10058d7d4faa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -990,9 +1295,9 @@ golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200826173525-f9321e4c35a6/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200828194041-157a740278f4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1001,21 +1306,42 @@ golang.org/x/sys v0.0.0-20201218084310-7d0127a74742/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210304124612-50617c2ba197/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210503080704-8803ae5d1324/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210917161153-d61c044b1678/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220204135822-1c1b9b1eba6a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1046,6 +1372,8 @@ golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20220224211638-0e9765cccd65/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.1.0 h1:xYY+Bajn2a7VBmTM5GikTmnK8ZuX8YgnQCqZpbBNtmA=
 golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1055,23 +1383,27 @@ golang.org/x/tools v0.0.0-20181221001348-537d06c36207/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190308174544-00c44ba9c14f/go.mod h1:25r3+/G6/xytQM8iWZKq3Hn0kr0rgFKPUNVEL/dr3z4=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190327201419-c70d86f8b7cf/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190422233926-fe54fb35175b/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190927191325-030b2cf1153e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -1079,6 +1411,7 @@ golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
@@ -1107,10 +1440,15 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.11.0 h1:EMCa6U9S2LtZXLAMoWiR/R8dAQFRqbAitmbJ2UKhoi8=
 golang.org/x/tools v0.11.0/go.mod h1:anzJrxPjNtfgiYQYirP2CPGzGLxrH2u2QBhn6Bf3qY8=
+golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1145,6 +1483,29 @@ google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz513
 google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
 google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
 google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
+google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
+google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
+google.golang.org/api v0.46.0/go.mod h1:ceL4oozhkAiTID8XMmJBsIxID/9wMXJVVFXPg4ylg3I=
+google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
+google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
+google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
+google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
+google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
+google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
+google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
+google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
+google.golang.org/api v0.58.0/go.mod h1:cAbP2FsxoGVNwtgNAmmn3y5G1TWAiVYRmg4yku3lv+E=
+google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU=
+google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
+google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
+google.golang.org/api v0.64.0/go.mod h1:931CdxA8Rm4t6zqTFGSsgwbAEZ2+GMYurbndwSimebM=
+google.golang.org/api v0.66.0/go.mod h1:I1dmXYpX7HGwz/ejRxwQp2qj5bFAz93HiCU1C1oYd9M=
+google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
+google.golang.org/api v0.68.0/go.mod h1:sOM8pTpwgflXRhz+oC8H2Dr+UcbMqkPPWNJo88Q7TH8=
+google.golang.org/api v0.69.0/go.mod h1:boanBiw+h5c3s+tBPgEzLDRHfFLWV0qXxRHz3ws7C80=
+google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/SkfA=
+google.golang.org/api v0.71.0/go.mod h1:4PyU6e6JogV1f9eA4voyrTY2batOLdgZ5qZ5HOCc4j8=
+google.golang.org/api v0.74.0/go.mod h1:ZpfMZOVRMywNyvJFeqL9HRWBgAuRfSjJFpe9QtRRyDs=
 google.golang.org/api v0.122.0 h1:zDobeejm3E7pEG1mNHvdxvjs5XJoCMzyNH+CmwL94Es=
 google.golang.org/api v0.122.0/go.mod h1:gcitW0lvnyWjSp9nKxAbdHKIZ6vF4aajGueeslZOyms=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -1192,8 +1553,54 @@ google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
+google.golang.org/genproto v0.0.0-20210429181445-86c259c2b4ab/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
+google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
+google.golang.org/genproto v0.0.0-20210517163617-5e0236093d7a/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
+google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
+google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
+google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
+google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
+google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210921142501-181ce0d877f6/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211008145708-270636b82663/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211018162055-cf77aa76bad2/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211028162531-8db9c33dc351/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211223182754-3ac035c7e7cb/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220111164026-67b88f271998/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220201184016-50beb8ab5c44/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220204002441-d6cc3cc0770e/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220211171837-173942840c17/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
+google.golang.org/genproto v0.0.0-20220216160803-4663080d8bc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
+google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
+google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
+google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
+google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
+google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
+google.golang.org/genproto v0.0.0-20220401170504-314d38edb7de/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
 google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
@@ -1215,10 +1622,19 @@ google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv
 google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
 google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
 google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
 google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1231,6 +1647,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
@@ -1240,14 +1658,16 @@ gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
 gopkg.in/go-playground/validator.v8 v8.18.2/go.mod h1:RX2a/7Ha8BgOhfk7j780h4/u/RRjR0eouCJSH80/M2Y=
 gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df h1:n7WqCuqOuCbNr617RXOY0AWRXxgwEyPp2z+p0+hgMuE=
 gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df/go.mod h1:LRQQ+SO6ZHR7tOkpBDuZnXENFzX8qRjMDMyPD6BRkCw=
+gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/ini.v1 v1.51.1/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/ini.v1 v1.57.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.66.6/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/jcmturner/aescts.v1 v1.0.1/go.mod h1:nsR8qBOg+OucoIW+WMhB3GspUQXq9XorLnQb9XtvcOo=
@@ -1259,6 +1679,7 @@ gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3M
 gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1280,6 +1701,7 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 pgregory.net/rapid v0.4.0 h1:/boyXNQlDs1pmk7g1b9u2KrYqXnqjj0ARUDsZj5kapg=
 pgregory.net/rapid v0.4.0/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
diff --git a/pkg/actions/lua/encoding/parquet/parquet.go b/pkg/actions/lua/encoding/parquet/parquet.go
index 06b91bd37ed..f5c1487f6bc 100644
--- a/pkg/actions/lua/encoding/parquet/parquet.go
+++ b/pkg/actions/lua/encoding/parquet/parquet.go
@@ -31,8 +31,7 @@ func getSchema(l *lua.State) int {
 	payload := lua.CheckString(l, 1)
 	bin := []byte(payload)
 	t := struct{}{}
-	fp, err := buffer.NewBufferFile(bin)
-	check(l, err)
+	fp := buffer.NewBufferFileFromBytes(bin)
 	r, err := reader.NewParquetReader(fp, &t, 1)
 	check(l, err)
 	output := make([]map[string]string, 0)
diff --git a/pkg/actions/lua/storage/aws/s3.go b/pkg/actions/lua/storage/aws/s3.go
index 54c62d04fce..ca64c7a0732 100644
--- a/pkg/actions/lua/storage/aws/s3.go
+++ b/pkg/actions/lua/storage/aws/s3.go
@@ -2,21 +2,24 @@ package aws
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"io"
 	"sort"
 	"strings"
 	"time"
 
 	"github.com/Shopify/go-lua"
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/treeverse/lakefs/pkg/actions/lua/util"
 )
 
+var errDeleteObject = errors.New("delete object failed")
+
 func Open(l *lua.State, ctx context.Context) {
 	open := func(l *lua.State) int {
 		lua.NewLibrary(l, []lua.RegistryFunction{
@@ -68,17 +71,17 @@ type S3Client struct {
 	ctx             context.Context
 }
 
-func (c *S3Client) client() *s3.S3 {
-	cfg := &aws.Config{}
-	if c.Region != "" {
-		cfg.Region = aws.String(c.Region)
-	}
-	if c.Endpoint != "" {
-		cfg.Endpoint = aws.String(c.Endpoint)
+func (c *S3Client) client() *s3.Client {
+	cfg, err := config.LoadDefaultConfig(c.ctx,
+		config.WithRegion(c.Region),
+		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(c.AccessKeyID, c.SecretAccessKey, "")),
+	)
+	if err != nil {
+		panic(err)
 	}
-	cfg.Credentials = credentials.NewStaticCredentials(c.AccessKeyID, c.SecretAccessKey, "")
-	sess, _ := session.NewSession(cfg)
-	return s3.New(sess)
+	return s3.NewFromConfig(cfg, func(o *s3.Options) {
+		o.BaseEndpoint = &c.Endpoint
+	})
 }
 
 var functions = map[string]func(client *S3Client) lua.Function{
@@ -91,14 +94,49 @@ var functions = map[string]func(client *S3Client) lua.Function{
 
 func deleteRecursive(c *S3Client) lua.Function {
 	return func(l *lua.State) int {
+		bucketName := lua.CheckString(l, 1)
+		prefix := lua.CheckString(l, 2)
+
 		client := c.client()
-		iter := s3manager.NewDeleteListIterator(client, &s3.ListObjectsInput{
-			Bucket: aws.String(lua.CheckString(l, 1)),
-			Prefix: aws.String(lua.CheckString(l, 2)),
-		})
-		err := s3manager.NewBatchDeleteWithClient(client).Delete(c.ctx, iter)
-		if err != nil {
-			lua.Errorf(l, err.Error())
+		input := &s3.ListObjectsV2Input{
+			Bucket: aws.String(bucketName),
+			Prefix: aws.String(prefix),
+		}
+
+		var errs error
+		for {
+			// list objects to delete and delete them
+			listObjects, err := client.ListObjectsV2(c.ctx, input)
+			if err != nil {
+				lua.Errorf(l, err.Error())
+				panic("unreachable")
+			}
+
+			deleteInput := &s3.DeleteObjectsInput{
+				Bucket: &bucketName,
+				Delete: &types.Delete{},
+			}
+			for _, content := range listObjects.Contents {
+				deleteInput.Delete.Objects = append(deleteInput.Delete.Objects, types.ObjectIdentifier{Key: content.Key})
+			}
+			deleteObjects, err := client.DeleteObjects(c.ctx, deleteInput)
+			if err != nil {
+				errs = errors.Join(errs, err)
+				break
+			}
+			for _, deleteError := range deleteObjects.Errors {
+				errDel := fmt.Errorf("%w '%s', %s",
+					errDeleteObject, aws.ToString(deleteError.Key), aws.ToString(deleteError.Message))
+				errs = errors.Join(errs, errDel)
+			}
+
+			if !listObjects.IsTruncated {
+				break
+			}
+			input.ContinuationToken = listObjects.NextContinuationToken
+		}
+		if errs != nil {
+			lua.Errorf(l, errs.Error())
 			panic("unreachable")
 		}
 		return 0
@@ -110,18 +148,19 @@ func getObject(c *S3Client) lua.Function {
 		client := c.client()
 		key := lua.CheckString(l, 2)
 		bucket := lua.CheckString(l, 1)
-		resp, err := client.GetObjectWithContext(c.ctx, &s3.GetObjectInput{
+		resp, err := client.GetObject(c.ctx, &s3.GetObjectInput{
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
 		})
 		if err != nil {
-			if aerr, ok := err.(awserr.Error); ok {
-				switch aerr.Code() {
-				case s3.ErrCodeNoSuchBucket, s3.ErrCodeNoSuchKey:
-					l.PushString("")
-					l.PushBoolean(false) // exists
-					return 2
-				}
+			var (
+				noSuchBucket *types.NoSuchBucket
+				noSuchKey    *types.NoSuchKey
+			)
+			if errors.As(err, &noSuchBucket) || errors.As(err, &noSuchKey) {
+				l.PushString("")
+				l.PushBoolean(false) // exists
+				return 2
 			}
 			lua.Errorf(l, err.Error())
 			panic("unreachable")
@@ -141,7 +180,7 @@ func putObject(c *S3Client) lua.Function {
 	return func(l *lua.State) int {
 		client := c.client()
 		buf := strings.NewReader(lua.CheckString(l, 3))
-		_, err := client.PutObjectWithContext(c.ctx, &s3.PutObjectInput{
+		_, err := client.PutObject(c.ctx, &s3.PutObjectInput{
 			Body:   buf,
 			Bucket: aws.String(lua.CheckString(l, 1)),
 			Key:    aws.String(lua.CheckString(l, 2)),
@@ -157,7 +196,7 @@ func putObject(c *S3Client) lua.Function {
 func deleteObject(c *S3Client) lua.Function {
 	return func(l *lua.State) int {
 		client := c.client()
-		_, err := client.DeleteObjectWithContext(c.ctx, &s3.DeleteObjectInput{
+		_, err := client.DeleteObject(c.ctx, &s3.DeleteObjectInput{
 			Bucket: aws.String(lua.CheckString(l, 1)),
 			Key:    aws.String(lua.CheckString(l, 2)),
 		})
@@ -186,7 +225,7 @@ func listObjects(c *S3Client) lua.Function {
 			delimiter = aws.String("/")
 		}
 
-		resp, err := client.ListObjectsV2WithContext(c.ctx, &s3.ListObjectsV2Input{
+		resp, err := client.ListObjectsV2(c.ctx, &s3.ListObjectsV2Input{
 			Bucket:            aws.String(lua.CheckString(l, 1)),
 			ContinuationToken: continuationToken,
 			Delimiter:         delimiter,
@@ -208,7 +247,7 @@ func listObjects(c *S3Client) lua.Function {
 				"key":           *obj.Key,
 				"type":          "object",
 				"etag":          *obj.ETag,
-				"size":          *obj.Size,
+				"size":          obj.Size,
 				"last_modified": obj.LastModified.Format(time.RFC3339),
 			})
 		}
@@ -219,8 +258,8 @@ func listObjects(c *S3Client) lua.Function {
 		})
 
 		response := map[string]interface{}{
-			"is_truncated":            aws.BoolValue(resp.IsTruncated),
-			"next_continuation_token": aws.StringValue(resp.NextContinuationToken),
+			"is_truncated":            resp.IsTruncated,
+			"next_continuation_token": aws.ToString(resp.NextContinuationToken),
 			"results":                 results,
 		}
 
diff --git a/pkg/api/controller.go b/pkg/api/controller.go
index 74585ba7d2e..909894123b0 100644
--- a/pkg/api/controller.go
+++ b/pkg/api/controller.go
@@ -19,7 +19,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/davecgh/go-spew/spew"
 	"github.com/go-openapi/swag"
 	"github.com/gorilla/sessions"
@@ -51,7 +50,7 @@ import (
 )
 
 const (
-	// DefaultMaxPerPage is the maximum amount of results returned for paginated queries to the API
+	// DefaultMaxPerPage is the maximum number of results returned for paginated queries to the API
 	DefaultMaxPerPage int = 1000
 	lakeFSPrefix          = "symlinks"
 
@@ -115,7 +114,7 @@ func (c *Controller) PrepareGarbageCollectionUncommitted(w http.ResponseWriter,
 	ctx := r.Context()
 	c.LogAction(ctx, "prepare_garbage_collection_uncommitted", r, repository, "", "")
 
-	continuationToken := apiutil.Value(body.ContinuationToken)
+	continuationToken := swag.StringValue(body.ContinuationToken)
 	mark, err := decodeGCUncommittedMark(continuationToken)
 	if err != nil {
 		c.Logger.WithError(err).
@@ -185,7 +184,7 @@ func (c *Controller) DeleteObjects(w http.ResponseWriter, r *http.Request, body
 			},
 		}) {
 			errs = append(errs, apigen.ObjectError{
-				Path:       apiutil.Ptr(objectPath),
+				Path:       swag.String(objectPath),
 				StatusCode: http.StatusUnauthorized,
 				Message:    http.StatusText(http.StatusUnauthorized),
 			})
@@ -209,7 +208,7 @@ func (c *Controller) DeleteObjects(w http.ResponseWriter, r *http.Request, body
 			lg.WithError(err).Debug("tried to delete a non-existent object")
 		case errors.Is(err, graveler.ErrWriteToProtectedBranch):
 			errs = append(errs, apigen.ObjectError{
-				Path:       apiutil.Ptr(objectPath),
+				Path:       swag.String(objectPath),
 				StatusCode: http.StatusForbidden,
 				Message:    err.Error(),
 			})
@@ -221,7 +220,7 @@ func (c *Controller) DeleteObjects(w http.ResponseWriter, r *http.Request, body
 		case err != nil:
 			lg.WithError(err).Error("failed deleting object")
 			errs = append(errs, apigen.ObjectError{
-				Path:       apiutil.Ptr(objectPath),
+				Path:       swag.String(objectPath),
 				StatusCode: http.StatusInternalServerError,
 				Message:    err.Error(),
 			})
@@ -264,7 +263,7 @@ func (c *Controller) Login(w http.ResponseWriter, r *http.Request, body apigen.L
 	}
 	response := apigen.AuthenticationToken{
 		Token:           tokenString,
-		TokenExpiration: apiutil.Ptr(expires.Unix()),
+		TokenExpiration: swag.Int64(expires.Unix()),
 	}
 	writeResponse(w, r, http.StatusOK, response)
 }
@@ -315,8 +314,8 @@ func (c *Controller) GetPhysicalAddress(w http.ResponseWriter, r *http.Request,
 	}
 
 	response := &apigen.StagingLocation{
-		PhysicalAddress: apiutil.Ptr(qk.Format()),
-		Token:           apiutil.Value(token),
+		PhysicalAddress: swag.String(qk.Format()),
+		Token:           swag.StringValue(token),
 	}
 
 	if swag.BoolValue(params.Presign) {
@@ -332,7 +331,7 @@ func (c *Controller) GetPhysicalAddress(w http.ResponseWriter, r *http.Request,
 		}
 		response.PresignedUrl = &preSignedURL
 		if !expiry.IsZero() {
-			response.PresignedUrlExpiry = apiutil.Ptr(expiry.Unix())
+			response.PresignedUrlExpiry = swag.Int64(expiry.Unix())
 		}
 	}
 
@@ -380,7 +379,7 @@ func (c *Controller) LinkPhysicalAddress(w http.ResponseWriter, r *http.Request,
 	}
 
 	writeTime := time.Now()
-	physicalAddress, addressType := normalizePhysicalAddress(repo.StorageNamespace, apiutil.Value(body.Staging.PhysicalAddress))
+	physicalAddress, addressType := normalizePhysicalAddress(repo.StorageNamespace, swag.StringValue(body.Staging.PhysicalAddress))
 
 	// validate token
 	err = c.Catalog.VerifyLinkAddress(ctx, repository, physicalAddress)
@@ -399,7 +398,7 @@ func (c *Controller) LinkPhysicalAddress(w http.ResponseWriter, r *http.Request,
 		CreationDate(writeTime).
 		Size(body.SizeBytes).
 		Checksum(body.Checksum).
-		ContentType(apiutil.Value(body.ContentType))
+		ContentType(swag.StringValue(body.ContentType))
 	if body.UserMetadata != nil {
 		entryBuilder.Metadata(body.UserMetadata.AdditionalProperties)
 	}
@@ -413,13 +412,13 @@ func (c *Controller) LinkPhysicalAddress(w http.ResponseWriter, r *http.Request,
 	metadata := apigen.ObjectUserMetadata{AdditionalProperties: entry.Metadata}
 	response := apigen.ObjectStats{
 		Checksum:        entry.Checksum,
-		ContentType:     &entry.ContentType,
+		ContentType:     swag.String(entry.ContentType),
 		Metadata:        &metadata,
 		Mtime:           entry.CreationDate.Unix(),
 		Path:            entry.Path,
 		PathType:        entryTypeObject,
 		PhysicalAddress: entry.PhysicalAddress,
-		SizeBytes:       apiutil.Ptr(entry.Size),
+		SizeBytes:       swag.Int64(entry.Size),
 	}
 
 	writeResponse(w, r, http.StatusOK, response)
@@ -1525,7 +1524,7 @@ func (c *Controller) CreateRepository(w http.ResponseWriter, r *http.Request, bo
 		return
 	}
 
-	defaultBranch := apiutil.Value(body.DefaultBranch)
+	defaultBranch := swag.StringValue(body.DefaultBranch)
 	if defaultBranch == "" {
 		defaultBranch = "main"
 	}
@@ -1634,7 +1633,7 @@ func (c *Controller) ensureStorageNamespace(ctx context.Context, storageNamespac
 	objLen := int64(len(dummyData))
 
 	// check if the dummy file exist in the root of the storage namespace
-	// this serves 2 purposes, first, we maintain safety check for older lakeFS version.
+	// this serves two purposes, first, we maintain safety check for older lakeFS version.
 	// second, in scenarios where lakeFS shouldn't have access to the root namespace (i.e pre-sign URL only).
 	if c.Config.Graveler.EnsureReadableRootNamespace {
 		rootObj := block.ObjectPointer{
@@ -1644,7 +1643,7 @@ func (c *Controller) ensureStorageNamespace(ctx context.Context, storageNamespac
 		}
 
 		if s, err := c.BlockAdapter.Get(ctx, rootObj, objLen); err == nil {
-			s.Close()
+			_ = s.Close()
 			return fmt.Errorf("found lakeFS objects in the storage namespace root(%s): %w",
 				storageNamespace, ErrStorageNamespaceInUse)
 		} else if !errors.Is(err, block.ErrDataNotFound) {
@@ -1660,7 +1659,7 @@ func (c *Controller) ensureStorageNamespace(ctx context.Context, storageNamespac
 	}
 
 	if s, err := c.BlockAdapter.Get(ctx, obj, objLen); err == nil {
-		s.Close()
+		_ = s.Close()
 		return fmt.Errorf("found lakeFS objects in the storage namespace(%s) key(%s): %w",
 			storageNamespace, obj.Identifier, ErrStorageNamespaceInUse)
 	} else if !errors.Is(err, block.ErrDataNotFound) {
@@ -1761,8 +1760,8 @@ func (c *Controller) ListRepositoryRuns(w http.ResponseWriter, r *http.Request,
 		return
 	}
 
-	branchName := apiutil.Value(params.Branch)
-	commitID := apiutil.Value(params.Commit)
+	branchName := swag.StringValue(params.Branch)
+	commitID := swag.StringValue(params.Commit)
 	runsIter, err := c.Actions.ListRunResults(ctx, repository, branchName, commitID, paginationAfter(params.After))
 	if c.handleAPIError(ctx, w, r, err) {
 		return
@@ -2157,11 +2156,11 @@ func (c *Controller) ResetBranch(w http.ResponseWriter, r *http.Request, body ap
 	var err error
 	switch body.Type {
 	case entryTypeCommonPrefix:
-		err = c.Catalog.ResetEntries(ctx, repository, branch, apiutil.Value(body.Path))
+		err = c.Catalog.ResetEntries(ctx, repository, branch, swag.StringValue(body.Path))
 	case "reset":
 		err = c.Catalog.ResetBranch(ctx, repository, branch)
 	case entryTypeObject:
-		err = c.Catalog.ResetEntry(ctx, repository, branch, apiutil.Value(body.Path))
+		err = c.Catalog.ResetEntry(ctx, repository, branch, swag.StringValue(body.Path))
 	default:
 		writeError(w, r, http.StatusNotFound, "reset type not found")
 	}
@@ -2346,8 +2345,8 @@ func (c *Controller) IngestRange(w http.ResponseWriter, r *http.Request, body ap
 	ctx := r.Context()
 	c.LogAction(ctx, "ingest_range", r, repository, "", "")
 
-	contToken := apiutil.Value(body.ContinuationToken)
-	stagingToken := apiutil.Value(body.StagingToken)
+	contToken := swag.StringValue(body.ContinuationToken)
+	stagingToken := swag.StringValue(body.StagingToken)
 	info, mark, err := c.Catalog.WriteRange(r.Context(), repository, catalog.WriteRangeRequest{
 		SourceURI:         body.FromSourceURI,
 		Prepend:           body.Prepend,
@@ -2404,7 +2403,7 @@ func (c *Controller) CreateMetaRange(w http.ResponseWriter, r *http.Request, bod
 		return
 	}
 	writeResponse(w, r, http.StatusCreated, apigen.MetaRangeCreationResponse{
-		Id: apiutil.Ptr(string(info.ID)),
+		Id: swag.String(string(info.ID)),
 	})
 }
 
@@ -2514,7 +2513,7 @@ func (c *Controller) DiffBranch(w http.ResponseWriter, r *http.Request, reposito
 			PathType: pathType,
 		}
 		if !d.CommonLevel {
-			diff.SizeBytes = &d.Size
+			diff.SizeBytes = swag.Int64(d.Size)
 		}
 		results = append(results, diff)
 	}
@@ -2592,7 +2591,7 @@ func (c *Controller) UploadObject(w http.ResponseWriter, r *http.Request, reposi
 	//	and then graveler will check again when passed a SetOptions.
 	allowOverwrite := true
 	if params.IfNoneMatch != nil {
-		if apiutil.Value(params.IfNoneMatch) != "*" {
+		if swag.StringValue(params.IfNoneMatch) != "*" {
 			writeError(w, r, http.StatusBadRequest, "Unsupported value for If-None-Match - Only \"*\" is supported")
 			return
 		}
@@ -2610,57 +2609,63 @@ func (c *Controller) UploadObject(w http.ResponseWriter, r *http.Request, reposi
 	}
 
 	// read request body parse multipart for "content" and upload the data
-	mt, p, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
+	contentType := r.Header.Get("Content-Type")
+	mediaType, p, err := mime.ParseMediaType(contentType)
 	if err != nil {
 		writeError(w, r, http.StatusInternalServerError, err)
 		return
 	}
-	if mt != "multipart/form-data" {
-		writeError(w, r, http.StatusInternalServerError, http.ErrNotMultipart)
-		return
-	}
-	boundary, ok := p["boundary"]
-	if !ok {
-		writeError(w, r, http.StatusInternalServerError, http.ErrMissingBoundary)
-		return
-	}
 
-	reader := multipart.NewReader(r.Body, boundary)
-	var (
-		contentUploaded bool
-		contentType     string
-		blob            *upload.Blob
-	)
-	for !contentUploaded {
-		part, err := reader.NextPart()
-		if err == io.EOF {
-			break
-		}
+	var blob *upload.Blob
+	if mediaType != "multipart/form-data" {
+		// handle non-multipart, direct content upload
+		address := c.PathProvider.NewPath()
+		blob, err = upload.WriteBlob(ctx, c.BlockAdapter, repo.StorageNamespace, address, r.Body, r.ContentLength,
+			block.PutOpts{StorageClass: params.StorageClass})
 		if err != nil {
 			writeError(w, r, http.StatusInternalServerError, err)
 			return
 		}
-		contentType = part.Header.Get("Content-Type")
-		partName := part.FormName()
-		if partName == "content" {
-			// upload the first "content" and exit the loop
-			address := c.PathProvider.NewPath()
-			blob, err = upload.WriteBlob(ctx, c.BlockAdapter, repo.StorageNamespace, address, part, -1, block.PutOpts{StorageClass: params.StorageClass})
+	} else {
+		// handle multipart upload
+		boundary, ok := p["boundary"]
+		if !ok {
+			writeError(w, r, http.StatusInternalServerError, http.ErrMissingBoundary)
+			return
+		}
+
+		contentUploaded := false
+		reader := multipart.NewReader(r.Body, boundary)
+		for !contentUploaded {
+			part, err := reader.NextPart()
+			if err == io.EOF {
+				break
+			}
 			if err != nil {
-				_ = part.Close()
 				writeError(w, r, http.StatusInternalServerError, err)
 				return
 			}
-			contentUploaded = true
+			contentType = part.Header.Get("Content-Type")
+			partName := part.FormName()
+			if partName == "content" {
+				// upload the first "content" and exit the loop
+				address := c.PathProvider.NewPath()
+				blob, err = upload.WriteBlob(ctx, c.BlockAdapter, repo.StorageNamespace, address, part, -1, block.PutOpts{StorageClass: params.StorageClass})
+				if err != nil {
+					_ = part.Close()
+					writeError(w, r, http.StatusInternalServerError, err)
+					return
+				}
+				contentUploaded = true
+			}
+			_ = part.Close()
+		}
+		if !contentUploaded {
+			err := fmt.Errorf("multipart upload missing key 'content': %w", http.ErrMissingFile)
+			writeError(w, r, http.StatusInternalServerError, err)
+			return
 		}
-		_ = part.Close()
-	}
-	if !contentUploaded {
-		err := fmt.Errorf("multipart upload missing key 'content': %w", http.ErrMissingFile)
-		writeError(w, r, http.StatusInternalServerError, err)
-		return
 	}
-
 	// write metadata
 	writeTime := time.Now()
 	entryBuilder := catalog.NewDBEntryBuilder().
@@ -2707,7 +2712,7 @@ func (c *Controller) UploadObject(w http.ResponseWriter, r *http.Request, reposi
 		Path:            params.Path,
 		PathType:        entryTypeObject,
 		PhysicalAddress: qk.Format(),
-		SizeBytes:       apiutil.Ptr(blob.Size),
+		SizeBytes:       swag.Int64(blob.Size),
 		ContentType:     &contentType,
 	}
 	writeResponse(w, r, http.StatusCreated, response)
@@ -2760,7 +2765,7 @@ func (c *Controller) StageObject(w http.ResponseWriter, r *http.Request, body ap
 		CreationDate(writeTime).
 		Size(body.SizeBytes).
 		Checksum(body.Checksum).
-		ContentType(apiutil.Value(body.ContentType))
+		ContentType(swag.StringValue(body.ContentType))
 	if body.Metadata != nil {
 		entryBuilder.Metadata(body.Metadata.AdditionalProperties)
 	}
@@ -2776,8 +2781,8 @@ func (c *Controller) StageObject(w http.ResponseWriter, r *http.Request, body ap
 		Path:            entry.Path,
 		PathType:        entryTypeObject,
 		PhysicalAddress: qk.Format(),
-		SizeBytes:       apiutil.Ptr(entry.Size),
-		ContentType:     &entry.ContentType,
+		SizeBytes:       swag.Int64(entry.Size),
+		ContentType:     swag.String(entry.ContentType),
 	}
 	writeResponse(w, r, http.StatusCreated, response)
 }
@@ -2847,8 +2852,8 @@ func (c *Controller) CopyObject(w http.ResponseWriter, r *http.Request, body api
 		Path:            entry.Path,
 		PathType:        entryTypeObject,
 		PhysicalAddress: qk.Format(),
-		SizeBytes:       apiutil.Ptr(entry.Size),
-		ContentType:     apiutil.Ptr(entry.ContentType),
+		SizeBytes:       swag.Int64(entry.Size),
+		ContentType:     swag.String(entry.ContentType),
 	}
 	writeResponse(w, r, http.StatusCreated, response)
 }
@@ -3047,7 +3052,7 @@ func (c *Controller) PrepareGarbageCollectionCommits(w http.ResponseWriter, r *h
 	}
 	ctx := r.Context()
 	c.LogAction(ctx, "prepare_garbage_collection_commits", r, repository, "", "")
-	gcRunMetadata, err := c.Catalog.PrepareExpiredCommits(ctx, repository, apiutil.Value(body.PreviousRunId))
+	gcRunMetadata, err := c.Catalog.PrepareExpiredCommits(ctx, repository, swag.StringValue(body.PreviousRunId))
 	if c.handleAPIError(ctx, w, r, err) {
 		return
 	}
@@ -3378,7 +3383,7 @@ func (c *Controller) CreateSymlinkFile(w http.ResponseWriter, r *http.Request, r
 			ctx,
 			repository,
 			branch,
-			apiutil.Value(params.Location),
+			swag.StringValue(params.Location),
 			after,
 			"",
 			-1)
@@ -3429,12 +3434,11 @@ func (c *Controller) CreateSymlinkFile(w http.ResponseWriter, r *http.Request, r
 func writeSymlink(ctx context.Context, repo *catalog.Repository, branch, path string, addresses []string, adapter block.Adapter) error {
 	address := fmt.Sprintf("%s/%s/%s/%s/symlink.txt", lakeFSPrefix, repo.Name, branch, path)
 	data := strings.Join(addresses, "\n")
-	symlinkReader := aws.ReadSeekCloser(strings.NewReader(data))
 	err := adapter.Put(ctx, block.ObjectPointer{
 		StorageNamespace: repo.StorageNamespace,
 		IdentifierType:   block.IdentifierTypeRelative,
 		Identifier:       address,
-	}, int64(len(data)), symlinkReader, block.PutOpts{})
+	}, int64(len(data)), strings.NewReader(data), block.PutOpts{})
 	return err
 }
 
@@ -3476,7 +3480,7 @@ func (c *Controller) DiffRefs(w http.ResponseWriter, r *http.Request, repository
 			PathType: pathType,
 		}
 		if !d.CommonLevel {
-			diff.SizeBytes = &d.Size
+			diff.SizeBytes = swag.Int64(d.Size)
 		}
 		results = append(results, diff)
 	}
@@ -3739,8 +3743,8 @@ func (c *Controller) ListObjects(w http.ResponseWriter, r *http.Request, reposit
 				Path:            entry.Path,
 				PhysicalAddress: qk.Format(),
 				PathType:        entryTypeObject,
-				SizeBytes:       apiutil.Ptr(entry.Size),
-				ContentType:     &entry.ContentType,
+				SizeBytes:       swag.Int64(entry.Size),
+				ContentType:     swag.String(entry.ContentType),
 			}
 			if (params.UserMetadata == nil || *params.UserMetadata) && entry.Metadata != nil {
 				objStat.Metadata = &apigen.ObjectUserMetadata{AdditionalProperties: entry.Metadata}
@@ -3770,7 +3774,7 @@ func (c *Controller) ListObjects(w http.ResponseWriter, r *http.Request, reposit
 						return
 					}
 					if !expiry.IsZero() {
-						objStat.PhysicalAddressExpiry = apiutil.Ptr(expiry.Unix())
+						objStat.PhysicalAddressExpiry = swag.Int64(expiry.Unix())
 					}
 				}
 			}
@@ -3825,8 +3829,8 @@ func (c *Controller) StatObject(w http.ResponseWriter, r *http.Request, reposito
 		Path:            entry.Path,
 		PathType:        entryTypeObject,
 		PhysicalAddress: qk.Format(),
-		SizeBytes:       apiutil.Ptr(entry.Size),
-		ContentType:     &entry.ContentType,
+		SizeBytes:       swag.Int64(entry.Size),
+		ContentType:     swag.String(entry.ContentType),
 	}
 	if (params.UserMetadata == nil || *params.UserMetadata) && entry.Metadata != nil {
 		objStat.Metadata = &apigen.ObjectUserMetadata{AdditionalProperties: entry.Metadata}
@@ -3846,7 +3850,7 @@ func (c *Controller) StatObject(w http.ResponseWriter, r *http.Request, reposito
 		}
 		objStat.PhysicalAddress = preSignedURL
 		if !expiry.IsZero() {
-			objStat.PhysicalAddressExpiry = apiutil.Ptr(expiry.Unix())
+			objStat.PhysicalAddressExpiry = swag.Int64(expiry.Unix())
 		}
 	}
 	writeResponse(w, r, code, objStat)
@@ -3916,9 +3920,9 @@ func (c *Controller) MergeIntoBranch(w http.ResponseWriter, r *http.Request, bod
 	reference, err := c.Catalog.Merge(ctx,
 		repository, destinationBranch, sourceRef,
 		user.Username,
-		apiutil.Value(body.Message),
+		swag.StringValue(body.Message),
 		metadata,
-		apiutil.Value(body.Strategy))
+		swag.StringValue(body.Strategy))
 
 	var hookAbortErr *graveler.HookAbortError
 	switch {
@@ -4235,7 +4239,7 @@ func (c *Controller) resetPasswordRequest(ctx context.Context, emailAddr string)
 	if err != nil {
 		return err
 	}
-	emailAddr = apiutil.Value(user.Email)
+	emailAddr = swag.StringValue(user.Email)
 	token, err := c.generateResetPasswordToken(emailAddr, DefaultResetPasswordExpiration)
 	if err != nil {
 		c.Logger.WithError(err).WithField("email_address", emailAddr).Error("reset password - failed generating token")
@@ -4275,7 +4279,7 @@ func (c *Controller) UpdatePassword(w http.ResponseWriter, r *http.Request, body
 	}
 
 	// verify provided email matched the token
-	requestEmail := apiutil.Value(body.Email)
+	requestEmail := swag.StringValue(body.Email)
 	if requestEmail != "" && requestEmail != claims.Subject {
 		c.Logger.WithError(err).WithFields(logging.Fields{
 			"token":         body.Token,
@@ -4398,7 +4402,7 @@ func (c *Controller) GetGarbageCollectionConfig(w http.ResponseWriter, r *http.R
 	}
 
 	writeResponse(w, r, http.StatusOK, apigen.GarbageCollectionConfig{
-		GracePeriod: aws.Int(int(ref.LinkAddressTime.Seconds())),
+		GracePeriod: swag.Int(int(ref.LinkAddressTime.Seconds())),
 	})
 }
 
@@ -4629,22 +4633,20 @@ func resolvePathList(objects, prefixes *[]string) []catalog.PathRecord {
 		return make([]catalog.PathRecord, 0)
 	}
 	if objects != nil {
-		for _, path := range *objects {
-			if path != "" {
-				path := path
+		for _, p := range *objects {
+			if p != "" {
 				pathRecords = append(pathRecords, catalog.PathRecord{
-					Path:     catalog.Path(apiutil.Value(&path)),
+					Path:     catalog.Path(p),
 					IsPrefix: false,
 				})
 			}
 		}
 	}
 	if prefixes != nil {
-		for _, path := range *prefixes {
-			if path != "" {
-				path := path
+		for _, p := range *prefixes {
+			if p != "" {
 				pathRecords = append(pathRecords, catalog.PathRecord{
-					Path:     catalog.Path(apiutil.Value(&path)),
+					Path:     catalog.Path(p),
 					IsPrefix: true,
 				})
 			}
diff --git a/pkg/api/helpers/adapters.go b/pkg/api/helpers/adapters.go
index 0cf98a6fe79..a9673eb1946 100644
--- a/pkg/api/helpers/adapters.go
+++ b/pkg/api/helpers/adapters.go
@@ -5,13 +5,13 @@ import (
 	"fmt"
 	"io"
 	"net/url"
+	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws/client"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
-	"github.com/treeverse/lakefs/pkg/api/apiutil"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
 )
 
 // ObjectStats metadata of an object stored on a backing store.
@@ -20,7 +20,7 @@ type ObjectStats struct {
 	Size int64
 	// ETag is a unique identifier of the contents.
 	ETag string
-	// MTime is the time stored for last object modification.  It can be returned as 0
+	// MTime is the time stored for last object modification. It can be returned as 0
 	// from calls to ClientAdapter.Upload().
 	MTime time.Time
 }
@@ -54,19 +54,15 @@ var adapterFactory = AdapterFactory{
 const s3Scheme = "s3"
 
 type s3Adapter struct {
-	svc  *s3.S3
-	sess client.ConfigProvider
+	svc *s3.Client
 }
 
 func newS3Adapter() (ClientAdapter, error) {
-	sess, err := session.NewSessionWithOptions(session.Options{
-		SharedConfigState: session.SharedConfigEnable,
-	})
+	cfg, err := config.LoadDefaultConfig(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("connect to S3 session: %w", err)
+		return nil, fmt.Errorf("aws load default config: %w", err)
 	}
-	sess.ClientConfig(s3.ServiceName)
-	return &s3Adapter{sess: sess, svc: s3.New(sess)}, nil
+	return &s3Adapter{svc: s3.NewFromConfig(cfg)}, nil
 }
 
 func (s *s3Adapter) Upload(ctx context.Context, physicalAddress *url.URL, contents io.ReadSeeker) (ObjectStats, error) {
@@ -74,11 +70,13 @@ func (s *s3Adapter) Upload(ctx context.Context, physicalAddress *url.URL, conten
 		return ObjectStats{}, fmt.Errorf("%s: %w", s3Scheme, ErrUnsupportedProtocol)
 	}
 
-	manager := s3manager.NewUploader(s.sess)
-	out, err := manager.UploadWithContext(ctx, &s3manager.UploadInput{
+	key := strings.TrimPrefix(physicalAddress.Path, "/")
+	bucket := physicalAddress.Hostname()
+	uploader := manager.NewUploader(s.svc)
+	out, err := uploader.Upload(ctx, &s3.PutObjectInput{
 		Body:   contents,
-		Bucket: apiutil.Ptr(physicalAddress.Hostname()),
-		Key:    &physicalAddress.Path,
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
 	})
 	if err != nil {
 		return ObjectStats{}, err
@@ -89,7 +87,7 @@ func (s *s3Adapter) Upload(ctx context.Context, physicalAddress *url.URL, conten
 	}
 	return ObjectStats{
 		Size: size,
-		ETag: apiutil.Value(out.ETag),
+		ETag: aws.StringValue(out.ETag),
 		// S3Manager Upload does not return creation time.
 	}, nil
 }
@@ -99,9 +97,11 @@ func (s *s3Adapter) Download(ctx context.Context, physicalAddress *url.URL) (io.
 		return nil, fmt.Errorf("%s: %w", s3Scheme, ErrUnsupportedProtocol)
 	}
 	// TODO(ariels): Allow customization of request
-	getObjectResponse, err := s.svc.GetObjectWithContext(ctx, &s3.GetObjectInput{
-		Bucket: apiutil.Ptr(physicalAddress.Hostname()),
-		Key:    &physicalAddress.Path,
+	bucket := physicalAddress.Hostname()
+	key := strings.TrimPrefix(physicalAddress.Path, "/")
+	getObjectResponse, err := s.svc.GetObject(ctx, &s3.GetObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
 	})
 	if err != nil {
 		return nil, err
diff --git a/pkg/api/helpers/upload.go b/pkg/api/helpers/upload.go
index 1ce8cdfd3b7..4d0c71b97cf 100644
--- a/pkg/api/helpers/upload.go
+++ b/pkg/api/helpers/upload.go
@@ -1,4 +1,4 @@
-// Package helpers provides useful wrappers for clients using the lakeFS OpenAPI.
+// Package helpers provide useful wrappers for clients using the lakeFS OpenAPI.
 package helpers
 
 import (
diff --git a/pkg/auth/model/model.go b/pkg/auth/model/model.go
index a205804c5b7..7ae0af08c65 100644
--- a/pkg/auth/model/model.go
+++ b/pkg/auth/model/model.go
@@ -21,7 +21,6 @@ const (
 	StatementEffectAllow   = "allow"
 	StatementEffectDeny    = "deny"
 	PartitionKey           = "auth"
-	PackageName            = "auth"
 	groupsPrefix           = "groups"
 	groupsUsersPrefix      = "gUsers"
 	groupsPoliciesPrefix   = "gPolicies"
@@ -350,14 +349,6 @@ func protoFromStatements(s *Statements) []*StatementData {
 	return statements
 }
 
-func ConvertUsersList(users []*DBUser) []*User {
-	kvUsers := make([]*User, 0, len(users))
-	for _, u := range users {
-		kvUsers = append(kvUsers, &u.User)
-	}
-	return kvUsers
-}
-
 func ConvertUsersDataList(users []proto.Message) []*User {
 	kvUsers := make([]*User, 0, len(users))
 	for _, u := range users {
@@ -367,25 +358,6 @@ func ConvertUsersDataList(users []proto.Message) []*User {
 	return kvUsers
 }
 
-func ConvertCredList(creds []*DBCredential, username string) []*Credential {
-	res := make([]*Credential, 0, len(creds))
-	for _, c := range creds {
-		res = append(res, &Credential{
-			Username:       username,
-			BaseCredential: c.BaseCredential,
-		})
-	}
-	return res
-}
-
-func ConvertGroupList(groups []*DBGroup) []*Group {
-	res := make([]*Group, 0, len(groups))
-	for _, g := range groups {
-		res = append(res, &g.Group)
-	}
-	return res
-}
-
 func ConvertGroupDataList(group []proto.Message) []*Group {
 	res := make([]*Group, 0, len(group))
 	for _, g := range group {
diff --git a/pkg/auth/model/validation.go b/pkg/auth/model/validation.go
index bd310c24331..e036590e697 100644
--- a/pkg/auth/model/validation.go
+++ b/pkg/auth/model/validation.go
@@ -5,14 +5,12 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/treeverse/lakefs/pkg/kv"
 	"github.com/treeverse/lakefs/pkg/permissions"
 )
 
-var (
-	ErrValidationError = errors.New("validation error")
-)
+var ErrValidationError = errors.New("validation error")
 
 func ValidateAuthEntityID(name string) error {
 	if len(name) == 0 {
diff --git a/pkg/auth/service.go b/pkg/auth/service.go
index a6bb337e717..1dd6973441c 100644
--- a/pkg/auth/service.go
+++ b/pkg/auth/service.go
@@ -13,7 +13,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/deepmap/oapi-codegen/pkg/securityprovider"
 	"github.com/getkin/kin-openapi/openapi3filter"
 	"github.com/go-openapi/swag"
@@ -1714,7 +1714,7 @@ func (a *APIAuthService) GetCredentials(ctx context.Context, accessKeyID string)
 		if credentials == nil {
 			return nil, fmt.Errorf("get credentials api %w", ErrInvalidResponse)
 		}
-		username := aws.StringValue(credentials.UserName)
+		username := aws.ToString(credentials.UserName)
 		if username == "" {
 			user, err := a.GetUserByID(ctx, model.ConvertDBID(credentials.UserId))
 			if err != nil {
diff --git a/pkg/block/adapter.go b/pkg/block/adapter.go
index c3373597ba1..75f3ac3383b 100644
--- a/pkg/block/adapter.go
+++ b/pkg/block/adapter.go
@@ -130,11 +130,11 @@ type Properties struct {
 }
 
 type Adapter interface {
-	InventoryGenerator
 	Put(ctx context.Context, obj ObjectPointer, sizeBytes int64, reader io.Reader, opts PutOpts) error
 	Get(ctx context.Context, obj ObjectPointer, expectedSize int64) (io.ReadCloser, error)
 	GetWalker(uri *url.URL) (Walker, error)
-	// Returns a presigned URL for accessing obj with mode, and the
+
+	// GetPreSignedURL returns a pre-signed URL for accessing obj with mode, and the
 	// expiry time for this URL.  The expiry time IsZero() if reporting
 	// expiry is not supported.  The expiry time will be sooner than
 	// Config.*.PreSignedExpiry if an auth token is about to expire.
diff --git a/pkg/block/azure/adapter.go b/pkg/block/azure/adapter.go
index eb5cdd041cf..6e0850dc796 100644
--- a/pkg/block/azure/adapter.go
+++ b/pkg/block/azure/adapter.go
@@ -143,10 +143,6 @@ func resolveBlobURLInfo(obj block.ObjectPointer) (BlobURLInfo, error) {
 	return ResolveBlobURLInfoFromURL(parsedKey)
 }
 
-func (a *Adapter) GenerateInventory(_ context.Context, _ logging.Logger, _ string, _ bool, _ []string) (block.Inventory, error) {
-	return nil, fmt.Errorf("inventory %w", ErrNotImplemented)
-}
-
 func (a *Adapter) translatePutOpts(ctx context.Context, opts block.PutOpts) azblob.UploadStreamOptions {
 	res := azblob.UploadStreamOptions{}
 	if opts.StorageClass == nil {
diff --git a/pkg/block/blocktest/adapter.go b/pkg/block/blocktest/adapter.go
index e28cb639196..322691038be 100644
--- a/pkg/block/blocktest/adapter.go
+++ b/pkg/block/blocktest/adapter.go
@@ -50,7 +50,7 @@ func testAdapterPutGet(t *testing.T, adapter block.Adapter, storageNamespace, ex
 			obj := block.ObjectPointer{
 				StorageNamespace: storageNamespace,
 				Identifier:       c.path,
-				IdentifierType:   block.IdentifierTypeRelative,
+				IdentifierType:   c.identifierType,
 			}
 
 			err := adapter.Put(ctx, obj, size, strings.NewReader(contents), block.PutOpts{})
diff --git a/pkg/block/factory/build.go b/pkg/block/factory/build.go
index fa9920b61e1..f318c9ba747 100644
--- a/pkg/block/factory/build.go
+++ b/pkg/block/factory/build.go
@@ -2,15 +2,10 @@ package factory
 
 import (
 	"context"
-	"crypto/tls"
 	"fmt"
-	"net/http"
 
 	"cloud.google.com/go/storage"
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/treeverse/lakefs/pkg/block"
 	"github.com/treeverse/lakefs/pkg/block/azure"
 	"github.com/treeverse/lakefs/pkg/block/gs"
@@ -85,45 +80,18 @@ func buildLocalAdapter(ctx context.Context, params params.Local) (*local.Adapter
 	return adapter, nil
 }
 
-func BuildS3Client(awsConfig *aws.Config, webIdentity *params.S3WebIdentity, skipVerifyCertificateTestOnly bool) (*session.Session, error) {
-	client := http.DefaultClient
-	if skipVerifyCertificateTestOnly {
-		tr := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
-		}
-		client = &http.Client{Transport: tr}
-	}
-	opts := session.Options{}
-	opts.Config.MergeIn(awsConfig, aws.NewConfig().WithHTTPClient(client))
-	if webIdentity != nil {
-		wi := *webIdentity // Copy WebIdentity: it will be used asynchronously.
-		opts.CredentialsProviderOptions = &session.CredentialsProviderOptions{
-			WebIdentityRoleProviderOptions: func(wirp *stscreds.WebIdentityRoleProvider) {
-				if wi.SessionDuration > 0 {
-					wirp.Duration = wi.SessionDuration
-				}
-				if wi.SessionExpiryWindow > 0 {
-					wirp.ExpiryWindow = wi.SessionExpiryWindow
-				}
-			},
-		}
-	}
-	sess, err := session.NewSessionWithOptions(opts)
+func BuildS3Client(ctx context.Context, params params.S3) (*s3.Client, error) {
+	cfg, err := s3a.LoadConfig(ctx, params)
 	if err != nil {
 		return nil, err
 	}
-	sess.ClientConfig(s3.ServiceName)
-	return sess, nil
+
+	client := s3.NewFromConfig(cfg, s3a.WithClientParams(params))
+	return client, nil
 }
 
 func buildS3Adapter(ctx context.Context, statsCollector stats.Collector, params params.S3) (*s3a.Adapter, error) {
-	sess, err := BuildS3Client(params.AwsConfig, params.WebIdentity, params.SkipVerifyCertificateTestOnly)
-	if err != nil {
-		return nil, err
-	}
 	opts := []s3a.AdapterOption{
-		s3a.WithStreamingChunkSize(params.StreamingChunkSize),
-		s3a.WithStreamingChunkTimeout(params.StreamingChunkTimeout),
 		s3a.WithStatsCollector(statsCollector),
 		s3a.WithDiscoverBucketRegion(params.DiscoverBucketRegion),
 		s3a.WithPreSignedExpiry(params.PreSignedExpiry),
@@ -136,10 +104,10 @@ func buildS3Adapter(ctx context.Context, statsCollector stats.Collector, params
 	if params.ServerSideEncryptionKmsKeyID != "" {
 		opts = append(opts, s3a.WithServerSideEncryptionKmsKeyID(params.ServerSideEncryptionKmsKeyID))
 	}
-	if params.WebIdentity != nil && params.WebIdentity.SessionExpiryWindow > 0 {
-		opts = append(opts, s3a.WithPreSignedRefreshWindow(params.WebIdentity.SessionExpiryWindow))
+	adapter, err := s3a.NewAdapter(ctx, params, opts...)
+	if err != nil {
+		return nil, err
 	}
-	adapter := s3a.NewAdapter(sess, opts...)
 	logging.FromContext(ctx).WithField("type", "s3").Info("initialized blockstore adapter")
 	return adapter, nil
 }
diff --git a/pkg/block/gs/adapter.go b/pkg/block/gs/adapter.go
index 0d9c7666efb..ff4943ea26b 100644
--- a/pkg/block/gs/adapter.go
+++ b/pkg/block/gs/adapter.go
@@ -529,10 +529,6 @@ func (a *Adapter) composeMultipartUploadParts(ctx context.Context, bucketName st
 	return targetAttrs, nil
 }
 
-func (a *Adapter) GenerateInventory(_ context.Context, _ logging.Logger, _ string, _ bool, _ []string) (block.Inventory, error) {
-	return nil, fmt.Errorf("inventory %w", ErrNotImplemented)
-}
-
 func (a *Adapter) Close() error {
 	return a.client.Close()
 }
diff --git a/pkg/block/gs/stream.go b/pkg/block/gs/stream.go
deleted file mode 100644
index 7e5eef96d29..00000000000
--- a/pkg/block/gs/stream.go
+++ /dev/null
@@ -1,152 +0,0 @@
-package gs
-
-import (
-	"bytes"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io"
-	"time"
-
-	"github.com/treeverse/lakefs/pkg/logging"
-
-	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
-)
-
-type StreamingReader struct {
-	Reader       io.Reader
-	Size         int
-	StreamSigner *v4.StreamSigner
-	Time         time.Time
-	ChunkSize    int
-	ChunkTimeout time.Duration
-
-	currentChunk io.Reader
-	totalRead    int
-	eof          bool
-}
-
-func chunkBoundary(signature []byte, length int) []byte {
-	return []byte(fmt.Sprintf("%x;chunk-signature=%s\r\n", length, hex.EncodeToString(signature)))
-}
-
-func isEOF(err error) bool {
-	return err == io.EOF || errors.Is(err, io.ErrUnexpectedEOF)
-}
-
-func (s *StreamingReader) GetLastChunk() []byte {
-	res := make([]byte, 0)
-	sig, _ := s.StreamSigner.GetSignature([]byte{}, []byte{}, s.Time)
-	lastBoundary := chunkBoundary(sig, 0)
-	res = append(res, lastBoundary...)
-	res = append(res, '\r', '\n') // additional \r\n after the last boundary
-	return res
-}
-
-// ReadAllWithTimeout is taken from io.ReadAtLeast and adapted to support a timeout
-func ReadAllWithTimeout(r io.Reader, buf []byte, timeout time.Duration) (n int, err error) {
-	desired := len(buf)
-
-	lg := logging.ContextUnavailable().WithFields(logging.Fields{
-		"timeout":      timeout,
-		"desired_size": desired,
-	})
-
-	start := time.Now()
-	timedOut := false
-	for n < desired && err == nil {
-		var nn int
-		nn, err = r.Read(buf[n:])
-		n += nn
-
-		if time.Since(start) > timeout {
-			timedOut = true
-			break
-		}
-	}
-	if n >= desired {
-		err = nil
-	} else if n > 0 && err == io.EOF {
-		err = io.ErrUnexpectedEOF
-	}
-	if err == nil && timedOut {
-		err = ErrReaderTimeout
-		lg.WithField("n", n).Warn("duration passed, reader timed out")
-	}
-	return
-}
-
-var ErrReaderTimeout = errors.New("reader timeout")
-
-func (s *StreamingReader) readNextChunk() error {
-	buf := make([]byte, s.ChunkSize)
-	n, err := ReadAllWithTimeout(s.Reader, buf, s.ChunkTimeout)
-	s.totalRead += n
-	buf = buf[:n]
-	if err != nil && !isEOF(err) && !errors.Is(err, ErrReaderTimeout) {
-		// actual error happened
-		return err
-	}
-	if n == 0 {
-		if s.currentChunk == nil {
-			s.currentChunk = bytes.NewBuffer(s.GetLastChunk())
-		}
-		return io.EOF
-	}
-	sig, sigErr := s.StreamSigner.GetSignature([]byte{}, buf, s.Time)
-	if sigErr != nil {
-		return sigErr
-	}
-
-	buf = append(buf, '\r', '\n') // additional \r\n after the content
-	boundary := chunkBoundary(sig, n)
-	if isEOF(err) || s.totalRead == s.Size {
-		// we're done with the upstream Reader, let's write one last chunk boundary.
-		buf = append(buf, s.GetLastChunk()...)
-	}
-	buf = append(boundary, buf...)
-	s.currentChunk = bytes.NewBuffer(buf)
-	if s.totalRead == s.Size {
-		err = io.EOF
-	}
-	if errors.Is(err, ErrReaderTimeout) {
-		return nil // a slow reader shouldn't fail.
-	}
-	return err
-}
-
-func (s *StreamingReader) Read(p []byte) (int, error) {
-	if s.eof {
-		return 0, io.EOF
-	}
-
-	var nerr error
-	var currentN int
-	if s.currentChunk == nil {
-		nerr = s.readNextChunk()
-		if nerr != nil && !isEOF(nerr) {
-			return currentN, nerr
-		}
-	}
-
-	for currentN < len(p) {
-		n, err := s.currentChunk.Read(p[currentN:])
-		currentN += n
-		if err != nil && !isEOF(err) {
-			return currentN, err
-		}
-		if isEOF(err) { // we drained the current chunk
-			if isEOF(nerr) { // no more chunks to read
-				s.eof = true
-				return currentN, io.EOF
-			}
-			// otherwise, we read the entire chunk, let's fill it back up (if n < size of p)
-			nerr = s.readNextChunk()
-			if nerr != nil && !isEOF(nerr) {
-				return currentN, nerr // something bad happened when reading the next chunk
-			}
-		}
-	}
-
-	return currentN, nil
-}
diff --git a/pkg/block/inventory.go b/pkg/block/inventory.go
deleted file mode 100644
index 03d60c31fe5..00000000000
--- a/pkg/block/inventory.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package block
-
-import (
-	"context"
-	"time"
-
-	"github.com/treeverse/lakefs/pkg/cmdutils"
-	"github.com/treeverse/lakefs/pkg/logging"
-)
-
-type InventoryGenerator interface {
-	GenerateInventory(ctx context.Context, logger logging.Logger, inventoryURL string, shouldSort bool, prefixes []string) (Inventory, error)
-}
-
-// Inventory represents a snapshot of the storage space
-type Inventory interface {
-	Iterator() InventoryIterator
-	SourceName() string
-	InventoryURL() string
-}
-
-type InventoryObject struct {
-	Bucket          string
-	Key             string
-	Size            int64
-	LastModified    *time.Time
-	Checksum        string
-	PhysicalAddress string
-}
-
-type InventoryIterator interface {
-	cmdutils.ProgressReporter
-	Next() bool
-	Err() error
-	Get() *InventoryObject
-}
diff --git a/pkg/block/local/adapter.go b/pkg/block/local/adapter.go
index 8380ecdd3a8..de122ef39f0 100644
--- a/pkg/block/local/adapter.go
+++ b/pkg/block/local/adapter.go
@@ -20,7 +20,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/treeverse/lakefs/pkg/block"
 	"github.com/treeverse/lakefs/pkg/block/params"
-	"github.com/treeverse/lakefs/pkg/logging"
 	"golang.org/x/exp/slices"
 )
 
@@ -520,10 +519,6 @@ func (l *Adapter) getPartFiles(uploadID string, obj block.ObjectPointer) ([]stri
 	return names, nil
 }
 
-func (l *Adapter) GenerateInventory(_ context.Context, _ logging.Logger, _ string, _ bool, _ []string) (block.Inventory, error) {
-	return nil, ErrInventoryNotSupported
-}
-
 func (l *Adapter) BlockstoreType() string {
 	return block.BlockstoreTypeLocal
 }
diff --git a/pkg/block/mem/adapter.go b/pkg/block/mem/adapter.go
index bab67ba81a6..fc1a294bdaa 100644
--- a/pkg/block/mem/adapter.go
+++ b/pkg/block/mem/adapter.go
@@ -17,7 +17,6 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/treeverse/lakefs/pkg/block"
-	"github.com/treeverse/lakefs/pkg/logging"
 )
 
 var (
@@ -338,10 +337,6 @@ func (a *Adapter) CompleteMultiPartUpload(_ context.Context, obj block.ObjectPoi
 	}, nil
 }
 
-func (a *Adapter) GenerateInventory(_ context.Context, _ logging.Logger, _ string, _ bool, _ []string) (block.Inventory, error) {
-	return nil, ErrInventoryNotImplemented
-}
-
 func (a *Adapter) BlockstoreType() string {
 	return block.BlockstoreTypeMem
 }
diff --git a/pkg/block/params/block.go b/pkg/block/params/block.go
index 771700f1941..7a84e5e66c9 100644
--- a/pkg/block/params/block.go
+++ b/pkg/block/params/block.go
@@ -2,8 +2,6 @@ package params
 
 import (
 	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
 )
 
 // AdapterConfig configures a block adapter.
@@ -37,10 +35,20 @@ type S3WebIdentity struct {
 	SessionExpiryWindow time.Duration
 }
 
+type S3Credentials struct {
+	AccessKeyID     string
+	SecretAccessKey string
+	SessionToken    string
+}
+
 type S3 struct {
-	AwsConfig                     *aws.Config
-	StreamingChunkSize            int
-	StreamingChunkTimeout         time.Duration
+	Region                        string
+	Profile                       string
+	CredentialsFile               string
+	Credentials                   S3Credentials
+	MaxRetries                    int
+	Endpoint                      string
+	ForcePathStyle                bool
 	DiscoverBucketRegion          bool
 	SkipVerifyCertificateTestOnly bool
 	ServerSideEncryption          string
@@ -48,6 +56,8 @@ type S3 struct {
 	PreSignedExpiry               time.Duration
 	DisablePreSigned              bool
 	DisablePreSignedUI            bool
+	ClientLogRetries              bool
+	ClientLogRequest              bool
 	WebIdentity                   *S3WebIdentity
 }
 
diff --git a/pkg/block/s3/adapter.go b/pkg/block/s3/adapter.go
index a7f04f300fd..53e24aacb9f 100644
--- a/pkg/block/s3/adapter.go
+++ b/pkg/block/s3/adapter.go
@@ -2,35 +2,32 @@ package s3
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"strings"
-	"sync"
+	"sync/atomic"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/aws/session"
-	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/aws/smithy-go/middleware"
+	smithyhttp "github.com/aws/smithy-go/transport/http"
 	"github.com/treeverse/lakefs/pkg/block"
+	"github.com/treeverse/lakefs/pkg/block/params"
 	"github.com/treeverse/lakefs/pkg/logging"
 	"github.com/treeverse/lakefs/pkg/stats"
 )
 
-const (
-	DefaultStreamingChunkSize    = 2 << 19         // 1MiB by default per chunk
-	DefaultStreamingChunkTimeout = time.Second * 1 // if we haven't read DefaultStreamingChunkSize by this duration, write whatever we have as a chunk
-
-	// Chunks smaller than that are only allowed for the last chunk upload
-	minChunkSize = 8 * 1024
-)
-
 var (
 	ErrS3          = errors.New("s3 error")
 	ErrMissingETag = fmt.Errorf("%w: missing ETag", ErrS3)
@@ -38,31 +35,15 @@ var (
 
 type Adapter struct {
 	clients                      *ClientCache
-	httpClient                   *http.Client
-	streamingChunkSize           int
-	streamingChunkTimeout        time.Duration
-	respServer                   string
-	respServerLock               sync.Mutex
+	respServer                   atomic.Pointer[string]
 	ServerSideEncryption         string
 	ServerSideEncryptionKmsKeyID string
 	preSignedExpiry              time.Duration
-	preSignedRefreshWindow       time.Duration
+	sessionExpiryWindow          time.Duration
 	disablePreSigned             bool
 	disablePreSignedUI           bool
 }
 
-func WithStreamingChunkSize(sz int) func(a *Adapter) {
-	return func(a *Adapter) {
-		a.streamingChunkSize = sz
-	}
-}
-
-func WithStreamingChunkTimeout(d time.Duration) func(a *Adapter) {
-	return func(a *Adapter) {
-		a.streamingChunkTimeout = d
-	}
-}
-
 func WithStatsCollector(s stats.Collector) func(a *Adapter) {
 	return func(a *Adapter) {
 		a.clients.SetStatsCollector(s)
@@ -75,12 +56,6 @@ func WithDiscoverBucketRegion(b bool) func(a *Adapter) {
 	}
 }
 
-func WithPreSignedRefreshWindow(v time.Duration) func(a *Adapter) {
-	return func(a *Adapter) {
-		a.preSignedRefreshWindow = v
-	}
-}
-
 func WithPreSignedExpiry(v time.Duration) func(a *Adapter) {
 	return func(a *Adapter) {
 		a.preSignedExpiry = v
@@ -117,18 +92,98 @@ func WithServerSideEncryptionKmsKeyID(s string) func(a *Adapter) {
 
 type AdapterOption func(a *Adapter)
 
-func NewAdapter(awsSession *session.Session, opts ...AdapterOption) *Adapter {
+func NewAdapter(ctx context.Context, params params.S3, opts ...AdapterOption) (*Adapter, error) {
+	cfg, err := LoadConfig(ctx, params)
+	if err != nil {
+		return nil, err
+	}
+	var sessionExpiryWindow time.Duration
+	if params.WebIdentity != nil {
+		sessionExpiryWindow = params.WebIdentity.SessionExpiryWindow
+	}
 	a := &Adapter{
-		clients:               NewClientCache(awsSession),
-		httpClient:            awsSession.Config.HTTPClient,
-		streamingChunkSize:    DefaultStreamingChunkSize,
-		streamingChunkTimeout: DefaultStreamingChunkTimeout,
-		preSignedExpiry:       block.DefaultPreSignExpiryDuration,
+		clients:             NewClientCache(cfg, params),
+		preSignedExpiry:     block.DefaultPreSignExpiryDuration,
+		sessionExpiryWindow: sessionExpiryWindow,
 	}
 	for _, opt := range opts {
 		opt(a)
 	}
-	return a
+	return a, nil
+}
+
+func LoadConfig(ctx context.Context, params params.S3) (aws.Config, error) {
+	var opts []func(*config.LoadOptions) error
+
+	opts = append(opts, config.WithLogger(&logging.AWSAdapter{
+		Logger: logging.ContextUnavailable().WithField("sdk", "aws"),
+	}))
+	var logMode aws.ClientLogMode
+	if params.ClientLogRetries {
+		logMode |= aws.LogRetries
+	}
+	if params.ClientLogRequest {
+		logMode |= aws.LogRequest
+	}
+	if logMode != 0 {
+		opts = append(opts, config.WithClientLogMode(logMode))
+	}
+	if params.Region != "" {
+		opts = append(opts, config.WithRegion(params.Region))
+	}
+	if params.Profile != "" {
+		opts = append(opts, config.WithSharedConfigProfile(params.Profile))
+	}
+	if params.CredentialsFile != "" {
+		opts = append(opts, config.WithSharedCredentialsFiles([]string{params.CredentialsFile}))
+	}
+	if params.Credentials.AccessKeyID != "" {
+		opts = append(opts, config.WithCredentialsProvider(
+			credentials.NewStaticCredentialsProvider(
+				params.Credentials.AccessKeyID,
+				params.Credentials.SecretAccessKey,
+				params.Credentials.SessionToken,
+			),
+		))
+	}
+	if params.MaxRetries > 0 {
+		opts = append(opts, config.WithRetryMaxAttempts(params.MaxRetries))
+	}
+	if params.SkipVerifyCertificateTestOnly {
+		tr := &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
+		}
+		opts = append(opts, config.WithHTTPClient(&http.Client{Transport: tr}))
+	}
+	if params.WebIdentity != nil {
+		wi := *params.WebIdentity // Copy WebIdentity: it will be used asynchronously.
+		if wi.SessionDuration > 0 {
+			opts = append(opts, config.WithWebIdentityRoleCredentialOptions(
+				func(options *stscreds.WebIdentityRoleOptions) {
+					options.Duration = wi.SessionDuration
+				}),
+			)
+		}
+		if wi.SessionExpiryWindow > 0 {
+			opts = append(opts, config.WithCredentialsCacheOptions(
+				func(options *aws.CredentialsCacheOptions) {
+					options.ExpiryWindow = wi.SessionExpiryWindow
+				}),
+			)
+		}
+	}
+	return config.LoadDefaultConfig(ctx, opts...)
+}
+
+func WithClientParams(params params.S3) func(options *s3.Options) {
+	return func(options *s3.Options) {
+		if params.Endpoint != "" {
+			options.BaseEndpoint = aws.String(params.Endpoint)
+		}
+		if params.ForcePathStyle {
+			options.UsePathStyle = true
+		}
+	}
 }
 
 func (a *Adapter) log(ctx context.Context) logging.Logger {
@@ -145,151 +200,118 @@ func (a *Adapter) Put(ctx context.Context, obj block.ObjectPointer, sizeBytes in
 		return a.managerUpload(ctx, obj, reader, opts)
 	}
 
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(obj)
+	bucket, key, _, err := a.extractParamsFromObj(obj)
 	if err != nil {
 		return err
 	}
 
 	putObject := s3.PutObjectInput{
-		Bucket:       aws.String(bucket),
-		Key:          aws.String(key),
-		StorageClass: opts.StorageClass,
+		Bucket:        aws.String(bucket),
+		Key:           aws.String(key),
+		Body:          reader,
+		ContentLength: sizeBytes,
+	}
+	if sizeBytes == 0 {
+		putObject.Body = http.NoBody
+	}
+	if opts.StorageClass != nil {
+		putObject.StorageClass = types.StorageClass(*opts.StorageClass)
 	}
 	if a.ServerSideEncryption != "" {
-		putObject.SetServerSideEncryption(a.ServerSideEncryption)
+		putObject.ServerSideEncryption = types.ServerSideEncryption(a.ServerSideEncryption)
 	}
 	if a.ServerSideEncryptionKmsKeyID != "" {
-		putObject.SetSSEKMSKeyId(a.ServerSideEncryptionKmsKeyID)
+		putObject.SSEKMSKeyId = aws.String(a.ServerSideEncryptionKmsKeyID)
 	}
 
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	sdkRequest, _ := client.PutObjectRequest(&putObject)
-	headers, err := a.streamToS3(ctx, sdkRequest, sizeBytes, reader)
+	client := a.clients.Get(ctx, bucket)
+	resp, err := client.PutObject(ctx, &putObject,
+		retryMaxAttemptsByReader(reader),
+		s3.WithAPIOptions(v4.SwapComputePayloadSHA256ForUnsignedPayloadMiddleware),
+		a.registerCaptureServerMiddleware(),
+	)
 	if err != nil {
 		return err
 	}
-	etag := headers.Get("ETag")
+	etag := aws.ToString(resp.ETag)
 	if etag == "" {
 		return ErrMissingETag
 	}
-	return err
+	return nil
 }
 
-func (a *Adapter) UploadPart(ctx context.Context, obj block.ObjectPointer, sizeBytes int64, reader io.Reader, uploadID string, partNumber int) (*block.UploadPartResponse, error) {
-	var err error
-	defer reportMetrics("UploadPart", time.Now(), &sizeBytes, &err)
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(obj)
-	if err != nil {
-		return nil, err
+// retryMaxAttemptsByReader return s3 options function
+// setup RetryMaxAttempts - if the reader is not seekable, we can't retry the request
+func retryMaxAttemptsByReader(reader io.Reader) func(*s3.Options) {
+	return func(o *s3.Options) {
+		if _, ok := reader.(io.Seeker); !ok {
+			o.RetryMaxAttempts = 1
+		}
 	}
+}
 
-	uploadPartObject := s3.UploadPartInput{
-		Bucket:     aws.String(bucket),
-		Key:        aws.String(key),
-		PartNumber: aws.Int64(int64(partNumber)),
-		UploadId:   aws.String(uploadID),
-	}
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	sdkRequest, _ := client.UploadPartRequest(&uploadPartObject)
-	headers, err := a.streamToS3(ctx, sdkRequest, sizeBytes, reader)
-	if err != nil {
-		return nil, err
-	}
-	etag := headers.Get("ETag")
-	if etag == "" {
-		return nil, ErrMissingETag
+// captureServerDeserializeMiddleware extracts the server name from the response and sets it on the block adapter
+func (a *Adapter) captureServerDeserializeMiddleware(ctx context.Context, input middleware.DeserializeInput, handler middleware.DeserializeHandler) (middleware.DeserializeOutput, middleware.Metadata, error) {
+	output, m, err := handler.HandleDeserialize(ctx, input)
+	if err == nil {
+		if rawResponse, ok := output.RawResponse.(*smithyhttp.Response); ok {
+			s := rawResponse.Header.Get("Server")
+			if s != "" {
+				a.respServer.Store(&s)
+			}
+		}
 	}
-	return &block.UploadPartResponse{
-		ETag:             strings.Trim(etag, `"`),
-		ServerSideHeader: extractAmzServerSideHeader(headers),
-	}, nil
+	return output, m, err
 }
 
-func (a *Adapter) streamToS3(ctx context.Context, sdkRequest *request.Request, sizeBytes int64, reader io.Reader) (http.Header, error) {
-	sigTime := time.Now()
-	log := a.log(ctx).WithField("operation", "PutObject")
-
-	if err := sdkRequest.Build(); err != nil {
+func (a *Adapter) UploadPart(ctx context.Context, obj block.ObjectPointer, sizeBytes int64, reader io.Reader, uploadID string, partNumber int) (*block.UploadPartResponse, error) {
+	var err error
+	defer reportMetrics("UploadPart", time.Now(), &sizeBytes, &err)
+	bucket, key, _, err := a.extractParamsFromObj(obj)
+	if err != nil {
 		return nil, err
 	}
 
-	req, err := http.NewRequest(sdkRequest.HTTPRequest.Method, sdkRequest.HTTPRequest.URL.String(), nil)
-	if err != nil {
-		return nil, err
+	uploadPartInput := &s3.UploadPartInput{
+		Bucket:        aws.String(bucket),
+		Key:           aws.String(key),
+		PartNumber:    int32(partNumber),
+		UploadId:      aws.String(uploadID),
+		Body:          reader,
+		ContentLength: sizeBytes,
 	}
-	req.Header.Set("Content-Encoding", StreamingContentEncoding)
-	req.Header.Set("Transfer-Encoding", "chunked")
-	req.Header.Set("x-amz-content-sha256", StreamingSha256)
-	req.Header.Set("x-amz-decoded-content-length", fmt.Sprintf("%d", sizeBytes))
 	if a.ServerSideEncryption != "" {
-		req.Header.Set("x-amz-server-side-encryption", a.ServerSideEncryption)
+		uploadPartInput.SSECustomerAlgorithm = &a.ServerSideEncryption
 	}
 	if a.ServerSideEncryptionKmsKeyID != "" {
-		req.Header.Set("x-amz-server-side-encryption-aws-kms-key-id", a.ServerSideEncryptionKmsKeyID)
+		uploadPartInput.SSECustomerKey = &a.ServerSideEncryptionKmsKeyID
 	}
-	req = req.WithContext(ctx)
 
-	baseSigner := v4.NewSigner(sdkRequest.Config.Credentials)
-	baseSigner.DisableURIPathEscaping = true
-	_, err = baseSigner.Sign(req, nil, s3.ServiceName, aws.StringValue(sdkRequest.Config.Region), sigTime)
+	client := a.clients.Get(ctx, bucket)
+	resp, err := client.UploadPart(ctx, uploadPartInput,
+		retryMaxAttemptsByReader(reader),
+		s3.WithAPIOptions(v4.SwapComputePayloadSHA256ForUnsignedPayloadMiddleware),
+		a.registerCaptureServerMiddleware(),
+	)
 	if err != nil {
-		log.WithError(err).Error("failed to sign request")
 		return nil, err
 	}
-	req.Header.Set("Expect", "100-Continue")
-
-	sigSeed, err := v4.GetSignedRequestSignature(req)
-	if err != nil {
-		log.WithError(err).Error("failed to get seed signature")
-		return nil, err
-	}
-
-	req.Body = io.NopCloser(&StreamingReader{
-		Reader: reader,
-		Size:   sizeBytes,
-		Time:   sigTime,
-		StreamSigner: v4.NewStreamSigner(
-			aws.StringValue(sdkRequest.Config.Region),
-			s3.ServiceName,
-			sigSeed,
-			sdkRequest.Config.Credentials,
-		),
-		ChunkSize:    a.streamingChunkSize,
-		ChunkTimeout: a.streamingChunkTimeout,
-	})
-	resp, err := a.httpClient.Do(req)
-	if err != nil {
-		log.WithError(err).
-			WithField("url", sdkRequest.HTTPRequest.URL.String()).
-			Error("error making request")
-		return nil, err
-	}
-
-	defer func() {
-		_ = resp.Body.Close()
-	}()
-
-	if resp.StatusCode != http.StatusOK {
-		body, err := io.ReadAll(resp.Body)
-		if err != nil {
-			err = fmt.Errorf("%w: %d %s (unknown)", ErrS3, resp.StatusCode, resp.Status)
-		} else {
-			err = fmt.Errorf("%w: %s", ErrS3, body)
-		}
-		log.WithError(err).
-			WithField("url", sdkRequest.HTTPRequest.URL.String()).
-			WithField("status_code", resp.StatusCode).
-			Error("bad S3 PutObject response")
-		return nil, err
+	etag := aws.ToString(resp.ETag)
+	if etag == "" {
+		return nil, ErrMissingETag
 	}
-
-	a.extractS3Server(resp)
-	return resp.Header, nil
+	return &block.UploadPartResponse{
+		ETag:             strings.Trim(etag, `"`),
+		ServerSideHeader: extractSSHeaderUploadPart(resp),
+	}, nil
 }
 
 func isErrNotFound(err error) bool {
-	var reqErr awserr.RequestFailure
-	return errors.As(err, &reqErr) && reqErr.StatusCode() == http.StatusNotFound
+	var (
+		errNoSuchKey *types.NoSuchKey
+		errNotFound  *types.NotFound
+	)
+	return errors.As(err, &errNoSuchKey) || errors.As(err, &errNotFound)
 }
 
 func (a *Adapter) Get(ctx context.Context, obj block.ObjectPointer, _ int64) (io.ReadCloser, error) {
@@ -306,9 +328,8 @@ func (a *Adapter) Get(ctx context.Context, obj block.ObjectPointer, _ int64) (io
 		Bucket: aws.String(bucket),
 		Key:    aws.String(key),
 	}
-
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	objectOutput, err := client.GetObjectWithContext(ctx, &getObjectInput)
+	client := a.clients.Get(ctx, bucket)
+	objectOutput, err := client.GetObject(ctx, &getObjectInput)
 	if isErrNotFound(err) {
 		return nil, block.ErrDataNotFound
 	}
@@ -316,7 +337,7 @@ func (a *Adapter) Get(ctx context.Context, obj block.ObjectPointer, _ int64) (io
 		log.WithError(err).Errorf("failed to get S3 object bucket %s key %s", qualifiedKey.GetStorageNamespace(), qualifiedKey.GetKey())
 		return nil, err
 	}
-	sizeBytes = aws.Int64Value(objectOutput.ContentLength)
+	sizeBytes = objectOutput.ContentLength
 	return objectOutput.Body, nil
 }
 
@@ -324,45 +345,20 @@ func (a *Adapter) GetWalker(uri *url.URL) (block.Walker, error) {
 	if err := block.ValidateStorageType(uri, block.StorageTypeS3); err != nil {
 		return nil, err
 	}
-
-	return NewS3Walker(a.clients.awsSession), nil
+	return NewS3Walker(a.clients.GetDefault()), nil
 }
 
-// refreshClientIfNeeded ensure client has some time before its token
-// expires.  It returns the updated expiry time.  It fails with
-// ErrDoesntExpire if the client is not an Expirer,
-func refreshClientIfNeeded(ctx context.Context, client S3APIWithExpirer, refreshWindow time.Duration) (time.Time, error) {
-	if client == nil {
-		return time.Time{}, nil
-	}
-
-	expiry, err := client.ExpiresAt()
-	if errors.Is(err, ErrDoesntExpire) {
-		return time.Time{}, ErrDoesntExpire
-	} else if err != nil {
-		return time.Time{}, fmt.Errorf("refresh client if needed: get current expiry: %w", err)
-	}
+type CaptureExpiresPresigner struct {
+	Presigner            s3.HTTPPresignerV4
+	CredentialsCanExpire bool
+	CredentialsExpireAt  time.Time
+}
 
-	ttl := time.Until(expiry)
-	l := logging.FromContext(ctx).WithFields(logging.Fields{
-		"expiry": expiry,
-		"TTL":    ttl.String(),
-	})
-	if ttl < refreshWindow {
-		l.Info("Refresh client as it will expire soon")
-		expiry, err = client.Refresh()
-		if err != nil {
-			return time.Time{}, fmt.Errorf("refresh client if needed: refreshing: %w", err)
-		}
-		ttl = time.Until(expiry)
-		l = l.WithFields(logging.Fields{
-			"expiry": expiry,
-			"TTL":    ttl.String(),
-		})
-		l.Info("Refreshed client")
-	}
-	l.Trace("Got client")
-	return expiry, nil
+func (c *CaptureExpiresPresigner) PresignHTTP(ctx context.Context, credentials aws.Credentials, r *http.Request, payloadHash string, service string, region string, signingTime time.Time, optFns ...func(*v4.SignerOptions)) (url string, signedHeader http.Header, err error) {
+	// capture credentials expiry
+	c.CredentialsCanExpire = credentials.CanExpire
+	c.CredentialsExpireAt = credentials.Expires
+	return c.Presigner.PresignHTTP(ctx, credentials, r, payloadHash, service, region, signingTime, optFns...)
 }
 
 func (a *Adapter) GetPreSignedURL(ctx context.Context, obj block.ObjectPointer, mode block.PreSignMode) (string, time.Time, error) {
@@ -370,81 +366,67 @@ func (a *Adapter) GetPreSignedURL(ctx context.Context, obj block.ObjectPointer,
 		return "", time.Time{}, block.ErrOperationNotSupported
 	}
 
-	log := a.log(ctx).WithField("operation", "GetPreSignedURL")
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(obj)
+	expiry := time.Now().Add(a.preSignedExpiry)
+
+	log := a.log(ctx).WithFields(logging.Fields{
+		"operation":  "GetPreSignedURL",
+		"namespace":  obj.StorageNamespace,
+		"identifier": obj.Identifier,
+		"ttl":        time.Until(expiry),
+	})
+	bucket, key, _, err := a.extractParamsFromObj(obj)
 	if err != nil {
-		log.WithField("namespace", obj.StorageNamespace).
-			WithField("identifier", obj.Identifier).
-			WithError(err).Error("could not resolve namespace")
+		log.WithError(err).Error("could not resolve namespace")
 		return "", time.Time{}, err
 	}
 
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-
-	clientExpiry, clientExpiryErr := refreshClientIfNeeded(ctx, client, a.preSignedRefreshWindow)
+	client := a.clients.Get(ctx, bucket)
+	presigner := s3.NewPresignClient(client,
+		func(options *s3.PresignOptions) {
+			options.Expires = a.preSignedExpiry
+		})
 
-	expiry := time.Now().Add(a.preSignedExpiry)
-	log = log.WithField("expiry", expiry)
-	switch {
-	case clientExpiryErr == nil:
-		if clientExpiry.Before(expiry) && !clientExpiry.IsZero() {
-			log.WithField("client_expiry", clientExpiry).
-				Trace("URL expiry shortened by client expiry")
-			// TODO(ariels): Monitor this?
-			expiry = clientExpiry
-			log = log.WithField("expiry", expiry)
-		}
-	case errors.Is(clientExpiryErr, ErrDoesntExpire):
-		break
-	default:
-		log.WithFields(logging.Fields{
-			"namespace":  obj.StorageNamespace,
-			"identifier": obj.Identifier,
-		}).
-			WithError(err).
-			Warning("Failed to get client (token) expiry: URL expiry may be too high")
-	}
-
-	// BUG(ariels): This is an inherent race.  urlLifetime is computed
-	//     relative to the local clock.  If expiry was shortened because
-	//     of clientExpiry then AWS will determine _remotely_ whether
-	//     the URL expired.  So this URL can expire before the client or
-	//     even lakeFS think that it has.
-	//
-	//     This is a limitation of the AWS SDK, which signs locally, and
-	//     of the AWS S3 API, which does not allow a meaningful
-	//     workaround.
-	urlLifetime := time.Until(expiry)
-	log = log.WithField("TTL", urlLifetime)
-	var preSignedURL string
+	captureExpiresPresigner := &CaptureExpiresPresigner{}
+	var req *v4.PresignedHTTPRequest
 	if mode == block.PreSignModeWrite {
 		putObjectInput := &s3.PutObjectInput{
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
 		}
-		req, _ := client.PutObjectRequest(putObjectInput)
-		preSignedURL, err = req.Presign(urlLifetime)
+		req, err = presigner.PresignPutObject(ctx, putObjectInput, func(o *s3.PresignOptions) {
+			captureExpiresPresigner.Presigner = o.Presigner
+			o.Presigner = captureExpiresPresigner
+		})
 	} else {
 		getObjectInput := &s3.GetObjectInput{
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
 		}
-		req, _ := client.GetObjectRequest(getObjectInput)
-		preSignedURL, err = req.Presign(urlLifetime)
+		req, err = presigner.PresignGetObject(ctx, getObjectInput, func(o *s3.PresignOptions) {
+			captureExpiresPresigner.Presigner = o.Presigner
+			o.Presigner = captureExpiresPresigner
+		})
 	}
 	if err != nil {
-		log.WithField("namespace", obj.StorageNamespace).
-			WithField("identifier", obj.Identifier).
-			WithError(err).Error("could not pre-sign request")
+		log.WithError(err).Error("could not pre-sign request")
+		return "", time.Time{}, err
+	}
+
+	// In case the credentials can expire, we need to use the earliest expiry time
+	// we assume that session expiry window is used and adjust the expiry time accordingly.
+	// AWS Go SDK v2 stores the time to renew credentials in `CredentialsExpireAt`.  This is
+	// a.sessionExpiryWindow before actual credentials expiry.
+	if captureExpiresPresigner.CredentialsCanExpire && captureExpiresPresigner.CredentialsExpireAt.Before(expiry) {
+		expiry = captureExpiresPresigner.CredentialsExpireAt.Add(a.sessionExpiryWindow)
 	}
-	return preSignedURL, expiry, err
+	return req.URL, expiry, nil
 }
 
 func (a *Adapter) Exists(ctx context.Context, obj block.ObjectPointer) (bool, error) {
 	var err error
 	defer reportMetrics("Exists", time.Now(), nil, &err)
 	log := a.log(ctx).WithField("operation", "HeadObject")
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(obj)
+	bucket, key, _, err := a.extractParamsFromObj(obj)
 	if err != nil {
 		return false, err
 	}
@@ -453,8 +435,8 @@ func (a *Adapter) Exists(ctx context.Context, obj block.ObjectPointer) (bool, er
 		Bucket: aws.String(bucket),
 		Key:    aws.String(key),
 	}
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	_, err = client.HeadObjectWithContext(ctx, &input)
+	client := a.clients.Get(ctx, bucket)
+	_, err = client.HeadObject(ctx, &input)
 	if isErrNotFound(err) {
 		return false, nil
 	}
@@ -469,7 +451,7 @@ func (a *Adapter) GetRange(ctx context.Context, obj block.ObjectPointer, startPo
 	var err error
 	var sizeBytes int64
 	defer reportMetrics("GetRange", time.Now(), &sizeBytes, &err)
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(obj)
+	bucket, key, _, err := a.extractParamsFromObj(obj)
 	if err != nil {
 		return nil, err
 	}
@@ -479,8 +461,8 @@ func (a *Adapter) GetRange(ctx context.Context, obj block.ObjectPointer, startPo
 		Key:    aws.String(key),
 		Range:  aws.String(fmt.Sprintf("bytes=%d-%d", startPosition, endPosition)),
 	}
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	objectOutput, err := client.GetObjectWithContext(ctx, &getObjectInput)
+	client := a.clients.Get(ctx, bucket)
+	objectOutput, err := client.GetObject(ctx, &getObjectInput)
 	if isErrNotFound(err) {
 		return nil, block.ErrDataNotFound
 	}
@@ -491,14 +473,14 @@ func (a *Adapter) GetRange(ctx context.Context, obj block.ObjectPointer, startPo
 		}).Error("failed to get S3 object range")
 		return nil, err
 	}
-	sizeBytes = aws.Int64Value(objectOutput.ContentLength)
+	sizeBytes = objectOutput.ContentLength
 	return objectOutput.Body, nil
 }
 
 func (a *Adapter) GetProperties(ctx context.Context, obj block.ObjectPointer) (block.Properties, error) {
 	var err error
 	defer reportMetrics("GetProperties", time.Now(), nil, &err)
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(obj)
+	bucket, key, _, err := a.extractParamsFromObj(obj)
 	if err != nil {
 		return block.Properties{}, err
 	}
@@ -507,36 +489,42 @@ func (a *Adapter) GetProperties(ctx context.Context, obj block.ObjectPointer) (b
 		Bucket: aws.String(bucket),
 		Key:    aws.String(key),
 	}
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	s3Props, err := client.HeadObjectWithContext(ctx, headObjectParams)
+	client := a.clients.Get(ctx, bucket)
+	s3Props, err := client.HeadObject(ctx, headObjectParams)
 	if err != nil {
 		return block.Properties{}, err
 	}
-	return block.Properties{StorageClass: s3Props.StorageClass}, nil
+	return block.Properties{
+		StorageClass: aws.String(string(s3Props.StorageClass)),
+	}, nil
 }
 
 func (a *Adapter) Remove(ctx context.Context, obj block.ObjectPointer) error {
 	var err error
 	defer reportMetrics("Remove", time.Now(), nil, &err)
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(obj)
+	bucket, key, _, err := a.extractParamsFromObj(obj)
 	if err != nil {
 		return err
 	}
-	deleteObjectParams := &s3.DeleteObjectInput{
+
+	deleteInput := &s3.DeleteObjectInput{
 		Bucket: aws.String(bucket),
 		Key:    aws.String(key),
 	}
-	svc := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	_, err = svc.DeleteObjectWithContext(ctx, deleteObjectParams)
+	client := a.clients.Get(ctx, bucket)
+	_, err = client.DeleteObject(ctx, deleteInput)
 	if err != nil {
 		a.log(ctx).WithError(err).Error("failed to delete S3 object")
 		return err
 	}
-	err = svc.WaitUntilObjectNotExistsWithContext(ctx, &s3.HeadObjectInput{
+
+	headInput := &s3.HeadObjectInput{
 		Bucket: aws.String(bucket),
 		Key:    aws.String(key),
-	})
-	return err
+	}
+	const maxWaitDur = 100 * time.Second
+	waiter := s3.NewObjectNotExistsWaiter(client)
+	return waiter.Wait(ctx, headInput, maxWaitDur)
 }
 
 func (a *Adapter) copyPart(ctx context.Context, sourceObj, destinationObj block.ObjectPointer, uploadID string, partNumber int, byteRange *string) (*block.UploadPartResponse, error) {
@@ -545,7 +533,7 @@ func (a *Adapter) copyPart(ctx context.Context, sourceObj, destinationObj block.
 		return nil, err
 	}
 
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(destinationObj)
+	bucket, key, _, err := a.extractParamsFromObj(destinationObj)
 	if err != nil {
 		return nil, err
 	}
@@ -553,34 +541,26 @@ func (a *Adapter) copyPart(ctx context.Context, sourceObj, destinationObj block.
 	uploadPartCopyObject := s3.UploadPartCopyInput{
 		Bucket:     aws.String(bucket),
 		Key:        aws.String(key),
-		PartNumber: aws.Int64(int64(partNumber)),
+		PartNumber: int32(partNumber),
 		UploadId:   aws.String(uploadID),
 		CopySource: aws.String(fmt.Sprintf("%s/%s", srcKey.GetStorageNamespace(), srcKey.GetKey())),
 	}
 	if byteRange != nil {
 		uploadPartCopyObject.CopySourceRange = byteRange
 	}
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	req, resp := client.UploadPartCopyRequest(&uploadPartCopyObject)
-	req.SetContext(ctx)
-	err = req.Send()
+	client := a.clients.Get(ctx, bucket)
+	resp, err := client.UploadPartCopy(ctx, &uploadPartCopyObject)
 	if err != nil {
 		return nil, err
 	}
 	if resp == nil || resp.CopyPartResult == nil || resp.CopyPartResult.ETag == nil {
 		return nil, ErrMissingETag
 	}
+
 	etag := strings.Trim(*resp.CopyPartResult.ETag, `"`)
-	// x-amz-server-side-* headers
-	headers := make(http.Header)
-	for k, v := range req.HTTPResponse.Header {
-		if strings.HasPrefix(k, "X-Amz-Server-Side-") {
-			headers[k] = v
-		}
-	}
 	return &block.UploadPartResponse{
 		ETag:             etag,
-		ServerSideHeader: headers,
+		ServerSideHeader: extractSSHeaderUploadPartCopy(resp),
 	}, nil
 }
 
@@ -611,18 +591,18 @@ func (a *Adapter) Copy(ctx context.Context, sourceObj, destinationObj block.Obje
 		return err
 	}
 
-	copyObjectParams := &s3.CopyObjectInput{
+	copyObjectInput := &s3.CopyObjectInput{
 		Bucket:     aws.String(destBucket),
 		Key:        aws.String(destKey),
 		CopySource: aws.String(qualifiedSourceKey.GetStorageNamespace() + "/" + qualifiedSourceKey.GetKey()),
 	}
 	if a.ServerSideEncryption != "" {
-		copyObjectParams.SetServerSideEncryption(a.ServerSideEncryption)
+		copyObjectInput.ServerSideEncryption = types.ServerSideEncryption(a.ServerSideEncryption)
 	}
 	if a.ServerSideEncryptionKmsKeyID != "" {
-		copyObjectParams.SetSSEKMSKeyId(a.ServerSideEncryptionKmsKeyID)
+		copyObjectInput.SSEKMSKeyId = aws.String(a.ServerSideEncryptionKmsKeyID)
 	}
-	_, err = a.clients.Get(ctx, destBucket).CopyObjectWithContext(ctx, copyObjectParams)
+	_, err = a.clients.Get(ctx, destBucket).CopyObject(ctx, copyObjectInput)
 	if err != nil {
 		a.log(ctx).WithError(err).Error("failed to copy S3 object")
 	}
@@ -638,25 +618,25 @@ func (a *Adapter) CreateMultiPartUpload(ctx context.Context, obj block.ObjectPoi
 	}
 
 	input := &s3.CreateMultipartUploadInput{
-		Bucket:       aws.String(bucket),
-		Key:          aws.String(key),
-		ContentType:  aws.String(""),
-		StorageClass: opts.StorageClass,
+		Bucket:      aws.String(bucket),
+		Key:         aws.String(key),
+		ContentType: aws.String(""),
+	}
+	if opts.StorageClass != nil {
+		input.StorageClass = types.StorageClass(*opts.StorageClass)
 	}
 	if a.ServerSideEncryption != "" {
-		input.SetServerSideEncryption(a.ServerSideEncryption)
+		input.ServerSideEncryption = types.ServerSideEncryption(a.ServerSideEncryption)
 	}
 	if a.ServerSideEncryptionKmsKeyID != "" {
-		input.SetSSEKMSKeyId(a.ServerSideEncryptionKmsKeyID)
+		input.SSEKMSKeyId = &a.ServerSideEncryptionKmsKeyID
 	}
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	req, resp := client.CreateMultipartUploadRequest(input)
-	req.SetContext(ctx)
-	err = req.Send()
+	client := a.clients.Get(ctx, bucket)
+	resp, err := client.CreateMultipartUpload(ctx, input)
 	if err != nil {
 		return nil, err
 	}
-	uploadID := aws.StringValue(resp.UploadId)
+	uploadID := aws.ToString(resp.UploadId)
 	a.log(ctx).WithFields(logging.Fields{
 		"upload_id":     uploadID,
 		"qualified_ns":  qualifiedKey.GetStorageNamespace(),
@@ -665,7 +645,7 @@ func (a *Adapter) CreateMultiPartUpload(ctx context.Context, obj block.ObjectPoi
 	}).Debug("created multipart upload")
 	return &block.CreateMultiPartUploadResponse{
 		UploadID:         uploadID,
-		ServerSideHeader: extractAmzServerSideHeader(req.HTTPResponse.Header),
+		ServerSideHeader: extractSSHeaderCreateMultipartUpload(resp),
 	}, err
 }
 
@@ -682,8 +662,8 @@ func (a *Adapter) AbortMultiPartUpload(ctx context.Context, obj block.ObjectPoin
 		UploadId: aws.String(uploadID),
 	}
 
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	_, err = client.AbortMultipartUploadWithContext(ctx, input)
+	client := a.clients.Get(ctx, bucket)
+	_, err = client.AbortMultipartUpload(ctx, input)
 	lg := a.log(ctx).WithFields(logging.Fields{
 		"upload_id":     uploadID,
 		"qualified_ns":  qualifiedKey.GetStorageNamespace(),
@@ -698,15 +678,15 @@ func (a *Adapter) AbortMultiPartUpload(ctx context.Context, obj block.ObjectPoin
 	return nil
 }
 
-func convertFromBlockMultipartUploadCompletion(multipartList *block.MultipartUploadCompletion) *s3.CompletedMultipartUpload {
-	parts := make([]*s3.CompletedPart, len(multipartList.Part))
-	for i, p := range multipartList.Part {
-		parts[i] = &s3.CompletedPart{
+func convertFromBlockMultipartUploadCompletion(multipartList *block.MultipartUploadCompletion) *types.CompletedMultipartUpload {
+	parts := make([]types.CompletedPart, 0, len(multipartList.Part))
+	for _, p := range multipartList.Part {
+		parts = append(parts, types.CompletedPart{
 			ETag:       aws.String(p.ETag),
-			PartNumber: aws.Int64(int64(p.PartNumber)),
-		}
+			PartNumber: int32(p.PartNumber),
+		})
 	}
-	return &s3.CompletedMultipartUpload{Parts: parts}
+	return &types.CompletedMultipartUpload{Parts: parts}
 }
 
 func (a *Adapter) CompleteMultiPartUpload(ctx context.Context, obj block.ObjectPointer, uploadID string, multipartList *block.MultipartUploadCompletion) (*block.CompleteMultiPartUploadResponse, error) {
@@ -728,27 +708,24 @@ func (a *Adapter) CompleteMultiPartUpload(ctx context.Context, obj block.ObjectP
 		"qualified_key": qualifiedKey.GetKey(),
 		"key":           obj.Identifier,
 	})
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	req, resp := client.CompleteMultipartUploadRequest(input)
-	req.SetContext(ctx)
-	err = req.Send()
+	client := a.clients.Get(ctx, bucket)
+	resp, err := client.CompleteMultipartUpload(ctx, input)
 	if err != nil {
 		lg.WithError(err).Error("CompleteMultipartUpload failed")
 		return nil, err
 	}
 	lg.Debug("completed multipart upload")
 	headInput := &s3.HeadObjectInput{Bucket: &bucket, Key: &key}
-	headResp, err := client.HeadObjectWithContext(ctx, headInput)
+	headResp, err := client.HeadObject(ctx, headInput)
 	if err != nil {
 		return nil, err
 	}
 
-	etag := strings.Trim(aws.StringValue(resp.ETag), `"`)
-	contentLength := aws.Int64Value(headResp.ContentLength)
+	etag := strings.Trim(aws.ToString(resp.ETag), `"`)
 	return &block.CompleteMultiPartUploadResponse{
 		ETag:             etag,
-		ContentLength:    contentLength,
-		ServerSideHeader: extractAmzServerSideHeader(req.HTTPResponse.Header),
+		ContentLength:    headResp.ContentLength,
+		ServerSideHeader: extractSSHeaderCompleteMultipartUpload(resp),
 	}, nil
 }
 
@@ -783,75 +760,48 @@ func (a *Adapter) ResolveNamespace(storageNamespace, key string, identifierType
 }
 
 func (a *Adapter) RuntimeStats() map[string]string {
-	a.respServerLock.Lock()
-	defer a.respServerLock.Unlock()
-	if a.respServer == "" {
+	respServer := aws.ToString(a.respServer.Load())
+	if respServer == "" {
 		return nil
 	}
 	return map[string]string{
-		"resp_server": a.respServer,
+		"resp_server": respServer,
 	}
 }
 
-func (a *Adapter) extractS3Server(resp *http.Response) {
-	if resp == nil || resp.Header == nil {
-		return
-	}
-
-	// Extract the responding server from the response.
-	// Expected values: "S3" from AWS, "MinIO" for MinIO. Others unknown.
-	server := resp.Header.Get("Server")
-	if server == "" {
-		return
-	}
-
-	a.respServerLock.Lock()
-	defer a.respServerLock.Unlock()
-	a.respServer = server
-}
-
 func (a *Adapter) managerUpload(ctx context.Context, obj block.ObjectPointer, reader io.Reader, opts block.PutOpts) error {
-	bucket, key, qualifiedKey, err := a.extractParamsFromObj(obj)
+	bucket, key, _, err := a.extractParamsFromObj(obj)
 	if err != nil {
 		return err
 	}
 
-	client := a.clients.Get(ctx, qualifiedKey.GetStorageNamespace())
-	uploader := s3manager.NewUploaderWithClient(client)
-	input := &s3manager.UploadInput{
-		Bucket:       aws.String(bucket),
-		Key:          aws.String(key),
-		Body:         reader,
-		StorageClass: opts.StorageClass,
+	client := a.clients.Get(ctx, bucket)
+	uploader := manager.NewUploader(client)
+	input := &s3.PutObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+		Body:   reader,
+	}
+	if opts.StorageClass != nil {
+		input.StorageClass = types.StorageClass(*opts.StorageClass)
 	}
 	if a.ServerSideEncryption != "" {
-		input.ServerSideEncryption = aws.String(a.ServerSideEncryption)
+		input.ServerSideEncryption = types.ServerSideEncryption(a.ServerSideEncryption)
 	}
 	if a.ServerSideEncryptionKmsKeyID != "" {
 		input.SSEKMSKeyId = aws.String(a.ServerSideEncryptionKmsKeyID)
 	}
 
-	output, err := uploader.UploadWithContext(ctx, input)
+	output, err := uploader.Upload(ctx, input)
 	if err != nil {
 		return err
 	}
-	if aws.StringValue(output.ETag) == "" {
+	if aws.ToString(output.ETag) == "" {
 		return ErrMissingETag
 	}
 	return nil
 }
 
-func extractAmzServerSideHeader(header http.Header) http.Header {
-	// return additional headers: x-amz-server-side-*
-	h := make(http.Header)
-	for k, v := range header {
-		if strings.HasPrefix(k, "X-Amz-Server-Side-") {
-			h[k] = v
-		}
-	}
-	return h
-}
-
 func (a *Adapter) extractParamsFromObj(obj block.ObjectPointer) (string, string, block.QualifiedKey, error) {
 	qk, err := a.ResolveNamespace(obj.StorageNamespace, obj.Identifier, obj.IdentifierType)
 	if err != nil {
@@ -861,6 +811,13 @@ func (a *Adapter) extractParamsFromObj(obj block.ObjectPointer) (string, string,
 	return bucket, key, qk, nil
 }
 
+func (a *Adapter) registerCaptureServerMiddleware() func(*s3.Options) {
+	fn := middleware.DeserializeMiddlewareFunc("ResponseServerValue", a.captureServerDeserializeMiddleware)
+	return s3.WithAPIOptions(func(stack *middleware.Stack) error {
+		return stack.Deserialize.Add(fn, middleware.After)
+	})
+}
+
 func ExtractParamsFromQK(qk block.QualifiedKey) (string, string) {
 	bucket, prefix, _ := strings.Cut(qk.GetStorageNamespace(), "/")
 	key := qk.GetKey()
diff --git a/pkg/block/s3/adapter_test.go b/pkg/block/s3/adapter_test.go
index 25fd4fd8fd0..5d107936411 100644
--- a/pkg/block/s3/adapter_test.go
+++ b/pkg/block/s3/adapter_test.go
@@ -1,31 +1,32 @@
 package s3_test
 
 import (
+	"context"
 	"net/url"
 	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/stretchr/testify/require"
 	"github.com/treeverse/lakefs/pkg/block/blocktest"
+	"github.com/treeverse/lakefs/pkg/block/params"
 	"github.com/treeverse/lakefs/pkg/block/s3"
 )
 
-func getAdapter() *s3.Adapter {
-	sess := session.Must(session.NewSession(
-		aws.NewConfig().WithCredentials(credentials.NewCredentials(
-			&credentials.StaticProvider{
-				Value: credentials.Value{
-					AccessKeyID:     minioTestAccessKeyID,
-					SecretAccessKey: minioTestSecretAccessKey,
-				},
-			})).WithEndpoint(blockURL).
-			WithRegion("us-east-1").
-			WithS3ForcePathStyle(true)),
-	)
-	adapter := s3.NewAdapter(sess, s3.WithDiscoverBucketRegion(false))
+func getS3BlockAdapter(t *testing.T) *s3.Adapter {
+	s3params := params.S3{
+		Region:               "us-east-1",
+		Endpoint:             blockURL,
+		ForcePathStyle:       true,
+		DiscoverBucketRegion: false,
+		Credentials: params.S3Credentials{
+			AccessKeyID:     minioTestAccessKeyID,
+			SecretAccessKey: minioTestSecretAccessKey,
+		},
+	}
+	adapter, err := s3.NewAdapter(context.Background(), s3params)
+	if err != nil {
+		t.Fatal("cannot create s3 adapter: ", err)
+	}
 	return adapter
 }
 
@@ -37,12 +38,12 @@ func TestS3Adapter(t *testing.T) {
 	externalPath, err := url.JoinPath(basePath, "external")
 	require.NoError(t, err)
 
-	adapter := getAdapter()
+	adapter := getS3BlockAdapter(t)
 	blocktest.AdapterTest(t, adapter, localPath, externalPath)
 }
 
 func TestAdapterNamespace(t *testing.T) {
-	adapter := getAdapter()
+	adapter := getS3BlockAdapter(t)
 	expr, err := regexp.Compile(adapter.GetStorageNamespaceInfo().ValidityRegex)
 	require.NoError(t, err)
 
diff --git a/pkg/block/s3/client_cache.go b/pkg/block/s3/client_cache.go
index ff55623860f..df9b0e7c604 100644
--- a/pkg/block/s3/client_cache.go
+++ b/pkg/block/s3/client_cache.go
@@ -2,107 +2,58 @@ package s3
 
 import (
 	"context"
-	"errors"
-	"fmt"
 	"sync"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3iface"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
-	"github.com/go-openapi/swag"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/treeverse/lakefs/pkg/block/params"
 	"github.com/treeverse/lakefs/pkg/logging"
 	"github.com/treeverse/lakefs/pkg/stats"
 )
 
-// ErrDoesntExpire is returned by an Expirer if expiry times cannot be
-// determined.  For instance, if AWS is configured using an access key then
-// Expirer cannot determine expiry.
-var ErrDoesntExpire = errors.New("no access expiry")
-
-type Expirer interface {
-	// ExpiresAt returns an expiry time or an error.  It returns
-	// a ErrDoesntExpire if it cannot determine expiry times -- for
-	// instance, if AWS is configured using an access key.
-	ExpiresAt() (time.Time, error)
-	// Refresh attempts to refresh and returns ExpiresAt().
-	Refresh() (time.Time, error)
-}
-
-type S3APIWithExpirer interface {
-	s3iface.S3API
-	Expirer
-}
-
 type (
-	clientFactory  func(awsSession *session.Session, cfgs ...*aws.Config) S3APIWithExpirer
-	s3RegionGetter func(ctx context.Context, sess *session.Session, bucket string) (string, error)
+	clientFactory  func(region string) *s3.Client
+	s3RegionGetter func(ctx context.Context, bucket string) (string, error)
 )
 
 type ClientCache struct {
-	regionToS3Client sync.Map
-	bucketToRegion   sync.Map
-	awsSession       *session.Session
-
+	mu             sync.Mutex
+	regionClient   map[string]*s3.Client
+	bucketRegion   map[string]string
+	awsConfig      aws.Config
+	defaultClient  *s3.Client
 	clientFactory  clientFactory
 	s3RegionGetter s3RegionGetter
 	collector      stats.Collector
 }
 
-func getBucketRegionFromS3(ctx context.Context, sess *session.Session, bucket string) (string, error) {
-	return s3manager.GetBucketRegion(ctx, sess, bucket, "")
-}
-
-func getBucketRegionFromSession(ctx context.Context, sess *session.Session, bucket string) (string, error) {
-	region := aws.StringValue(sess.Config.Region)
-	return region, nil
-}
-
-type s3Client struct {
-	s3iface.S3API
-	awsSession *session.Session
-}
-
-func newS3Client(sess *session.Session, cfgs ...*aws.Config) S3APIWithExpirer {
-	return &s3Client{
-		S3API:      s3.New(sess, cfgs...),
-		awsSession: sess,
-	}
-}
-
-func (c *s3Client) ExpiresAt() (time.Time, error) {
-	creds := c.awsSession.Config.Credentials
-	if creds == nil {
-		return time.Time{}, ErrDoesntExpire
+func NewClientCache(awsConfig aws.Config, params params.S3) *ClientCache {
+	clientFactory := newClientFactory(awsConfig, WithClientParams(params))
+	defaultClient := clientFactory(awsConfig.Region)
+	clientCache := &ClientCache{
+		regionClient:  make(map[string]*s3.Client),
+		bucketRegion:  make(map[string]string),
+		awsConfig:     awsConfig,
+		defaultClient: defaultClient,
+		clientFactory: clientFactory,
+		collector:     &stats.NullCollector{},
 	}
-	expiryTime, err := creds.ExpiresAt()
-	if err != nil {
-		if awsErr, ok := err.(awserr.Error); ok {
-			if awsErr.Code() == "ProviderNotExpirer" {
-				err = ErrDoesntExpire
+	clientCache.DiscoverBucketRegion(true)
+	return clientCache
+}
+
+// newClientFactory returns a function that creates a new S3 client with the given region.
+// accepts aws configuration and list of s3 options functions to apply with the s3 client.
+// the factory function is used to create a new client for a region when it is not cached.
+func newClientFactory(awsConfig aws.Config, s3OptFns ...func(options *s3.Options)) clientFactory {
+	return func(region string) *s3.Client {
+		return s3.NewFromConfig(awsConfig, func(options *s3.Options) {
+			for _, opts := range s3OptFns {
+				opts(options)
 			}
-		}
-	}
-	return expiryTime, err
-}
-
-func (c *s3Client) Refresh() (time.Time, error) {
-	c.awsSession.Config.Credentials.Expire()
-	_, err := c.awsSession.Config.Credentials.Get()
-	if err != nil {
-		return time.Time{}, fmt.Errorf("refresh credentials: %w", err)
-	}
-	return c.ExpiresAt()
-}
-
-func NewClientCache(awsSession *session.Session) *ClientCache {
-	return &ClientCache{
-		awsSession:     awsSession,
-		clientFactory:  newS3Client,
-		s3RegionGetter: getBucketRegionFromS3,
+			options.Region = region
+		})
 	}
 }
 
@@ -118,44 +69,94 @@ func (c *ClientCache) SetStatsCollector(statsCollector stats.Collector) {
 	c.collector = statsCollector
 }
 
-func (c *ClientCache) getBucketRegion(ctx context.Context, bucket string) string {
-	if region, hasRegion := c.bucketToRegion.Load(bucket); hasRegion {
-		return region.(string)
-	}
-	logging.FromContext(ctx).WithField("bucket", bucket).Debug("requesting region for bucket")
-	region, err := c.s3RegionGetter(ctx, c.awsSession, bucket)
-	if err != nil {
-		logging.FromContext(ctx).WithError(err).Error("failed to get region for bucket, falling back to default region")
-		region = *c.awsSession.Config.Region
+func (c *ClientCache) DiscoverBucketRegion(b bool) {
+	if b {
+		c.s3RegionGetter = c.getBucketRegionFromAWS
+	} else {
+		c.s3RegionGetter = c.getBucketRegionDefault
 	}
-	c.bucketToRegion.Store(bucket, region)
-	return region
 }
 
-// Get returns an AWS client configured to the region of the given bucket.
-func (c *ClientCache) Get(ctx context.Context, bucket string) S3APIWithExpirer {
-	region := c.getBucketRegion(ctx, bucket)
-	svc, hasClient := c.regionToS3Client.Load(region)
-	if !hasClient {
-		logging.FromContext(ctx).WithField("bucket", bucket).WithField("region", region).Debug("creating client for region")
-		ret := c.clientFactory(c.awsSession, &aws.Config{Region: swag.String(region)})
-		c.regionToS3Client.Store(region, ret)
-		if c.collector != nil {
-			c.collector.CollectEvent(stats.Event{
-				Class: "s3_block_adapter",
-				Name:  fmt.Sprintf("created_aws_client_%s", region),
-			})
+func (c *ClientCache) getBucketRegionFromAWS(ctx context.Context, bucket string) (string, error) {
+	return manager.GetBucketRegion(ctx, c.defaultClient, bucket)
+}
+
+func (c *ClientCache) getBucketRegionDefault(_ context.Context, _ string) (string, error) {
+	return c.awsConfig.Region, nil
+}
+
+func (c *ClientCache) Get(ctx context.Context, bucket string) *s3.Client {
+	client, region := c.cachedClientByBucket(bucket)
+	if client != nil {
+		return client
+	}
+
+	// lookup region if needed
+	if region == "" {
+		region = c.refreshBucketRegion(ctx, bucket)
+		if client, ok := c.cachedClientByRegion(region); ok {
+			return client
 		}
-		return ret
+	}
+
+	// create client and update cache
+	logging.FromContext(ctx).WithField("region", region).Debug("creating client for region")
+	client = c.clientFactory(region)
+
+	// re-check if a client was created by another goroutine
+	// keep using the existing client and discard the new one
+	c.mu.Lock()
+	existingClient, existingFound := c.regionClient[region]
+	if existingFound {
+		client = existingClient
 	} else {
-		return svc.(S3APIWithExpirer)
+		c.regionClient[region] = client
 	}
+	c.mu.Unlock()
+
+	// report client creation, if needed
+	if !existingFound && c.collector != nil {
+		c.collector.CollectEvent(stats.Event{
+			Class: "s3_block_adapter",
+			Name:  "created_aws_client_" + region,
+		})
+	}
+	return client
 }
 
-func (c *ClientCache) DiscoverBucketRegion(b bool) {
-	if b {
-		c.s3RegionGetter = getBucketRegionFromS3
-	} else {
-		c.s3RegionGetter = getBucketRegionFromSession
+func (c *ClientCache) cachedClientByBucket(bucket string) (*s3.Client, string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if region, ok := c.bucketRegion[bucket]; ok {
+		return c.regionClient[region], region
 	}
+	return nil, ""
+}
+
+func (c *ClientCache) cachedClientByRegion(region string) (*s3.Client, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	client, ok := c.regionClient[region]
+	return client, ok
+}
+
+func (c *ClientCache) refreshBucketRegion(ctx context.Context, bucket string) string {
+	region, err := c.s3RegionGetter(ctx, bucket)
+	if err != nil {
+		// fallback to default region
+		region = c.awsConfig.Region
+		logging.FromContext(ctx).
+			WithError(err).
+			WithField("default_region", region).
+			Error("Failed to get region for bucket, falling back to default region")
+	}
+	// update bucket to region cache
+	c.mu.Lock()
+	c.bucketRegion[bucket] = region
+	c.mu.Unlock()
+	return region
+}
+
+func (c *ClientCache) GetDefault() *s3.Client {
+	return c.defaultClient
 }
diff --git a/pkg/block/s3/client_cache_test.go b/pkg/block/s3/client_cache_test.go
index 4f667f82e47..33c57dcb665 100644
--- a/pkg/block/s3/client_cache_test.go
+++ b/pkg/block/s3/client_cache_test.go
@@ -4,116 +4,103 @@ import (
 	"context"
 	"errors"
 	"testing"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3/s3iface"
+	"github.com/aws/aws-sdk-go-v2/config"
+	awss3 "github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/go-test/deep"
+	"github.com/treeverse/lakefs/pkg/block/params"
 	"github.com/treeverse/lakefs/pkg/block/s3"
 	"github.com/treeverse/lakefs/pkg/testutil"
 )
 
-var (
-	errRegion      = errors.New("failed to get region")
-	errFakeExpires = errors.New("fake Expirer")
-)
-
-type FakeS3APIWithExpirer struct {
-	s3iface.S3API
-}
-
-func NewFakeS3APIWithExpirer() FakeS3APIWithExpirer {
-	return FakeS3APIWithExpirer(struct{ s3iface.S3API }{})
-}
-
-func (f FakeS3APIWithExpirer) ExpiresAt() (time.Time, error) {
-	return time.Time{}, errFakeExpires
-}
-
-func (f FakeS3APIWithExpirer) Refresh() (time.Time, error) {
-	return f.ExpiresAt()
-}
+var errRegion = errors.New("failed to get region")
 
 func TestClientCache(t *testing.T) {
-	defaultRegion := "us-west-2"
-	sess, err := session.NewSession(&aws.Config{Region: &defaultRegion})
+	const defaultRegion = "us-west-2"
+	ctx := context.Background()
+	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(defaultRegion))
 	testutil.Must(t, err)
-	tests := map[string]struct {
+
+	tests := []struct {
+		name                string
 		bucketToRegion      map[string]string
 		bucketCalls         []string
 		regionErrorsIndexes map[int]bool
 	}{
-		"two_buckets_two_regions": {
+		{
+			name:           "two_buckets_two_regions",
 			bucketToRegion: map[string]string{"us-bucket": "us-east-1", "eu-bucket": "eu-west-1"},
 			bucketCalls:    []string{"us-bucket", "us-bucket", "us-bucket", "eu-bucket", "eu-bucket", "eu-bucket"},
 		},
-		"multiple_buckets_two_regions": {
+		{
+			name:           "multiple_buckets_two_regions",
 			bucketToRegion: map[string]string{"us-bucket-1": "us-east-1", "us-bucket-2": "us-east-1", "us-bucket-3": "us-east-1", "eu-bucket-1": "eu-west-1", "eu-bucket-2": "eu-west-1"},
 			bucketCalls:    []string{"us-bucket-1", "us-bucket-2", "us-bucket-3", "eu-bucket-1", "eu-bucket-2"},
 		},
-		"error_on_get_region": {
+		{
+			name:                "error_on_get_region",
 			bucketToRegion:      map[string]string{"us-bucket": "us-east-1", "eu-bucket": "eu-west-1"},
 			bucketCalls:         []string{"us-bucket", "us-bucket", "us-bucket", "eu-bucket", "eu-bucket", "eu-bucket"},
 			regionErrorsIndexes: map[int]bool{3: true},
 		},
-		"all_errors": {
+		{
+			name:                "all_errors",
 			bucketToRegion:      map[string]string{"us-bucket-1": "us-east-1", "us-bucket-2": "us-east-1", "us-bucket-3": "us-east-1", "eu-bucket-1": "eu-west-1", "eu-bucket-2": "eu-west-1"},
 			bucketCalls:         []string{"us-bucket-1", "us-bucket-2", "us-bucket-3", "eu-bucket-1", "eu-bucket-2"},
 			regionErrorsIndexes: map[int]bool{0: true, 1: true, 2: true, 3: true, 4: true},
 		},
-		"alternating_regions": {
+		{
+			name:           "alternating_regions",
 			bucketToRegion: map[string]string{"us-bucket-1": "us-east-1", "us-bucket-2": "us-east-1", "us-bucket-3": "us-east-1", "eu-bucket-1": "eu-west-1", "eu-bucket-2": "eu-west-1"},
 			bucketCalls:    []string{"us-bucket-1", "eu-bucket-1", "us-bucket-2", "eu-bucket-2", "us-bucket-3", "us-bucket-1", "eu-bucket-1", "us-bucket-2", "eu-bucket-2", "us-bucket-3"},
 		},
 	}
-	for name, tst := range tests {
-		t.Run(name, func(t *testing.T) {
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
 			var callIdx int
 			var bucket string
 			actualClientsCreated := make(map[string]bool)
 			expectedClientsCreated := make(map[string]bool)
 			actualRegionFetch := make(map[string]bool)
 			expectedRegionFetch := make(map[string]bool)
-			c := s3.NewClientCache(sess)
 
-			c.SetClientFactory(func(sess *session.Session, cfgs ...*aws.Config) s3.S3APIWithExpirer {
-				region := sess.Config.Region
-				for _, cfg := range cfgs {
-					if cfg.Region != nil {
-						region = cfg.Region
-					}
-				}
-				if actualClientsCreated[*region] {
+			c := s3.NewClientCache(cfg, params.S3{}) // params are ignored as we use custom client factory
+
+			c.SetClientFactory(func(region string) *awss3.Client {
+				if actualClientsCreated[region] {
 					t.Fatalf("client created more than once for a region")
 				}
-				actualClientsCreated[*region] = true
-				return NewFakeS3APIWithExpirer()
+				actualClientsCreated[region] = true
+				return awss3.NewFromConfig(cfg, func(o *awss3.Options) {
+					o.Region = region
+				})
 			})
-			c.SetS3RegionGetter(func(ctx context.Context, sess *session.Session, bucket string) (string, error) {
+
+			c.SetS3RegionGetter(func(ctx context.Context, bucket string) (string, error) {
 				if actualRegionFetch[bucket] {
 					t.Fatalf("region fetched more than once for bucket")
 				}
 				actualRegionFetch[bucket] = true
-				if tst.regionErrorsIndexes[callIdx] {
+				if test.regionErrorsIndexes[callIdx] {
 					return "", errRegion
 				}
-				return tst.bucketToRegion[bucket], nil
+				return test.bucketToRegion[bucket], nil
 			})
+
 			alreadyCalled := make(map[string]bool)
-			for callIdx, bucket = range tst.bucketCalls {
-				expectedRegionFetch[bucket] = true // for every bucket, there should be exactly 1 region fetch
+			for callIdx, bucket = range test.bucketCalls {
+				expectedRegionFetch[bucket] = true // for every bucket, there should be exactly one region fetch
 				if _, ok := alreadyCalled[bucket]; !ok {
-					if tst.regionErrorsIndexes[callIdx] {
+					if test.regionErrorsIndexes[callIdx] {
 						// if there's an error, a client should be created for the default region
 						expectedClientsCreated[defaultRegion] = true
 					} else {
 						// for every region, a client is created exactly once
-						expectedClientsCreated[tst.bucketToRegion[bucket]] = true
+						expectedClientsCreated[test.bucketToRegion[bucket]] = true
 					}
 				}
 				alreadyCalled[bucket] = true
-				c.Get(context.Background(), bucket)
+				c.Get(ctx, bucket)
 			}
 			if diff := deep.Equal(expectedClientsCreated, actualClientsCreated); diff != nil {
 				t.Fatal("unexpected client creation count: ", diff)
diff --git a/pkg/block/s3/extract_sse.go b/pkg/block/s3/extract_sse.go
new file mode 100644
index 00000000000..dc0169dc504
--- /dev/null
+++ b/pkg/block/s3/extract_sse.go
@@ -0,0 +1,84 @@
+package s3
+
+import (
+	"net/http"
+
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+)
+
+// extractSSHeaderUploadPart extracts the x-amz-server-side-* headers from the given
+// UploadPartOutput response.
+func extractSSHeaderUploadPart(resp *s3.UploadPartOutput) http.Header {
+	// x-amz-server-side-* headers
+	headers := make(http.Header)
+	if resp.SSECustomerAlgorithm != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Customer-Algorithm", *resp.SSECustomerAlgorithm)
+	}
+	if resp.SSECustomerKeyMD5 != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Customer-Key-Md5", *resp.SSECustomerKeyMD5)
+	}
+	if resp.SSEKMSKeyId != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id", *resp.SSEKMSKeyId)
+	}
+	if resp.ServerSideEncryption != "" {
+		headers.Set("X-Amz-Server-Side-Encryption", string(resp.ServerSideEncryption))
+	}
+	return headers
+}
+
+// extractSSHeaderUploadPartCopy extracts the x-amz-server-side-* headers from the given
+// UploadPartCopyOutput response.
+func extractSSHeaderUploadPartCopy(resp *s3.UploadPartCopyOutput) http.Header {
+	// x-amz-server-side-* headers
+	headers := make(http.Header)
+	if resp.SSECustomerAlgorithm != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Customer-Algorithm", *resp.SSECustomerAlgorithm)
+	}
+	if resp.SSECustomerKeyMD5 != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Customer-Key-Md5", *resp.SSECustomerKeyMD5)
+	}
+	if resp.SSEKMSKeyId != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id", *resp.SSEKMSKeyId)
+	}
+	if resp.ServerSideEncryption != "" {
+		headers.Set("X-Amz-Server-Side-Encryption", string(resp.ServerSideEncryption))
+	}
+	return headers
+}
+
+// extractSSHeaderCreateMultipartUpload extracts the x-amz-server-side-* headers from the given
+// CreateMultipartUploadOutput response.
+func extractSSHeaderCreateMultipartUpload(resp *s3.CreateMultipartUploadOutput) http.Header {
+	// x-amz-server-side-* headers
+	headers := make(http.Header)
+	if resp.SSECustomerAlgorithm != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Customer-Algorithm", *resp.SSECustomerAlgorithm)
+	}
+	if resp.SSECustomerKeyMD5 != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Customer-Key-Md5", *resp.SSECustomerKeyMD5)
+	}
+	if resp.SSEKMSKeyId != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id", *resp.SSEKMSKeyId)
+	}
+	if resp.ServerSideEncryption != "" {
+		headers.Set("X-Amz-Server-Side-Encryption", string(resp.ServerSideEncryption))
+	}
+	if resp.SSEKMSEncryptionContext != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Context", *resp.SSEKMSEncryptionContext)
+	}
+	return headers
+}
+
+// extractSSHeaderCompleteMultipartUpload extracts the x-amz-server-side-* headers from the given
+// CompleteMultipartUploadOutput response.
+func extractSSHeaderCompleteMultipartUpload(resp *s3.CompleteMultipartUploadOutput) http.Header {
+	// x-amz-server-side-* headers
+	headers := make(http.Header)
+	if resp.SSEKMSKeyId != nil {
+		headers.Set("X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id", *resp.SSEKMSKeyId)
+	}
+	if resp.ServerSideEncryption != "" {
+		headers.Set("X-Amz-Server-Side-Encryption", string(resp.ServerSideEncryption))
+	}
+	return headers
+}
diff --git a/pkg/block/s3/inventory.go b/pkg/block/s3/inventory.go
deleted file mode 100644
index 9c29be7842f..00000000000
--- a/pkg/block/s3/inventory.go
+++ /dev/null
@@ -1,165 +0,0 @@
-package s3
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/url"
-	"sort"
-	"strings"
-
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/treeverse/lakefs/pkg/block"
-	"github.com/treeverse/lakefs/pkg/cloud/aws/s3inventory"
-	"github.com/treeverse/lakefs/pkg/logging"
-)
-
-var ErrInventoryFilesRangesOverlap = errors.New("got s3 inventory with files covering overlapping ranges")
-
-type Manifest struct {
-	URL                string          `json:"-"`
-	InventoryBucketArn string          `json:"destinationBucket"`
-	SourceBucket       string          `json:"sourceBucket"`
-	Files              []InventoryFile `json:"files"` // inventory list files, each contains a list of objects
-	Format             string          `json:"fileFormat"`
-	CreationTimestamp  string          `json:"creationTimestamp"`
-	inventoryBucket    string
-}
-
-type InventoryFile struct {
-	Key      string `json:"key"` // an s3 key for an inventory list file
-	firstKey string
-	lastKey  string
-}
-
-func (a *Adapter) GenerateInventory(ctx context.Context, logger logging.Logger, manifestURL string, shouldSort bool, prefixes []string) (block.Inventory, error) {
-	m, err := a.loadManifest(ctx, manifestURL)
-	if err != nil {
-		return nil, err
-	}
-	svc := a.clients.Get(ctx, m.inventoryBucket)
-	return GenerateInventory(ctx, logger, m, s3inventory.NewReader(ctx, svc, logger), shouldSort, prefixes)
-}
-
-func GenerateInventory(ctx context.Context, logger logging.Logger, m *Manifest, inventoryReader s3inventory.IReader, shouldSort bool, prefixes []string) (block.Inventory, error) {
-	if logger == nil {
-		logger = logging.FromContext(ctx)
-	}
-	if shouldSort || len(prefixes) > 0 {
-		if err := sortManifest(m, logger, inventoryReader); err != nil {
-			return nil, err
-		}
-	}
-	if len(prefixes) > 0 {
-		manifestFileCount := len(m.Files)
-		m.Files = filterFiles(m.Files, prefixes)
-		logger.Debugf("manifest filtered from %d to %d files", manifestFileCount, len(m.Files))
-	}
-	return &Inventory{Manifest: m, logger: logger, shouldSort: shouldSort, reader: inventoryReader, prefixes: prefixes}, nil
-}
-
-type Inventory struct {
-	Manifest   *Manifest
-	logger     logging.Logger
-	shouldSort bool
-	reader     s3inventory.IReader
-	prefixes   []string
-}
-
-func (inv *Inventory) Iterator() block.InventoryIterator {
-	return NewInventoryIterator(inv)
-}
-
-func (inv *Inventory) SourceName() string {
-	return inv.Manifest.SourceBucket
-}
-
-func (inv *Inventory) InventoryURL() string {
-	return inv.Manifest.URL
-}
-
-func (a *Adapter) loadManifest(ctx context.Context, manifestURL string) (*Manifest, error) {
-	u, err := url.Parse(manifestURL)
-	if err != nil {
-		return nil, err
-	}
-	output, err := a.clients.Get(ctx, u.Host).GetObject(&s3.GetObjectInput{Bucket: &u.Host, Key: &u.Path})
-	if err != nil {
-		return nil, fmt.Errorf("%w: failed to read manifest.json from %s", err, manifestURL)
-	}
-	var m Manifest
-	err = json.NewDecoder(output.Body).Decode(&m)
-	if err != nil {
-		return nil, err
-	}
-	if m.Format != s3inventory.OrcFormatName && m.Format != s3inventory.ParquetFormatName {
-		return nil, fmt.Errorf("%w. got format: %s", s3inventory.ErrUnsupportedInventoryFormat, m.Format)
-	}
-	m.URL = manifestURL
-	inventoryBucketArn, err := arn.Parse(m.InventoryBucketArn)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse inventory bucket arn: %w", err)
-	}
-	m.inventoryBucket = inventoryBucketArn.Resource
-	return &m, nil
-}
-
-func filterFiles(files []InventoryFile, prefixes []string) []InventoryFile {
-	sort.Strings(prefixes)
-	currentPrefixIdx := 0
-	filteredFiles := make([]InventoryFile, 0)
-	for i := 0; i < len(files); i++ {
-		for {
-			// find a prefix that may have suitable keys in the current file
-			if prefixes[currentPrefixIdx] >= files[i].firstKey {
-				// prefix may be in scope of current file
-				break
-			}
-			if strings.HasPrefix(files[i].firstKey, prefixes[currentPrefixIdx]) {
-				// first object in file starts with prefix
-				break
-			}
-			// current prefix ends before this file - move to next prefix
-			currentPrefixIdx++
-			if currentPrefixIdx == len(prefixes) {
-				// no more prefixes - other files are irrelevant
-				return filteredFiles
-			}
-		}
-		if strings.HasPrefix(files[i].firstKey, prefixes[currentPrefixIdx]) ||
-			(prefixes[currentPrefixIdx] >= files[i].firstKey && prefixes[currentPrefixIdx] < files[i].lastKey) {
-			// file may contain keys starting with this prefix
-			filteredFiles = append(filteredFiles, files[i])
-		}
-	}
-	return filteredFiles
-}
-
-func sortManifest(m *Manifest, logger logging.Logger, reader s3inventory.IReader) error {
-	for i, f := range m.Files {
-		mr, err := reader.GetMetadataReader(m.Format, m.inventoryBucket, f.Key)
-		if err != nil {
-			return fmt.Errorf("failed to sort inventory files in manifest: %w", err)
-		}
-		m.Files[i].firstKey = mr.FirstObjectKey()
-		m.Files[i].lastKey = mr.LastObjectKey()
-		err = mr.Close()
-		if err != nil {
-			logger.WithError(err).WithField("file", f).Error("Failed to close inventory file")
-		}
-	}
-	sort.Slice(m.Files, func(i, j int) bool {
-		return m.Files[i].firstKey < m.Files[j].firstKey ||
-			(m.Files[i].firstKey == m.Files[j].firstKey && m.Files[i].lastKey < m.Files[j].lastKey)
-	})
-	// validate sorting: if a file begins before the next one ends - the files cover overlapping ranges,
-	// which we don't know how to handle.
-	for i := 0; i < len(m.Files)-1; i++ {
-		if m.Files[i+1].firstKey < m.Files[i].lastKey {
-			return ErrInventoryFilesRangesOverlap
-		}
-	}
-	return nil
-}
diff --git a/pkg/block/s3/inventory_iterator.go b/pkg/block/s3/inventory_iterator.go
deleted file mode 100644
index 8f98fb21991..00000000000
--- a/pkg/block/s3/inventory_iterator.go
+++ /dev/null
@@ -1,161 +0,0 @@
-package s3
-
-import (
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/treeverse/lakefs/pkg/block"
-	"github.com/treeverse/lakefs/pkg/cloud/aws/s3inventory"
-	"github.com/treeverse/lakefs/pkg/cmdutils"
-)
-
-var ErrInventoryNotSorted = errors.New("got unsorted s3 inventory")
-
-type InventoryIterator struct {
-	*Inventory
-	err                   error
-	val                   *block.InventoryObject
-	buffer                []*s3inventory.InventoryObject
-	inventoryFileIndex    int
-	valIndexInBuffer      int
-	inventoryFileProgress *cmdutils.Progress
-	currentFileProgress   *cmdutils.Progress
-	currentPrefix         int
-}
-
-func NewInventoryIterator(inv *Inventory) *InventoryIterator {
-	creationTimestamp, err := strconv.ParseInt(inv.Manifest.CreationTimestamp, 10, 64) //nolint: gomnd
-	if err != nil {
-		inv.logger.WithError(err).Error("Failed to get creation timestamp from manifest")
-		creationTimestamp = 0
-	}
-	t := time.Unix(creationTimestamp/int64(time.Second/time.Millisecond), 0)
-	inventoryFileProgress := cmdutils.NewActiveProgress(fmt.Sprintf("Inventory (%s) Files Read", t.Format("2006-01-02")), cmdutils.Bar)
-	inventoryFileProgress.SetTotal(int64(len(inv.Manifest.Files)))
-	return &InventoryIterator{
-		Inventory:             inv,
-		inventoryFileIndex:    -1,
-		inventoryFileProgress: inventoryFileProgress,
-		currentFileProgress:   cmdutils.NewActiveProgress(fmt.Sprintf("Inventory (%s) Current File", t.Format("2006-01-02")), cmdutils.Bar),
-	}
-}
-
-func (it *InventoryIterator) Next() bool {
-	for {
-		if len(it.Manifest.Files) == 0 {
-			// empty manifest
-			return false
-		}
-		val := it.nextFromBuffer()
-		if val != nil {
-			// validate element order
-			if it.shouldSort && it.val != nil && val.Key < it.val.Key {
-				it.err = ErrInventoryNotSorted
-				return false
-			}
-			it.currentFileProgress.SetCurrent(int64(it.valIndexInBuffer + 1))
-			it.val = val
-			return true
-		}
-		// value not found in buffer, need to reload the buffer
-		it.valIndexInBuffer = -1
-		if !it.moveToNextInventoryFile() {
-			// no more files left
-			it.inventoryFileProgress.SetCompleted(true)
-			it.currentFileProgress.SetCompleted(true)
-			return false
-		}
-		if !it.fillBuffer() {
-			return false
-		}
-	}
-}
-
-func (it *InventoryIterator) moveToNextInventoryFile() bool {
-	if it.inventoryFileIndex == len(it.Manifest.Files)-1 {
-		return false
-	}
-	it.inventoryFileIndex += 1
-	it.inventoryFileProgress.Incr()
-	it.logger.WithField("file", it.Manifest.Files[it.inventoryFileIndex].Key).Debug("Moving to next manifest file")
-	it.buffer = nil
-	return true
-}
-
-func (it *InventoryIterator) fillBuffer() bool {
-	it.logger.Debug("Start reading rows from inventory to buffer")
-	rdr, err := it.reader.GetFileReader(it.Manifest.Format, it.Manifest.inventoryBucket, it.Manifest.Files[it.inventoryFileIndex].Key)
-	if err != nil {
-		it.err = err
-		return false
-	}
-	it.currentFileProgress.SetTotal(rdr.GetNumRows())
-	it.currentFileProgress.SetCurrent(0)
-	defer func() {
-		err = rdr.Close()
-		if err != nil {
-			it.logger.WithError(err).WithField("file", it.Manifest.Files[it.inventoryFileIndex].Key).Error("Failed to close manifest file reader")
-		}
-	}()
-	it.buffer, err = rdr.Read(int(rdr.GetNumRows()))
-	if err != nil {
-		it.err = err
-		return false
-	}
-	return true
-}
-
-func (it *InventoryIterator) nextFromBuffer() *block.InventoryObject {
-	for i := it.valIndexInBuffer + 1; i < len(it.buffer); i++ {
-		obj := it.buffer[i]
-		if !obj.IsLatest || obj.IsDeleteMarker {
-			continue
-		}
-		if len(it.prefixes) > 0 {
-			// check file against prefix filter
-			// loop while current prefix may fit current object
-			for it.prefixes[it.currentPrefix] < obj.Key {
-				if strings.HasPrefix(obj.Key, it.prefixes[it.currentPrefix]) {
-					// found current prefix
-					break
-				}
-				it.currentPrefix++
-				if it.currentPrefix == len(it.prefixes) {
-					// no more prefixes
-					return nil
-				}
-			}
-			if !strings.HasPrefix(obj.Key, it.prefixes[it.currentPrefix]) {
-				continue
-			}
-		}
-		res := block.InventoryObject{
-			Bucket:          obj.Bucket,
-			Key:             obj.Key,
-			PhysicalAddress: obj.GetPhysicalAddress(),
-			Size:            obj.Size,
-			LastModified:    obj.LastModified,
-			Checksum:        obj.Checksum,
-		}
-		it.valIndexInBuffer = i
-		return &res
-	}
-	return nil
-}
-
-func (it *InventoryIterator) Err() error {
-	return it.err
-}
-
-func (it *InventoryIterator) Get() *block.InventoryObject {
-	return it.val
-}
-
-func (it *InventoryIterator) Progress() []*cmdutils.Progress {
-	return []*cmdutils.Progress{
-		it.inventoryFileProgress, it.currentFileProgress,
-	}
-}
diff --git a/pkg/block/s3/inventory_test.go b/pkg/block/s3/inventory_test.go
deleted file mode 100644
index 40d09663455..00000000000
--- a/pkg/block/s3/inventory_test.go
+++ /dev/null
@@ -1,334 +0,0 @@
-package s3_test
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/treeverse/lakefs/pkg/block"
-	"github.com/treeverse/lakefs/pkg/block/s3"
-	"github.com/treeverse/lakefs/pkg/cloud/aws/s3inventory"
-	"github.com/treeverse/lakefs/pkg/logging"
-)
-
-var ErrReadFile = errors.New("error reading file")
-
-func rows(keys []string, lastModified map[string]time.Time) []*s3inventory.InventoryObject {
-	if keys == nil {
-		return nil
-	}
-	res := make([]*s3inventory.InventoryObject, len(keys))
-	for i, key := range keys {
-		if key != "" {
-			res[i] = new(s3inventory.InventoryObject)
-			res[i].Key = key
-			res[i].IsLatest = !strings.Contains(key, "_expired")
-			res[i].IsDeleteMarker = strings.Contains(key, "_del")
-			if lastModified != nil {
-				tm := lastModified[key]
-				res[i].LastModified = &tm
-			}
-		}
-	}
-	return res
-}
-
-var fileContents = map[string][]string{
-	"f1":            {"f1row1_del", "f1row2", "f1row3", "f1row4_del"},
-	"f2":            {"f2row1", "f2row2"},
-	"f3":            {"f3row1", "f3row2"},
-	"f4":            {"f4row1", "f4row2", "f4row3", "f4row4", "f4row5", "f4row6", "f4row7"},
-	"f5":            {"f5row1", "f5row2", "f5row3"},
-	"f6":            {"f6row1", "f6row2", "f6row3", "f6row4"},
-	"f7":            {"f7row1", "f7row2_del", "f7row3_del", "f7row4_del", "f7row5_del", "f7row6_del", "f7row7_del", "f7row8_expired", "f7row9_expired", "f7row10_expired", "f7row11"},
-	"err_file1":     {"f8row1", "", "f8row2", "f8row3"},
-	"err_file2":     {""},
-	"unsorted_file": {"f9row1", "f9row2", "f9row3", "f9row5", "f9row4"},
-	"all_deleted1":  {"fd1_del1", "fd1_del2", "fd1_del3", "fd1_del4", "fd1_del5", "fd1_del6", "fd1_del7", "fd1_del8"},
-	"all_deleted2":  {"fd2_del1", "fd2_del2", "fd2_del3", "fd2_del4", "fd2_del5", "fd2_del6", "fd2_del7", "fd2_del8"},
-	"all_deleted3":  {"fd3_del1", "fd3_del2", "fd3_del3", "fd3_del4", "fd3_del5", "fd3_del6", "fd3_del7", "fd3_del8"},
-	"all_deleted4":  {"fd4_del1", "fd4_del2", "fd4_del3", "fd4_del4", "fd4_del5", "fd4_del6", "fd4_del7", "fd4_del8"},
-	"all_deleted5":  {"fd5_del1", "fd5_del2", "fd5_del3", "fd5_del4", "fd5_del5", "fd5_del6", "fd5_del7", "fd5_del8"},
-	"all_deleted6":  {"fd6_del1", "fd6_del2", "fd6_del3", "fd6_del4", "fd6_del5", "fd6_del6", "fd6_del7", "fd6_del8"},
-	"all_deleted7":  {"fd7_del1", "fd7_del2", "fd7_del3", "fd7_del4", "fd7_del5", "fd7_del6", "fd7_del7", "fd7_del8"},
-	"all_deleted8":  {"fd8_del1", "fd8_del2", "fd8_del3", "fd8_del4", "fd8_del5", "fd8_del6", "fd8_del7", "fd8_del8"},
-	"all_deleted9":  {"fd9_del1", "fd9_del2", "fd9_del3", "fd9_del4", "fd9_del5", "fd9_del6", "fd9_del7", "fd9_del8"},
-	"empty_file":    {},
-	"f_overlap1":    {"fo_row1", "fo_row3", "fo_row5"},
-	"f_overlap2":    {"fo_row2", "fo_row4"},
-	"f_overlap3":    {"fo_row2", "fo_row6"},
-	"f_overlap4":    {"fo_row1", "fo_row4"},
-	"f_overlap5":    {"fo_row2", "fo_row4"},
-	"f1_prefix":     {"a1", "a2", "b1", "b2"},
-	"f2_prefix":     {"b3", "b4", "c1", "c2"},
-	"f3_prefix":     {"d1", "d2", "e1", "e2"},
-	"f4_prefix":     {"a1", "a2", "b1", "b2", "c1", "c2", "d1", "d2"},
-	"f5_prefix":     {"e1", "e2", "f1", "f2", "g1", "g2", "h1", "h2"},
-}
-
-func TestIterator(t *testing.T) {
-	now := time.Now()
-	lastModified := make(map[string]time.Time)
-	for _, rows := range fileContents {
-		for i, r := range rows {
-			lastModified[r] = now.Add(time.Hour * time.Duration(-i))
-		}
-	}
-	testdata := map[string]struct {
-		InventoryFiles             []string
-		ExpectedObjects            []string
-		Prefixes                   []string
-		ErrExpected                error
-		ExpectedCountReadRows      int
-		ExpectedCountGetFileReader int
-		ShouldSort                 bool
-	}{
-		"new inventory": {
-			InventoryFiles:  []string{"f1", "f2", "f3"},
-			ExpectedObjects: []string{"f1row2", "f1row3", "f2row1", "f2row2", "f3row1", "f3row2"},
-		},
-		"new inventory - sort before": {
-			InventoryFiles:  []string{"f3", "f2", "f1"},
-			ShouldSort:      true,
-			ExpectedObjects: []string{"f1row2", "f1row3", "f2row1", "f2row2", "f3row1", "f3row2"},
-		},
-		"new inventory - unsorted": {
-			InventoryFiles:  []string{"f3", "f2", "f1"},
-			ExpectedObjects: []string{"f3row1", "f3row2", "f2row1", "f2row2", "f1row2", "f1row3"},
-		},
-		"empty inventory": {
-			InventoryFiles:  []string{},
-			ExpectedObjects: []string{},
-		},
-		"single file": {
-			InventoryFiles:  []string{"f4"},
-			ExpectedObjects: []string{"f4row1", "f4row2", "f4row3", "f4row4", "f4row5", "f4row6", "f4row7"},
-		},
-		"unsorted inventory file": {
-			InventoryFiles: []string{"f1", "unsorted_file"},
-			ErrExpected:    s3.ErrInventoryNotSorted,
-			ShouldSort:     true,
-		},
-		"file with error": {
-			InventoryFiles: []string{"f5", "err_file1"},
-			ErrExpected:    ErrReadFile,
-		},
-		"file with error in the middle": {
-			InventoryFiles: []string{"f1", "f2", "f3", "f4", "f5", "f6", "err_file2"},
-			ErrExpected:    ErrReadFile,
-		},
-		"file with many deletions": {
-			InventoryFiles:  []string{"f7"},
-			ExpectedObjects: []string{"f7row1", "f7row11"},
-		},
-		"inventory with everything deleted": {
-			InventoryFiles:  []string{"all_deleted1", "all_deleted2", "all_deleted3"},
-			ExpectedObjects: []string{},
-		},
-		"many files with everything deleted": {
-			InventoryFiles:  []string{"all_deleted1", "all_deleted2", "f1", "all_deleted3", "all_deleted4", "all_deleted5", "all_deleted6", "all_deleted7", "f2", "all_deleted8", "all_deleted9"},
-			ExpectedObjects: []string{"f1row2", "f1row3", "f2row1", "f2row2"},
-		},
-		"many files with everything deleted - sort before test": {
-			InventoryFiles:  []string{"all_deleted1", "all_deleted2", "f2", "all_deleted3", "all_deleted4", "all_deleted5", "all_deleted6", "all_deleted7", "f1", "all_deleted8", "all_deleted9"},
-			ExpectedObjects: []string{"f1row2", "f1row3", "f2row1", "f2row2"},
-			ShouldSort:      true,
-		},
-		"empty file": {
-			InventoryFiles:  []string{"empty_file"},
-			ExpectedObjects: []string{},
-		},
-		"overlapping inventory files": {
-			InventoryFiles: []string{"f_overlap1", "f_overlap2"},
-			ShouldSort:     true,
-			ErrExpected:    s3.ErrInventoryFilesRangesOverlap,
-		},
-		"overlapping inventory files - type 2": {
-			InventoryFiles: []string{"f_overlap1", "f_overlap3"},
-			ShouldSort:     true,
-			ErrExpected:    s3.ErrInventoryFilesRangesOverlap,
-		},
-		"overlapping inventory files - type 3": {
-			InventoryFiles: []string{"f_overlap1", "f_overlap4"},
-			ShouldSort:     true,
-			ErrExpected:    s3.ErrInventoryFilesRangesOverlap,
-		},
-		"overlapping inventory files - type 4": {
-			InventoryFiles: []string{"f_overlap4", "f_overlap5"},
-			ShouldSort:     true,
-			ErrExpected:    s3.ErrInventoryFilesRangesOverlap,
-		},
-		"import with prefix": {
-			InventoryFiles:             []string{"f1_prefix", "f2_prefix"},
-			Prefixes:                   []string{"b"},
-			ExpectedObjects:            []string{"b1", "b2", "b3", "b4"},
-			ExpectedCountReadRows:      8,
-			ExpectedCountGetFileReader: 2,
-		},
-		"import with prefix - skip entire file": {
-			InventoryFiles:             []string{"f1_prefix", "f2_prefix", "f3_prefix"},
-			Prefixes:                   []string{"b"},
-			ExpectedObjects:            []string{"b1", "b2", "b3", "b4"},
-			ExpectedCountReadRows:      8,
-			ExpectedCountGetFileReader: 2,
-		},
-		"import with prefix - skip first file": {
-			InventoryFiles:             []string{"f1", "f2", "f3"},
-			Prefixes:                   []string{"f2", "f3"},
-			ExpectedObjects:            []string{"f2row1", "f2row2", "f3row1", "f3row2"},
-			ExpectedCountReadRows:      4,
-			ExpectedCountGetFileReader: 2,
-		},
-		"import with prefix - unsorted prefixes": {
-			InventoryFiles:             []string{"f1", "f2", "f3"},
-			Prefixes:                   []string{"f3", "f2"},
-			ExpectedObjects:            []string{"f2row1", "f2row2", "f3row1", "f3row2"},
-			ExpectedCountReadRows:      4,
-			ExpectedCountGetFileReader: 2,
-		},
-		"import with prefix - unsorted inventory": {
-			InventoryFiles:             []string{"f3", "f2", "f1"},
-			Prefixes:                   []string{"f2", "f3"},
-			ExpectedObjects:            []string{"f2row1", "f2row2", "f3row1", "f3row2"},
-			ShouldSort:                 true,
-			ExpectedCountReadRows:      4,
-			ExpectedCountGetFileReader: 2,
-		},
-		"import with prefix - prefix in middle": {
-			InventoryFiles:             []string{"f4_prefix", "f5_prefix"},
-			Prefixes:                   []string{"b", "f"},
-			ExpectedObjects:            []string{"b1", "b2", "f1", "f2"},
-			ExpectedCountReadRows:      16,
-			ExpectedCountGetFileReader: 2,
-		},
-	}
-	manifestURL := "s3://example-bucket/manifest1.json"
-	for name, test := range testdata {
-		t.Run(name, func(t *testing.T) {
-			reader := &mockInventoryReader{openFiles: make(map[string]bool), lastModified: lastModified}
-			inventoryFiles := make([]s3.InventoryFile, 0, len(test.InventoryFiles))
-			for _, filename := range test.InventoryFiles {
-				inventoryFiles = append(inventoryFiles, s3.InventoryFile{Key: filename})
-			}
-			inv, err := s3.GenerateInventory(context.Background(), logging.ContextUnavailable(), &s3.Manifest{
-				URL:                manifestURL,
-				InventoryBucketArn: "arn:aws:s3:::example-bucket",
-				SourceBucket:       "lakefs-example-data",
-				Files:              inventoryFiles,
-				Format:             "Parquet",
-				CreationTimestamp:  "1593216000000",
-			}, reader, test.ShouldSort, test.Prefixes)
-			if err != nil {
-				if errors.Is(err, test.ErrExpected) {
-					return
-				}
-				t.Fatalf("error: %v", err)
-			}
-			it := inv.Iterator()
-			objects := make([]*block.InventoryObject, 0, len(test.ExpectedObjects))
-			for it.Next() {
-				objects = append(objects, it.Get())
-			}
-			if len(reader.openFiles) != 0 {
-				t.Errorf("some files stayed open: %v", reader.openFiles)
-			}
-			if !errors.Is(it.Err(), test.ErrExpected) {
-				t.Fatalf("got unexpected error. expected=%v, got=%v.", test.ErrExpected, it.Err())
-			}
-			if test.ErrExpected != nil {
-				return
-			}
-			if len(objects) != len(test.ExpectedObjects) {
-				t.Fatalf("unexpected number of objects in inventory. expected=%d, got=%d", len(test.ExpectedObjects), len(objects))
-			}
-			if test.ExpectedCountReadRows > 0 && test.ExpectedCountReadRows != reader.countReadRows {
-				t.Fatalf("total number of read rows different than expected. expected=%d, got=%d", test.ExpectedCountReadRows, reader.countReadRows)
-			}
-			if test.ExpectedCountGetFileReader > 0 && test.ExpectedCountGetFileReader != reader.countGetFileReader {
-				t.Fatalf("total number of get file reader different than expected. expected=%d, got=%d", test.ExpectedCountGetFileReader, reader.countGetFileReader)
-			}
-			for i, obj := range objects {
-				if obj.Key != test.ExpectedObjects[i] {
-					t.Fatalf("at index %d: expected=%s, got=%s", i, test.ExpectedObjects[i], obj.Key)
-				}
-				if *obj.LastModified != lastModified[obj.Key] {
-					t.Fatalf("last modified for object in index %d different than expected. expected=%v, got=%v", i, lastModified[obj.Key], obj.LastModified)
-				}
-			}
-		})
-	}
-}
-
-type mockInventoryReader struct {
-	openFiles          map[string]bool
-	lastModified       map[string]time.Time
-	countReadRows      int
-	countGetFileReader int
-}
-
-type mockInventoryFileReader struct {
-	rows            []*s3inventory.InventoryObject
-	nextIdx         int
-	inventoryReader *mockInventoryReader
-	key             string
-}
-
-func (m *mockInventoryFileReader) FirstObjectKey() string {
-	if len(m.rows) == 0 {
-		return ""
-	}
-	min := m.rows[0].Key
-	for _, r := range m.rows {
-		if r.Key < min {
-			min = r.Key
-		}
-	}
-	return min
-}
-
-func (m *mockInventoryFileReader) LastObjectKey() string {
-	max := ""
-	for _, r := range m.rows {
-		if r.Key > max {
-			max = r.Key
-		}
-	}
-	return max
-}
-
-func (m *mockInventoryFileReader) Close() error {
-	m.nextIdx = -1
-	m.rows = nil
-	delete(m.inventoryReader.openFiles, m.key)
-	return nil
-}
-
-func (m *mockInventoryFileReader) Read(n int) ([]*s3inventory.InventoryObject, error) {
-	res := make([]*s3inventory.InventoryObject, 0, len(m.rows))
-	for i := m.nextIdx; i < len(m.rows) && i < m.nextIdx+n; i++ {
-		if m.rows[i] == nil {
-			return nil, ErrReadFile // for test - simulate file with error
-		}
-		res = append(res, m.rows[i])
-	}
-	m.nextIdx = m.nextIdx + len(res)
-	m.inventoryReader.countReadRows += len(res)
-	return res, nil
-}
-
-func (m *mockInventoryFileReader) GetNumRows() int64 {
-	return int64(len(m.rows))
-}
-
-func (m *mockInventoryReader) GetFileReader(_ string, _ string, key string) (s3inventory.FileReader, error) {
-	m.openFiles[key] = true
-	m.countGetFileReader++
-	return &mockInventoryFileReader{rows: rows(fileContents[key], m.lastModified), inventoryReader: m, key: key}, nil
-}
-
-func (m *mockInventoryReader) GetMetadataReader(_ string, _ string, key string) (s3inventory.MetadataReader, error) {
-	m.openFiles[key] = true
-	return &mockInventoryFileReader{rows: rows(fileContents[key], m.lastModified), inventoryReader: m, key: key}, nil
-}
diff --git a/pkg/block/s3/main_test.go b/pkg/block/s3/main_test.go
index 4aba80bb3ec..8fd91a5f9ee 100644
--- a/pkg/block/s3/main_test.go
+++ b/pkg/block/s3/main_test.go
@@ -66,7 +66,7 @@ func TestMain(m *testing.M) {
 		panic("could not expire minio container: " + err.Error())
 	}
 
-	// Create test client and bucket
+	// Create a test client and bucket
 	client, err := newClient(resource.GetPort("9000/tcp"))
 	if err != nil {
 		log.Fatalf("create client: %s", err)
diff --git a/pkg/block/s3/stream.go b/pkg/block/s3/stream.go
deleted file mode 100644
index 0a12ad50fe4..00000000000
--- a/pkg/block/s3/stream.go
+++ /dev/null
@@ -1,156 +0,0 @@
-package s3
-
-import (
-	"bytes"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io"
-	"time"
-
-	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
-	"github.com/treeverse/lakefs/pkg/logging"
-)
-
-const (
-	StreamingSha256          = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
-	StreamingContentEncoding = "aws-chunked"
-)
-
-type StreamingReader struct {
-	Reader       io.Reader
-	Size         int64
-	StreamSigner *v4.StreamSigner
-	Time         time.Time
-	ChunkSize    int
-	ChunkTimeout time.Duration
-
-	currentChunk io.Reader
-	totalRead    int64
-	eof          bool
-}
-
-func chunkBoundary(signature []byte, length int) []byte {
-	return []byte(fmt.Sprintf("%x;chunk-signature=%s\r\n", length, hex.EncodeToString(signature)))
-}
-
-func isEOF(err error) bool {
-	return err == io.EOF || errors.Is(err, io.ErrUnexpectedEOF)
-}
-
-func (s *StreamingReader) GetLastChunk() []byte {
-	res := make([]byte, 0)
-	sig, _ := s.StreamSigner.GetSignature([]byte{}, []byte{}, s.Time)
-	lastBoundary := chunkBoundary(sig, 0)
-	res = append(res, lastBoundary...)
-	res = append(res, '\r', '\n') // additional \r\n after the last boundary
-	return res
-}
-
-// ReadAllWithTimeout is taken from io.ReadAtLeast and adapted to support a timeout and a minimum read size
-func ReadAllWithTimeout(r io.Reader, buf []byte, timeout time.Duration, minSize int) (n int, err error) {
-	desired := len(buf)
-
-	lg := logging.ContextUnavailable().WithFields(logging.Fields{
-		"timeout":      timeout,
-		"desired_size": desired,
-	})
-
-	start := time.Now()
-	timedOut := false
-	for n < desired && err == nil {
-		var nn int
-		nn, err = r.Read(buf[n:])
-		n += nn
-
-		if time.Since(start) > timeout && n >= minChunkSize {
-			timedOut = true
-			break
-		}
-	}
-	if n >= desired {
-		err = nil
-	} else if n > 0 && err == io.EOF {
-		err = io.ErrUnexpectedEOF
-	}
-	if err == nil && timedOut {
-		err = ErrReaderTimeout
-		lg.WithField("n", n).Warn("duration passed, reader timed out")
-	}
-	return
-}
-
-var ErrReaderTimeout = errors.New("reader timeout")
-
-func (s *StreamingReader) readNextChunk() error {
-	buf := make([]byte, s.ChunkSize)
-	n, err := ReadAllWithTimeout(s.Reader, buf, s.ChunkTimeout, minChunkSize)
-	s.totalRead += int64(n)
-	buf = buf[:n]
-	if err != nil && !isEOF(err) && !errors.Is(err, ErrReaderTimeout) {
-		// actual error happened
-		return err
-	}
-	if n == 0 {
-		if s.currentChunk == nil {
-			s.currentChunk = bytes.NewBuffer(s.GetLastChunk())
-		}
-		return io.EOF
-	}
-	sig, sigErr := s.StreamSigner.GetSignature([]byte{}, buf, s.Time)
-	if sigErr != nil {
-		return sigErr
-	}
-
-	buf = append(buf, '\r', '\n') // additional \r\n after the content
-	boundary := chunkBoundary(sig, n)
-	if isEOF(err) || s.totalRead == s.Size {
-		// we're done with the upstream Reader, let's write one last chunk boundary.
-		buf = append(buf, s.GetLastChunk()...)
-	}
-	buf = append(boundary, buf...)
-	s.currentChunk = bytes.NewBuffer(buf)
-	if s.totalRead == s.Size {
-		err = io.EOF
-	}
-	if errors.Is(err, ErrReaderTimeout) {
-		return nil // a slow reader shouldn't fail.
-	}
-	return err
-}
-
-func (s *StreamingReader) Read(p []byte) (int, error) {
-	if s.eof {
-		return 0, io.EOF
-	}
-
-	var nerr error
-	var currentN int
-	if s.currentChunk == nil {
-		nerr = s.readNextChunk()
-		if nerr != nil && !isEOF(nerr) {
-			return currentN, nerr
-		}
-	}
-
-	for currentN < len(p) {
-		n, err := s.currentChunk.Read(p[currentN:])
-		currentN += n
-		if err != nil && !isEOF(err) {
-			return currentN, err
-		}
-		if isEOF(err) { // we drained the current chunk
-			if isEOF(nerr) { // no more chunks to read
-				s.eof = true
-				return currentN, io.EOF
-			}
-			// otherwise, we read the entire chunk, let's fill it back up (if n < size of p)
-			nerr = s.readNextChunk()
-			if nerr != nil && !isEOF(nerr) {
-				return currentN, nerr // something bad happened when reading the next chunk
-			}
-		}
-	}
-
-	return currentN, nil
-}
diff --git a/pkg/block/s3/stream_test.go b/pkg/block/s3/stream_test.go
deleted file mode 100644
index 8332cb2e528..00000000000
--- a/pkg/block/s3/stream_test.go
+++ /dev/null
@@ -1,146 +0,0 @@
-package s3_test
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
-	"github.com/aws/aws-sdk-go/service/s3"
-	s3a "github.com/treeverse/lakefs/pkg/block/s3"
-)
-
-func TestS3StreamingReader_Read(t *testing.T) {
-	// generate test data
-	cases := []struct {
-		Name      string
-		Input     []byte
-		ChunkSize int
-		Expected  []byte
-		Delay     bool
-	}{
-		{
-			Name:      "chunk5_data10",
-			Input:     mustReadFile(t, "testdata/chunk5_data10.input"),
-			ChunkSize: 5,
-			Expected:  mustReadFile(t, "testdata/chunk5_data10.output"),
-		},
-		{
-			Name:      "chunk250_data500",
-			Input:     mustReadFile(t, "testdata/chunk250_data500.input"),
-			ChunkSize: 250,
-			Expected:  mustReadFile(t, "testdata/chunk250_data500.output"),
-		},
-		{
-			Name:      "chunk250_data510",
-			Input:     mustReadFile(t, "testdata/chunk250_data510.input"),
-			ChunkSize: 250,
-			Expected:  mustReadFile(t, "testdata/chunk250_data510.output"),
-		},
-		{
-			Name:      "chunk600_data240",
-			Input:     mustReadFile(t, "testdata/chunk600_data240.input"),
-			ChunkSize: 250,
-			Expected:  mustReadFile(t, "testdata/chunk600_data240.output"),
-		},
-		{
-			Name:      "chunk3000_data10",
-			Input:     mustReadFile(t, "testdata/chunk3000_data10.input"),
-			ChunkSize: 250,
-			Expected:  mustReadFile(t, "testdata/chunk3000_data10.output"),
-		},
-		{
-			Name:      "chunk5_data0",
-			Input:     mustReadFile(t, "testdata/chunk5_data0.input"),
-			ChunkSize: 5,
-			Expected:  mustReadFile(t, "testdata/chunk5_data0.output"),
-		},
-		{
-			Name:      "delayed_chunk5_data0",
-			Input:     mustReadFile(t, "testdata/chunk5_data0.input"),
-			ChunkSize: 5,
-			Expected:  mustReadFile(t, "testdata/chunk5_data0.output"),
-			Delay:     true,
-		},
-	}
-
-	for _, cas := range cases {
-		t.Run(cas.Name, func(t *testing.T) {
-			// this is just boilerplate to create a signature
-			keys := credentials.NewStaticCredentials("AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "")
-			sigTime, _ := time.Parse("Jan 2 15:04:05 2006 -0700", "Apr 7 15:13:13 2005 -0700")
-			req, _ := http.NewRequest(http.MethodPut, "https://s3.amazonaws.com/example/foo", nil)
-			req.Header.Set("Content-Encoding", "aws-chunked")
-			req.Header.Set("Transfer-Encoding", "chunked")
-			req.Header.Set("x-amz-content-sha", "STREAMING-AWS4-HMAC-SHA256-PAYLOAD")
-			req.Header.Set("x-amz-decoded-content-length", fmt.Sprintf("%d", len(cas.Input)))
-			req.Header.Set("Expect", "100-Continue")
-			baseSigner := v4.NewSigner(keys)
-
-			signature, err := baseSigner.Sign(req, nil, s3.ServiceName, "us-east-1", sigTime)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			for k := range signature {
-				req.Header.Set(k, signature.Get(k))
-			}
-
-			sigSeed, err := v4.GetSignedRequestSignature(req)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			r := io.NopCloser(bytes.NewBuffer(cas.Input))
-			timeout := time.Second * 300
-			if cas.Delay {
-				r = io.NopCloser(&delayReader{
-					r:    bytes.NewBuffer(cas.Input),
-					wait: 2 * time.Millisecond,
-				})
-				timeout = time.Millisecond
-			}
-
-			data := &s3a.StreamingReader{
-				Reader:       r,
-				Size:         int64(len(cas.Input)),
-				StreamSigner: v4.NewStreamSigner("us-east-1", s3.ServiceName, sigSeed, keys),
-				Time:         sigTime,
-				ChunkSize:    cas.ChunkSize,
-				ChunkTimeout: timeout,
-			}
-
-			out, err := io.ReadAll(data)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if !bytes.Equal(out, cas.Expected) {
-				t.Fatalf("got wrong chunked data. Got:\n%s\nExpected:\n%s\n", out, cas.Expected)
-			}
-		})
-	}
-}
-
-func mustReadFile(t *testing.T, path string) []byte {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return data
-}
-
-type delayReader struct {
-	r    io.Reader
-	wait time.Duration
-}
-
-func (d *delayReader) Read(p []byte) (n int, err error) {
-	time.Sleep(d.wait)
-	return d.r.Read(p)
-}
diff --git a/pkg/block/s3/walker.go b/pkg/block/s3/walker.go
index 8f149442c2e..f19132da9ef 100644
--- a/pkg/block/s3/walker.go
+++ b/pkg/block/s3/walker.go
@@ -6,22 +6,20 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3iface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/treeverse/lakefs/pkg/block"
 )
 
 type Walker struct {
-	s3   s3iface.S3API
-	mark block.Mark
+	client *s3.Client
+	mark   block.Mark
 }
 
-func NewS3Walker(sess *session.Session) *Walker {
+func NewS3Walker(client *s3.Client) *Walker {
 	return &Walker{
-		s3:   s3.New(sess),
-		mark: block.Mark{HasMore: true},
+		client: client,
+		mark:   block.Mark{HasMore: true},
 	}
 }
 
@@ -48,10 +46,10 @@ func (s *Walker) Walk(ctx context.Context, storageURI *url.URL, op block.WalkOpt
 	}
 	bucket := storageURI.Host
 	for {
-		result, err := s.s3.ListObjectsV2WithContext(ctx, &s3.ListObjectsV2Input{
+		result, err := s.client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
 			Bucket:            aws.String(bucket),
 			ContinuationToken: continuation,
-			MaxKeys:           aws.Int64(maxKeys),
+			MaxKeys:           maxKeys,
 			Prefix:            aws.String(prefix),
 			StartAfter:        aws.String(op.After),
 		})
@@ -62,15 +60,15 @@ func (s *Walker) Walk(ctx context.Context, storageURI *url.URL, op block.WalkOpt
 			return err
 		}
 		for _, record := range result.Contents {
-			key := aws.StringValue(record.Key)
+			key := aws.ToString(record.Key)
 			addr := fmt.Sprintf("s3://%s/%s", bucket, key)
 			ent := block.ObjectStoreEntry{
 				FullKey:     key,
 				RelativeKey: strings.TrimPrefix(key, basePath),
 				Address:     addr,
-				ETag:        strings.Trim(aws.StringValue(record.ETag), "\""),
-				Mtime:       aws.TimeValue(record.LastModified),
-				Size:        aws.Int64Value(record.Size),
+				ETag:        strings.Trim(aws.ToString(record.ETag), "\""),
+				Mtime:       aws.ToTime(record.LastModified),
+				Size:        record.Size,
 			}
 			s.mark.LastKey = key
 			err := walkFn(ent)
@@ -78,7 +76,7 @@ func (s *Walker) Walk(ctx context.Context, storageURI *url.URL, op block.WalkOpt
 				return err
 			}
 		}
-		if !aws.BoolValue(result.IsTruncated) {
+		if !result.IsTruncated {
 			break
 		}
 		continuation = result.NextContinuationToken
diff --git a/pkg/block/transient/adapter.go b/pkg/block/transient/adapter.go
index f7e4527559d..c9ceac105aa 100644
--- a/pkg/block/transient/adapter.go
+++ b/pkg/block/transient/adapter.go
@@ -13,7 +13,6 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/treeverse/lakefs/pkg/block"
-	"github.com/treeverse/lakefs/pkg/logging"
 )
 
 var ErrInventoryNotImplemented = errors.New("inventory feature not implemented for transient storage adapter")
@@ -143,10 +142,6 @@ func (a *Adapter) CompleteMultiPartUpload(context.Context, block.ObjectPointer,
 	}, nil
 }
 
-func (a *Adapter) GenerateInventory(_ context.Context, _ logging.Logger, _ string, _ bool, _ []string) (block.Inventory, error) {
-	return nil, ErrInventoryNotImplemented
-}
-
 func (a *Adapter) BlockstoreType() string {
 	return block.BlockstoreTypeTransient
 }
diff --git a/pkg/catalog/catalog_test.go b/pkg/catalog/catalog_test.go
index 127a4dc9ca7..ba5505f9879 100644
--- a/pkg/catalog/catalog_test.go
+++ b/pkg/catalog/catalog_test.go
@@ -734,8 +734,7 @@ func readPhysicalAddressesFromParquetObject(t *testing.T, repositoryID string, c
 
 	data, err := io.ReadAll(objReader)
 	require.NoError(t, err)
-	bufferFile, err := buffer.NewBufferFile(data)
-	require.NoError(t, err)
+	bufferFile := buffer.NewBufferFileFromBytes(data)
 	defer func() { _ = bufferFile.Close() }()
 
 	pr, err := reader.NewParquetReader(bufferFile, new(catalog.UncommittedParquetObject), 4)
diff --git a/pkg/cloud/aws/metadata.go b/pkg/cloud/aws/metadata.go
index f93c49c2de9..32070334d32 100644
--- a/pkg/cloud/aws/metadata.go
+++ b/pkg/cloud/aws/metadata.go
@@ -1,26 +1,27 @@
 package aws
 
 import (
+	"context"
 	"crypto/md5" //nolint:gosec
 	"fmt"
-	"net/http"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/sts"
+	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/cenkalti/backoff/v4"
+	"github.com/treeverse/lakefs/pkg/block/params"
 	"github.com/treeverse/lakefs/pkg/cloud"
 	"github.com/treeverse/lakefs/pkg/logging"
 )
 
 type MetadataProvider struct {
 	logger    logging.Logger
-	stsClient *sts.STS
+	stsClient *sts.Client
 }
 
-func NewMetadataProvider(logger logging.Logger, awsConfig *aws.Config) *MetadataProvider {
+func NewMetadataProvider(logger logging.Logger, params params.S3) (*MetadataProvider, error) {
 	// set up a session with a shorter timeout and no retries
 	const sessionMaxRetries = 0 // max number of retries on the client operation
 
@@ -28,23 +29,38 @@ func NewMetadataProvider(logger logging.Logger, awsConfig *aws.Config) *Metadata
 	// because the service can be inaccessible from networks
 	// which don't have an internet connection
 	const sessionTimeout = 5 * time.Second
-	metaConfig := &aws.Config{
-		HTTPClient: &http.Client{
-			Timeout: sessionTimeout,
-		},
-		MaxRetries: aws.Int(sessionMaxRetries),
+	/// params
+	var opts []func(*config.LoadOptions) error
+	if params.Region != "" {
+		opts = append(opts, config.WithRegion(params.Region))
+	}
+	if params.Profile != "" {
+		opts = append(opts, config.WithSharedConfigProfile(params.Profile))
+	}
+	if params.CredentialsFile != "" {
+		opts = append(opts, config.WithSharedCredentialsFiles([]string{params.CredentialsFile}))
+	}
+	if params.Credentials.AccessKeyID != "" {
+		opts = append(opts, config.WithCredentialsProvider(
+			credentials.NewStaticCredentialsProvider(
+				params.Credentials.AccessKeyID,
+				params.Credentials.SecretAccessKey,
+				params.Credentials.SessionToken,
+			),
+		))
 	}
 
-	var stsClient *sts.STS
-	sess, err := session.NewSession(awsConfig.Copy(metaConfig))
+	cfg, err := config.LoadDefaultConfig(context.Background(), opts...)
 	if err != nil {
-		logger.WithError(err).Warn("Failed to create AWS session for BI")
-	} else {
-		sess.ClientConfig(s3.ServiceName)
-		stsClient = sts.New(sess)
+		return nil, err
 	}
 
-	return &MetadataProvider{logger: logger, stsClient: stsClient}
+	stsClient := sts.NewFromConfig(cfg, func(options *sts.Options) {
+		options.RetryMaxAttempts = sessionMaxRetries
+		options.HTTPClient = awshttp.NewBuildableClient().
+			WithTimeout(sessionTimeout)
+	})
+	return &MetadataProvider{logger: logger, stsClient: stsClient}, nil
 }
 
 func (m *MetadataProvider) GetMetadata() map[string]string {
@@ -58,8 +74,9 @@ func (m *MetadataProvider) GetMetadata() map[string]string {
 	bo := backoff.NewExponentialBackOff()
 	bo.MaxInterval = maxInterval
 	bo.MaxElapsedTime = maxElapsedTime
+	ctx := context.Background()
 	identity, err := backoff.RetryWithData(func() (*sts.GetCallerIdentityOutput, error) {
-		identity, err := m.stsClient.GetCallerIdentity(&sts.GetCallerIdentityInput{})
+		identity, err := m.stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
 		if err != nil {
 			m.logger.WithError(err).Warn("Tried to to get AWS account ID for BI")
 			return nil, err
diff --git a/pkg/cloud/aws/s3inventory/orc_reader.go b/pkg/cloud/aws/s3inventory/orc_reader.go
deleted file mode 100644
index 4379a0b23b2..00000000000
--- a/pkg/cloud/aws/s3inventory/orc_reader.go
+++ /dev/null
@@ -1,128 +0,0 @@
-package s3inventory
-
-import (
-	"context"
-	"time"
-
-	"github.com/hashicorp/go-multierror"
-	"github.com/scritchley/orc"
-)
-
-type OrcInventoryFileReader struct {
-	reader    *orc.Reader
-	cursor    *orc.Cursor
-	ctx       context.Context
-	orcSelect *OrcSelect
-	orcFile   *OrcFile
-}
-
-type OrcField struct {
-	IndexInFile   int
-	IndexInSelect int
-}
-
-type OrcSelect struct {
-	SelectFields  []string       // the list of fields to select from the file
-	IndexInSelect map[string]int // for each field, its index in the select query
-	IndexInFile   map[string]int // for each field, its index in the original file
-}
-
-func getOrcSelect(typeDescription *orc.TypeDescription) *OrcSelect {
-	res := &OrcSelect{
-		SelectFields:  nil,
-		IndexInFile:   make(map[string]int),
-		IndexInSelect: make(map[string]int),
-	}
-	for i, field := range typeDescription.Columns() {
-		res.IndexInFile[field] = i
-	}
-	j := 0
-	for _, field := range inventoryFields {
-		if _, ok := res.IndexInFile[field]; ok {
-			res.SelectFields = append(res.SelectFields, field)
-			res.IndexInSelect[field] = j
-			j++
-		}
-	}
-	return res
-}
-
-func (r *OrcInventoryFileReader) inventoryObjectFromRow(rowData []interface{}) *InventoryObject {
-	obj := NewInventoryObject()
-	obj.Bucket = rowData[r.orcSelect.IndexInSelect[bucketFieldName]].(string)
-	obj.Key = rowData[r.orcSelect.IndexInSelect[keyFieldName]].(string)
-	if sizeIdx, ok := r.orcSelect.IndexInSelect[sizeFieldName]; ok && rowData[sizeIdx] != nil {
-		obj.Size = rowData[sizeIdx].(int64)
-	}
-	if lastModifiedIdx, ok := r.orcSelect.IndexInSelect[lastModifiedDateFieldName]; ok && rowData[lastModifiedIdx] != nil {
-		tm := rowData[lastModifiedIdx].(time.Time)
-		obj.LastModified = &tm
-	}
-	if eTagIdx, ok := r.orcSelect.IndexInSelect[eTagFieldName]; ok && rowData[eTagIdx] != nil {
-		obj.Checksum = rowData[eTagIdx].(string)
-	}
-	if isLatestIdx, ok := r.orcSelect.IndexInSelect[isLatestFieldName]; ok && rowData[isLatestIdx] != nil {
-		obj.IsLatest = rowData[isLatestIdx].(bool)
-	}
-	if isDeleteMarkerIdx, ok := r.orcSelect.IndexInSelect[isDeleteMarkerFieldName]; ok && rowData[isDeleteMarkerIdx] != nil {
-		obj.IsDeleteMarker = rowData[isDeleteMarkerIdx].(bool)
-	}
-	return obj
-}
-
-func (r *OrcInventoryFileReader) Read(n int) ([]*InventoryObject, error) {
-	res := make([]*InventoryObject, 0, n)
-	for {
-		select {
-		case <-r.ctx.Done():
-			return nil, r.ctx.Err()
-		default:
-		}
-		if !r.cursor.Next() {
-			if !r.cursor.Stripes() {
-				break
-			}
-			if !r.cursor.Next() {
-				break
-			}
-		}
-		obj := r.inventoryObjectFromRow(r.cursor.Row())
-		res = append(res, obj)
-		if len(res) == n {
-			break
-		}
-	}
-	return res, nil
-}
-
-func (r *OrcInventoryFileReader) GetNumRows() int64 {
-	return int64(r.reader.NumRows())
-}
-
-func (r *OrcInventoryFileReader) Close() error {
-	var combinedErr error
-	if err := r.cursor.Close(); err != nil {
-		combinedErr = multierror.Append(combinedErr, err)
-	}
-	if err := r.reader.Close(); err != nil {
-		combinedErr = multierror.Append(combinedErr, err)
-	}
-	if err := r.orcFile.Close(); err != nil {
-		combinedErr = multierror.Append(combinedErr, err)
-	}
-	return combinedErr
-}
-
-func (r *OrcInventoryFileReader) FirstObjectKey() string {
-	if len(r.reader.Metadata().StripeStats) == 0 {
-		return ""
-	}
-	return *r.reader.Metadata().StripeStats[0].GetColStats()[r.orcSelect.IndexInFile[keyFieldName]+1].StringStatistics.Minimum
-}
-
-func (r *OrcInventoryFileReader) LastObjectKey() string {
-	if len(r.reader.Metadata().StripeStats) == 0 {
-		return ""
-	}
-	return *r.reader.Metadata().StripeStats[0].GetColStats()[r.orcSelect.IndexInFile[keyFieldName]+1].StringStatistics.Maximum
-}
diff --git a/pkg/cloud/aws/s3inventory/orc_utils.go b/pkg/cloud/aws/s3inventory/orc_utils.go
deleted file mode 100644
index 466571a91a8..00000000000
--- a/pkg/cloud/aws/s3inventory/orc_utils.go
+++ /dev/null
@@ -1,145 +0,0 @@
-package s3inventory
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3iface"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
-	gproto "github.com/golang/protobuf/proto" //nolint:staticcheck // orc lib uses old proto
-	"github.com/scritchley/orc/proto"
-	"github.com/treeverse/lakefs/pkg/logging"
-)
-
-const (
-	maxPostScriptSize  = 256 // from the ORC specification: https://orc.apache.org/specification/ORCv1/
-	orcInitialReadSize = 16000
-	downloadTimeout    = 3 * time.Minute
-)
-
-// getTailLength reads the ORC postscript from the given file, returning the full tail length.
-// The tail length equals (footer + metadata + postscript + 1) bytes.
-func getTailLength(f *os.File) (int, error) {
-	stat, err := f.Stat()
-	if err != nil {
-		return 0, err
-	}
-	fileSize := stat.Size()
-	psPlusByte := int64(maxPostScriptSize + 1)
-	if psPlusByte > fileSize {
-		psPlusByte = fileSize
-	}
-	// Read the last 256 bytes into buffer to get postscript
-	postScriptBytes := make([]byte, psPlusByte)
-	sr := io.NewSectionReader(f, fileSize-psPlusByte, psPlusByte)
-	_, err = io.ReadFull(sr, postScriptBytes)
-	if err != nil {
-		return 0, err
-	}
-	psLen := int(postScriptBytes[len(postScriptBytes)-1])
-	psOffset := len(postScriptBytes) - 1 - psLen
-	postScript := &proto.PostScript{}
-	err = gproto.Unmarshal(postScriptBytes[psOffset:psOffset+psLen], postScript)
-	if err != nil {
-		return 0, err
-	}
-	footerLength := int(postScript.GetFooterLength())
-	metadataLength := int(postScript.GetMetadataLength())
-	return footerLength + metadataLength + psLen + 1, nil
-}
-
-func downloadRange(ctx context.Context, svc s3iface.S3API, logger logging.Logger, bucket string, key string, fromByte int64) (*os.File, error) {
-	f, err := os.CreateTemp("", path.Base(key))
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		if err := os.Remove(f.Name()); err != nil {
-			logger.WithError(err).WithField("file", f.Name()).Error("Failed to remove orc file after download")
-		}
-	}()
-	downloader := s3manager.NewDownloaderWithClient(svc)
-	var rng *string
-	if fromByte > 0 {
-		rng = aws.String(fmt.Sprintf("bytes=%d-", fromByte))
-	}
-	logger.Debugf("start downloading %s[%s] to local file %s", key, aws.StringValue(rng), f.Name())
-	timeoutCtx, cancelFn := context.WithTimeout(ctx, downloadTimeout)
-	defer cancelFn()
-	_, err = downloader.DownloadWithContext(timeoutCtx, f, &s3.GetObjectInput{
-		Bucket: aws.String(bucket),
-		Key:    aws.String(key),
-		Range:  rng,
-	})
-	if err != nil {
-		logger.WithError(err).
-			WithFields(logging.Fields{
-				"download_from_bucket": bucket,
-				"download_from_key":    key,
-				"download_to":          f.Name(),
-			}).Debug("error when downloading orc file")
-		return nil, err
-	}
-	logger.Debugf("finished downloading %s to local file %s", key, f.Name())
-	return f, nil
-}
-
-// DownloadOrc downloads a file from s3 and returns a ReaderSeeker to it.
-// If tailOnly is set to true, download only the tail (metadata+footer) by trying the last `orcInitialReadSize` bytes of the file.
-// Then, check the last byte to see if the whole tail was downloaded. If not, download again with the actual tail length.
-func DownloadOrc(ctx context.Context, svc s3iface.S3API, logger logging.Logger, bucket string, key string, tailOnly bool) (*OrcFile, error) {
-	var size int64
-	if tailOnly {
-		headObject, err := svc.HeadObject(&s3.HeadObjectInput{
-			Bucket: aws.String(bucket),
-			Key:    aws.String(key),
-		})
-		if err != nil {
-			return nil, err
-		}
-		size = *headObject.ContentLength
-	}
-	f, err := downloadRange(ctx, svc, logger, bucket, key, size-orcInitialReadSize)
-	if err != nil {
-		return nil, err
-	}
-	if tailOnly {
-		tailLength, err := getTailLength(f)
-		if err != nil {
-			return nil, err
-		}
-		if tailLength > orcInitialReadSize {
-			// tail didn't fit in initially downloaded file
-			if err = f.Close(); err != nil {
-				logger.WithError(err).WithField("file", f.Name()).Error("failed to close orc file")
-			}
-			f, err = downloadRange(ctx, svc, logger, bucket, key, size-int64(tailLength))
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-	return &OrcFile{f}, nil
-}
-
-type OrcFile struct {
-	*os.File
-}
-
-func (or *OrcFile) Size() int64 {
-	stats, err := or.Stat()
-	if err != nil {
-		return 0
-	}
-	return stats.Size()
-}
-
-func (or *OrcFile) Close() error {
-	return or.File.Close()
-}
diff --git a/pkg/cloud/aws/s3inventory/parquet_reader.go b/pkg/cloud/aws/s3inventory/parquet_reader.go
deleted file mode 100644
index d56982a54d9..00000000000
--- a/pkg/cloud/aws/s3inventory/parquet_reader.go
+++ /dev/null
@@ -1,132 +0,0 @@
-package s3inventory
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/cznic/mathutil"
-	"github.com/spf13/cast"
-	"github.com/xitongsys/parquet-go/parquet"
-	"github.com/xitongsys/parquet-go/reader"
-	"github.com/xitongsys/parquet-go/schema"
-)
-
-type ParquetInventoryFileReader struct {
-	*reader.ParquetReader
-	nextRow            int64
-	fieldToParquetPath map[string]string
-}
-
-func NewParquetInventoryFileReader(parquetReader *reader.ParquetReader) (*ParquetInventoryFileReader, error) {
-	fieldToParquetPath := getParquetPaths(parquetReader.SchemaHandler)
-	for _, required := range requiredFields {
-		if _, ok := fieldToParquetPath[required]; !ok {
-			return nil, fmt.Errorf("%w: %s", ErrRequiredFieldNotFound, required)
-		}
-	}
-	return &ParquetInventoryFileReader{
-		ParquetReader:      parquetReader,
-		fieldToParquetPath: fieldToParquetPath,
-	}, nil
-}
-
-func (p *ParquetInventoryFileReader) Close() error {
-	p.ReadStop()
-	return p.PFile.Close()
-}
-
-func (p *ParquetInventoryFileReader) getKeyColumnStatistics(rowGroupIdx int) *parquet.Statistics {
-	columns := p.Footer.RowGroups[rowGroupIdx].Columns
-	for _, c := range columns {
-		metaData := c.GetMetaData()
-		if metaData.GetPathInSchema()[len(metaData.GetPathInSchema())-1] == "Key" {
-			return metaData.GetStatistics()
-		}
-	}
-	return columns[1].GetMetaData().GetStatistics()
-}
-
-func (p *ParquetInventoryFileReader) FirstObjectKey() string {
-	statistics := p.getKeyColumnStatistics(0)
-	if len(statistics.GetMin()) > 0 {
-		return string(statistics.GetMin())
-	}
-	return string(statistics.GetMinValue())
-}
-
-func (p *ParquetInventoryFileReader) LastObjectKey() string {
-	statistics := p.getKeyColumnStatistics(len(p.Footer.RowGroups) - 1)
-	if len(statistics.GetMax()) > 0 {
-		return string(statistics.GetMax())
-	}
-	return string(statistics.GetMinValue())
-}
-
-func (p *ParquetInventoryFileReader) Read(n int) ([]*InventoryObject, error) {
-	num := mathutil.MinInt64(int64(n), p.GetNumRows()-p.nextRow)
-	p.nextRow += num
-	res := make([]*InventoryObject, num)
-	for fieldName, path := range p.fieldToParquetPath {
-		columnRes, _, dls, err := p.ReadColumnByPath(path, num)
-		if err != nil {
-			return nil, fmt.Errorf("failed to read parquet column %s: %w", fieldName, err)
-		}
-		for i, v := range columnRes {
-			if !isRequired(fieldName) && dls[i] == 0 {
-				// got no value for non-required field, move on
-				continue
-			}
-			if res[i] == nil {
-				res[i] = NewInventoryObject()
-			}
-			err := set(res[i], fieldName, v)
-			if err != nil {
-				return nil, fmt.Errorf("failed to read parquet column %s: %w", fieldName, err)
-			}
-		}
-	}
-	return res, nil
-}
-
-func set(o *InventoryObject, f string, v interface{}) error {
-	var err error
-	switch f {
-	case bucketFieldName:
-		o.Bucket, err = cast.ToStringE(v)
-	case keyFieldName:
-		o.Key, err = cast.ToStringE(v)
-	case isLatestFieldName:
-		o.IsLatest, err = cast.ToBoolE(v)
-	case isDeleteMarkerFieldName:
-		o.IsDeleteMarker, err = cast.ToBoolE(v)
-	case sizeFieldName:
-		o.Size, err = cast.ToInt64E(v)
-	case lastModifiedDateFieldName:
-		var lastModifiedMillis int64
-		lastModifiedMillis, err = cast.ToInt64E(v)
-		secToMS := int64(time.Second / time.Millisecond)
-		seconds := lastModifiedMillis / secToMS
-		ns := (lastModifiedMillis % secToMS) * int64(time.Millisecond/time.Nanosecond)
-		tm := time.Unix(seconds, ns)
-		o.LastModified = &tm
-	case eTagFieldName:
-		o.Checksum, err = cast.ToStringE(v)
-	default:
-		return fmt.Errorf("%w: %s", ErrUnknownField, f)
-	}
-	return err
-}
-
-// getParquetPaths returns parquet schema fields as a mapping from their base column name to their path in ParquetReader
-// only known inventory fields are returned
-func getParquetPaths(schemaHandler *schema.SchemaHandler) map[string]string {
-	res := make(map[string]string)
-	for i, fieldInfo := range schemaHandler.Infos {
-		for _, field := range inventoryFields {
-			if fieldInfo.ExName == field {
-				res[field] = schemaHandler.IndexMap[int32(i)]
-			}
-		}
-	}
-	return res
-}
diff --git a/pkg/cloud/aws/s3inventory/reader.go b/pkg/cloud/aws/s3inventory/reader.go
deleted file mode 100644
index 929199ef7c2..00000000000
--- a/pkg/cloud/aws/s3inventory/reader.go
+++ /dev/null
@@ -1,152 +0,0 @@
-package s3inventory
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/aws/aws-sdk-go/service/s3/s3iface"
-	"github.com/scritchley/orc"
-	"github.com/treeverse/lakefs/pkg/logging"
-	s3parquet "github.com/xitongsys/parquet-go-source/s3"
-	"github.com/xitongsys/parquet-go/reader"
-)
-
-const (
-	bucketFieldName           = "bucket"
-	keyFieldName              = "key"
-	sizeFieldName             = "size"
-	lastModifiedDateFieldName = "last_modified_date"
-	eTagFieldName             = "e_tag"
-	isDeleteMarkerFieldName   = "is_delete_marker"
-	isLatestFieldName         = "is_latest"
-)
-
-var inventoryFields = []string{
-	bucketFieldName,
-	keyFieldName,
-	sizeFieldName,
-	lastModifiedDateFieldName,
-	eTagFieldName,
-	isDeleteMarkerFieldName,
-	isLatestFieldName,
-}
-
-var requiredFields = []string{bucketFieldName, keyFieldName}
-
-const (
-	OrcFormatName     = "ORC"
-	ParquetFormatName = "Parquet"
-)
-
-var (
-	ErrUnsupportedInventoryFormat = errors.New("unsupported inventory type. supported types: parquet, orc")
-	ErrRequiredFieldNotFound      = errors.New("required field not found in inventory")
-	ErrUnknownField               = errors.New("unknown field")
-)
-
-type IReader interface {
-	GetFileReader(format string, bucket string, key string) (FileReader, error)
-	GetMetadataReader(format string, bucket string, key string) (MetadataReader, error)
-}
-
-type InventoryObject struct {
-	Bucket         string
-	Key            string
-	IsLatest       bool
-	IsDeleteMarker bool
-	Size           int64
-	LastModified   *time.Time
-	Checksum       string
-}
-
-func NewInventoryObject() *InventoryObject {
-	return &InventoryObject{IsLatest: true}
-}
-
-func (o *InventoryObject) GetPhysicalAddress() string {
-	return "s3://" + o.Bucket + "/" + o.Key
-}
-
-type Reader struct {
-	ctx    context.Context
-	svc    s3iface.S3API
-	logger logging.Logger
-}
-
-type MetadataReader interface {
-	GetNumRows() int64
-	Close() error
-	FirstObjectKey() string
-	LastObjectKey() string
-}
-
-type FileReader interface {
-	MetadataReader
-	Read(n int) ([]*InventoryObject, error)
-}
-
-func NewReader(ctx context.Context, svc s3iface.S3API, logger logging.Logger) IReader {
-	return &Reader{ctx: ctx, svc: svc, logger: logger}
-}
-
-func (o *Reader) GetFileReader(format string, bucket string, key string) (FileReader, error) {
-	switch format {
-	case OrcFormatName:
-		return o.getOrcReader(bucket, key, false)
-	case ParquetFormatName:
-		return o.getParquetReader(bucket, key)
-	default:
-		return nil, ErrUnsupportedInventoryFormat
-	}
-}
-
-func (o *Reader) GetMetadataReader(format string, bucket string, key string) (MetadataReader, error) {
-	switch format {
-	case OrcFormatName:
-		return o.getOrcReader(bucket, key, true)
-	default:
-		return o.GetFileReader(format, bucket, key)
-	}
-}
-
-func (o *Reader) getParquetReader(bucket string, key string) (FileReader, error) {
-	pf, err := s3parquet.NewS3FileReaderWithClient(o.ctx, o.svc, bucket, key)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create parquet file reader: %w", err)
-	}
-	pr, err := reader.NewParquetReader(pf, nil, 4) //nolint: gomnd
-	if err != nil {
-		return nil, fmt.Errorf("failed to create parquet reader: %w", err)
-	}
-	return NewParquetInventoryFileReader(pr)
-}
-
-func (o *Reader) getOrcReader(bucket string, key string, tailOnly bool) (FileReader, error) {
-	orcFile, err := DownloadOrc(o.ctx, o.svc, o.logger, bucket, key, tailOnly)
-	if err != nil {
-		return nil, err
-	}
-	orcReader, err := orc.NewReader(orcFile)
-	if err != nil {
-		return nil, err
-	}
-	orcSelect := getOrcSelect(orcReader.Schema())
-	return &OrcInventoryFileReader{
-		ctx:       o.ctx,
-		reader:    orcReader,
-		orcFile:   orcFile,
-		orcSelect: orcSelect,
-		cursor:    orcReader.Select(orcSelect.SelectFields...),
-	}, nil
-}
-
-func isRequired(field string) bool {
-	for _, f := range requiredFields {
-		if f == field {
-			return true
-		}
-	}
-	return false
-}
diff --git a/pkg/cloud/aws/s3inventory/reader_test.go b/pkg/cloud/aws/s3inventory/reader_test.go
deleted file mode 100644
index 44d1fedb47f..00000000000
--- a/pkg/cloud/aws/s3inventory/reader_test.go
+++ /dev/null
@@ -1,318 +0,0 @@
-package s3inventory
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/cznic/mathutil"
-	"github.com/scritchley/orc"
-	"github.com/treeverse/lakefs/pkg/logging"
-	"github.com/xitongsys/parquet-go-source/local"
-	"github.com/xitongsys/parquet-go/schema"
-	"github.com/xitongsys/parquet-go/writer"
-)
-
-const inventoryBucketName = "inventory-bucket"
-
-type TestObject struct {
-	Bucket             string  `parquet:"name=bucket, type=UTF8"`
-	Key                string  `parquet:"name=key, type=UTF8"`
-	IsLatest           *bool   `parquet:"name=is_latest, type=BOOLEAN"`
-	IsDeleteMarker     *bool   `parquet:"name=is_delete_marker, type=BOOLEAN"`
-	Size               *int64  `parquet:"name=size, type=INT_64"`
-	LastModifiedMillis *int64  `parquet:"name=last_modified_date, type=TIMESTAMP_MILLIS"`
-	Checksum           *string `parquet:"name=e_tag, type=UTF8"`
-}
-
-func parquetSchema(fieldToRemove string) *schema.JSONSchemaItemType {
-	fieldMap := map[string]string{
-		bucketFieldName:           "name=bucket, inname=Bucket, type=BYTE_ARRAY, convertedtype=UTF8, repetitiontype=REQUIRED, fieldid=1",
-		keyFieldName:              "name=key, inname=Key, type=BYTE_ARRAY, convertedtype=UTF8, repetitiontype=REQUIRED, fieldid=2",
-		isLatestFieldName:         "name=is_latest, inname=IsLatest, type=BOOLEAN, repetitiontype=OPTIONAL, fieldid=3",
-		isDeleteMarkerFieldName:   "name=is_delete_marker, inname=IsDeleteMarker, type=BOOLEAN, repetitiontype=OPTIONAL, fieldid=4",
-		sizeFieldName:             "name=size, inname=Size, type=INT64, repetitiontype=OPTIONAL, fieldid=5",
-		lastModifiedDateFieldName: "name=last_modified_date, inname=LastModifiedMillis, type=INT64, repetitiontype=OPTIONAL, fieldid=6",
-		eTagFieldName:             "name=e_tag, inname=Checksum, type=BYTE_ARRAY, convertedtype=UTF8, repetitiontype=OPTIONAL, fieldid=7",
-	}
-	fields := make([]*schema.JSONSchemaItemType, 0, len(fieldMap))
-	for field, tag := range fieldMap {
-		if field == fieldToRemove {
-			continue
-		}
-		fields = append(fields, &schema.JSONSchemaItemType{Tag: tag})
-	}
-	return &schema.JSONSchemaItemType{
-		Tag:    "name=s3inventory, repetitiontype=REQUIRED",
-		Fields: fields,
-	}
-}
-
-func generateParquet(t *testing.T, objs <-chan *TestObject, fieldToRemove string) *os.File {
-	f, err := os.CreateTemp("", "parquettest")
-	if err != nil {
-		t.Fatalf("failed to create temp file: %v", err)
-	}
-	defer func() {
-		_ = os.Remove(f.Name())
-	}()
-	fw, err := local.NewLocalFileWriter(f.Name())
-	if err != nil {
-		t.Fatalf("failed to create parquet file writer: %v", err)
-	}
-	defer func() {
-		_ = fw.Close()
-	}()
-	jsonSchema, err := json.Marshal(parquetSchema(fieldToRemove))
-	if err != nil {
-		t.Fatalf("failed to marshal to JSON %+v: %s", parquetSchema(fieldToRemove), err)
-	}
-	jsonSchemaStr := string(jsonSchema)
-	pw, err := writer.NewParquetWriter(fw, jsonSchemaStr, 4)
-	if err != nil {
-		t.Fatalf("failed to create parquet writer: %v", err)
-	}
-	for obj := range objs {
-		err = pw.Write(obj)
-		if err != nil {
-			t.Fatalf("failed to write object to parquet: %v", err)
-		}
-	}
-	err = pw.WriteStop()
-	if err != nil {
-		t.Fatalf("failed to stop parquet writer: %v", err)
-	}
-	return f
-}
-
-func orcSchema(fieldToRemove string) string {
-	fieldTypes := map[string]string{
-		bucketFieldName:           "string",
-		keyFieldName:              "string",
-		isLatestFieldName:         "boolean",
-		isDeleteMarkerFieldName:   "boolean",
-		sizeFieldName:             "int",
-		lastModifiedDateFieldName: "timestamp",
-		eTagFieldName:             "string",
-	}
-	var orcSchema strings.Builder
-	orcSchema.WriteString("struct<")
-	isFirst := true
-	for _, field := range inventoryFields {
-		if fieldToRemove == field {
-			continue
-		}
-		if !isFirst {
-			orcSchema.WriteString(",")
-		}
-		isFirst = false
-		orcSchema.WriteString(fmt.Sprintf("%s:%s", field, fieldTypes[field]))
-	}
-	orcSchema.WriteString(">")
-	return orcSchema.String()
-}
-
-func getOrcValues(o *TestObject, fieldToRemove string) []interface{} {
-	var sz int64
-	if o.Size != nil {
-		sz = *o.Size
-	}
-	var ms int64
-	if o.LastModifiedMillis != nil {
-		ms = *o.LastModifiedMillis
-	}
-	var checksum string
-	if o.Checksum != nil {
-		checksum = *o.Checksum
-	}
-	fieldValues := map[string]interface{}{
-		bucketFieldName:           o.Bucket,
-		keyFieldName:              o.Key,
-		isLatestFieldName:         o.IsLatest == nil || (o.IsLatest != nil && *o.IsLatest),
-		isDeleteMarkerFieldName:   o.IsDeleteMarker != nil && *o.IsDeleteMarker,
-		sizeFieldName:             sz,
-		lastModifiedDateFieldName: time.Unix(ms/1000, (ms%1000)*1_000_000),
-		eTagFieldName:             checksum,
-	}
-	values := make([]interface{}, 0, len(fieldValues))
-	for _, field := range inventoryFields {
-		if fieldToRemove == field {
-			continue
-		}
-		values = append(values, fieldValues[field])
-	}
-	return values
-}
-
-func generateOrc(t *testing.T, objs <-chan *TestObject, fieldToRemove string) *os.File {
-	f, err := os.CreateTemp("", "orctest")
-	if err != nil {
-		t.Fatalf("failed to create temp file: %v", err)
-	}
-	defer func() {
-		_ = os.Remove(f.Name())
-	}()
-	orcSchema := orcSchema(fieldToRemove)
-	s, err := orc.ParseSchema(orcSchema)
-	if err != nil {
-		t.Fatalf("failed to parse orc schema: %v", err)
-	}
-	w, err := orc.NewWriter(f, orc.SetSchema(s), orc.SetStripeTargetSize(100))
-	if err != nil {
-		t.Fatalf("failed to create orc writer: %v", err)
-	}
-	for o := range objs {
-		err = w.Write(getOrcValues(o, fieldToRemove)...)
-		if err != nil {
-			t.Fatalf("failed to write object to orc: %v", err)
-		}
-	}
-	err = w.Close()
-	if err != nil {
-		t.Fatalf("failed to close orc writer: %v", err)
-	}
-	_, _ = f.Seek(0, 0)
-	return f
-}
-
-func TestReaders(t *testing.T) {
-	svc, testServer := getS3Fake(t)
-	defer testServer.Close()
-	_, err := svc.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(inventoryBucketName),
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	testdata := map[string]struct {
-		ObjectNum           int
-		ExpectedReadObjects int
-		ExpectedMaxValue    string
-		ExpectedMinValue    string
-		ExcludeField        string
-	}{
-		"2 objects": {
-			ObjectNum:           2,
-			ExpectedReadObjects: 2,
-			ExpectedMinValue:    "f00000",
-			ExpectedMaxValue:    "f00001",
-		},
-		"12500 objects": {
-			ObjectNum:           12500,
-			ExpectedReadObjects: 12500,
-			ExpectedMinValue:    "f00000",
-			ExpectedMaxValue:    "f12499",
-		},
-		"100 objects": {
-			ObjectNum:           100,
-			ExpectedReadObjects: 100,
-			ExpectedMinValue:    "f00000",
-			ExpectedMaxValue:    "f00099",
-		},
-		"without size field": {
-			ObjectNum:           12500,
-			ExpectedReadObjects: 12500,
-			ExpectedMinValue:    "f00000",
-			ExpectedMaxValue:    "f12499",
-			ExcludeField:        "size",
-		},
-		"without is_latest field": {
-			ObjectNum:           12500,
-			ExpectedReadObjects: 12500,
-			ExpectedMinValue:    "f00000",
-			ExpectedMaxValue:    "f12499",
-			ExcludeField:        "is_latest",
-		},
-		"without is_delete_marker field": {
-			ObjectNum:           12500,
-			ExpectedReadObjects: 12500,
-			ExpectedMinValue:    "f00000",
-			ExpectedMaxValue:    "f12499",
-			ExcludeField:        "is_delete_marker",
-		},
-		"without e_tag field": {
-			ObjectNum:           100,
-			ExpectedReadObjects: 100,
-			ExpectedMinValue:    "f00000",
-			ExpectedMaxValue:    "f00099",
-			ExcludeField:        "e_tag",
-		},
-	}
-	for _, format := range []string{"ORC", "Parquet"} {
-		for testName, test := range testdata {
-			t.Run(fmt.Sprintf("%s %s", strings.ToLower(format), testName), func(t *testing.T) {
-				now := time.Now().Truncate(time.Millisecond)
-				lastModified := []time.Time{now, now.Add(-1 * time.Hour), now.Add(-2 * time.Hour), now.Add(-3 * time.Hour)}
-				var localFile *os.File
-				if format == "ORC" {
-					localFile = generateOrc(t, objs(test.ObjectNum, lastModified), test.ExcludeField)
-				} else if format == "Parquet" {
-					localFile = generateParquet(t, objs(test.ObjectNum, lastModified), test.ExcludeField)
-				}
-				uploadFile(t, svc, inventoryBucketName, "myFile.inv", localFile)
-				reader := NewReader(context.Background(), svc, logging.ContextUnavailable())
-				fileReader, err := reader.GetFileReader(format, inventoryBucketName, "myFile.inv")
-				if err != nil {
-					t.Fatalf("failed to create file reader: %v", err)
-				}
-				numRowsResult := int(fileReader.GetNumRows())
-				if test.ObjectNum != numRowsResult {
-					t.Fatalf("unexpected result from GetNumRows. expected=%d, got=%d", test.ObjectNum, numRowsResult)
-				}
-				minValueResult := fileReader.FirstObjectKey()
-				if test.ExpectedMinValue != minValueResult {
-					t.Fatalf("unexpected result from FirstObjectKey. expected=%s, got=%s", test.ExpectedMinValue, minValueResult)
-				}
-				maxValueResult := fileReader.LastObjectKey()
-				if test.ExpectedMaxValue != maxValueResult {
-					t.Fatalf("unexpected result from LastObjectKey. expected=%s, got=%s", test.ExpectedMaxValue, maxValueResult)
-				}
-				readBatchSize := 1000
-				offset := 0
-				readCount := 0
-				for {
-					res, err := fileReader.Read(readBatchSize)
-					if err != nil {
-						t.Fatalf("failed to read from file reader: %v", err)
-					}
-					expectedSize := 500
-					if test.ExcludeField == "size" {
-						expectedSize = 0
-					}
-					expectedChecksum := "abcdefg"
-					if test.ExcludeField == "e_tag" {
-						expectedChecksum = ""
-					}
-					for i := offset; i < mathutil.Min(offset+readBatchSize, test.ObjectNum); i++ {
-						verifyObject(t, res[i-offset], &InventoryObject{
-							Bucket:         inventoryBucketName,
-							Key:            fmt.Sprintf("f%05d", i),
-							IsLatest:       true,
-							IsDeleteMarker: false,
-							Size:           int64(expectedSize),
-							LastModified:   &lastModified[i%len(lastModified)],
-							Checksum:       expectedChecksum,
-						}, i, offset/readBatchSize, i-offset)
-					}
-					offset += len(res)
-					readCount += len(res)
-					if len(res) != readBatchSize {
-						break
-					}
-				}
-				if test.ExpectedReadObjects != readCount {
-					t.Fatalf("read unexpected number of keys from inventory. expected=%d, got=%d", test.ExpectedReadObjects, readCount)
-				}
-				if fileReader.Close() != nil {
-					t.Fatalf("failed to close file reader")
-				}
-			})
-		}
-	}
-}
diff --git a/pkg/cloud/aws/s3inventory/utils_test.go b/pkg/cloud/aws/s3inventory/utils_test.go
deleted file mode 100644
index 2b9a2d8ebd0..00000000000
--- a/pkg/cloud/aws/s3inventory/utils_test.go
+++ /dev/null
@@ -1,96 +0,0 @@
-package s3inventory
-
-import (
-	"fmt"
-	"net/http/httptest"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3iface"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
-	"github.com/johannesboyne/gofakes3"
-	"github.com/johannesboyne/gofakes3/backend/s3mem"
-)
-
-func verifyObject(t *testing.T, actual *InventoryObject, expected *InventoryObject, index int, batchId int, indexInBatch int) {
-	if expected.Bucket != actual.Bucket {
-		t.Fatalf("bucket in index %d different than expected. expected=%s, got=%s (batch #%d, index %d)", index, expected.Bucket, actual.Bucket, batchId, indexInBatch)
-	}
-	if expected.Key != actual.Key {
-		t.Fatalf("object key in index %d different than expected. expected=%s, got=%s (batch #%d, index %d)", index, expected.Key, actual.Key, batchId, indexInBatch)
-	}
-	if expected.Size != actual.Size {
-		t.Fatalf("size in index %d different than expected. expected=%d, got=%d (batch #%d, index %d)", index, expected.Size, actual.Size, batchId, indexInBatch)
-	}
-	if expected.Checksum != actual.Checksum {
-		t.Fatalf("e_tag in index %d different than expected. expected=%s, got=%s (batch #%d, index %d)", index, expected.Checksum, actual.Checksum, batchId, indexInBatch)
-	}
-	if !expected.LastModified.Equal(*actual.LastModified) {
-		t.Fatalf("last_modified_time in index %d different than expected. expected=%v, got=%v (batch #%d, index %d)", index, expected.LastModified, actual.LastModified, batchId, indexInBatch)
-	}
-	if expected.IsDeleteMarker != actual.IsDeleteMarker {
-		t.Fatalf("is_delete_marker in index %d different than expected. expected=%v, got=%v (batch #%d, index %d)", index, expected.IsDeleteMarker, actual.IsDeleteMarker, batchId, indexInBatch)
-	}
-	if actual.IsLatest != expected.IsLatest {
-		t.Fatalf("is_latest in index %d different than expected. expected=%v, got=%v (batch #%d, index %d)", index, expected.IsLatest, actual.IsLatest, batchId, indexInBatch)
-	}
-}
-
-func objs(num int, lastModified []time.Time) <-chan *TestObject {
-	out := make(chan *TestObject)
-	go func() {
-		defer close(out)
-		for i := 0; i < num; i++ {
-			sz := int64(500)
-			tm := lastModified[i%len(lastModified)].UnixNano() / 1_000_000
-			checksum := "abcdefg"
-			out <- &TestObject{
-				Bucket:             inventoryBucketName,
-				Key:                fmt.Sprintf("f%05d", i),
-				Size:               &sz,
-				LastModifiedMillis: &tm,
-				Checksum:           &checksum,
-			}
-		}
-	}()
-	return out
-}
-
-func uploadFile(t *testing.T, s3 s3iface.S3API, inventoryBucket string, inventoryFilename string, f *os.File) {
-	defer func() {
-		_ = f.Close()
-	}()
-	uploader := s3manager.NewUploaderWithClient(s3)
-	_, err := uploader.Upload(&s3manager.UploadInput{
-		Bucket: aws.String(inventoryBucket),
-		Key:    aws.String(inventoryFilename),
-		Body:   f,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-func getS3Fake(t *testing.T) (s3iface.S3API, *httptest.Server) {
-	backend := s3mem.New()
-	faker := gofakes3.New(backend)
-	ts := httptest.NewServer(faker.Server())
-	// configure S3 client
-	s3Config := &aws.Config{
-		Credentials:      credentials.NewStaticCredentials("YOUR-ACCESSKEYID", "YOUR-SECRETACCESSKEY", ""),
-		Endpoint:         aws.String(ts.URL),
-		Region:           aws.String("eu-central-1"),
-		DisableSSL:       aws.Bool(true),
-		S3ForcePathStyle: aws.Bool(true),
-	}
-	newSession, err := session.NewSession(s3Config)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return s3.New(newSession), ts
-}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 4e1b7f49c30..ea71caab08f 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -8,8 +8,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/mitchellh/go-homedir"
 	"github.com/mitchellh/mapstructure"
 	"github.com/spf13/viper"
@@ -20,7 +18,6 @@ import (
 
 var (
 	ErrBadConfiguration    = errors.New("bad configuration")
-	ErrMissingSecretKey    = fmt.Errorf("%w: auth.encrypt.secret_key cannot be empty", ErrBadConfiguration)
 	ErrBadDomainNames      = fmt.Errorf("%w: domain names are prefixes", ErrBadConfiguration)
 	ErrMissingRequiredKeys = fmt.Errorf("%w: missing required keys", ErrBadConfiguration)
 )
@@ -43,7 +40,7 @@ type OIDC struct {
 // CookieAuthVerification is related to auth based on a cookie set by an external service
 // TODO(isan) consolidate with OIDC
 type CookieAuthVerification struct {
-	// ValidateIDTokenClaims if set will validate the values  (e.g department: "R&D") exist in the token claims
+	// ValidateIDTokenClaims if set will validate the values (e.g., department: "R&D") exist in the token claims
 	ValidateIDTokenClaims map[string]string `mapstructure:"validate_id_token_claims"`
 	// DefaultInitialGroups is a list of groups to add to the user on the lakeFS side
 	DefaultInitialGroups []string `mapstructure:"default_initial_groups"`
@@ -62,11 +59,7 @@ type S3AuthInfo struct {
 	CredentialsFile string `mapstructure:"credentials_file"`
 	Profile         string
 	Credentials     *struct {
-		AccessKeyID SecureString `mapstructure:"access_key_id"`
-		// AccessSecretKey is the old name for SecretAccessKey.
-		//
-		// Deprecated: use SecretAccessKey instead.
-		AccessSecretKey SecureString `mapstructure:"access_secret_key"`
+		AccessKeyID     SecureString `mapstructure:"access_key_id"`
 		SecretAccessKey SecureString `mapstructure:"secret_access_key"`
 		SessionToken    SecureString `mapstructure:"session_token"`
 	}
@@ -240,8 +233,6 @@ type Config struct {
 			S3AuthInfo                    `mapstructure:",squash"`
 			Region                        string        `mapstructure:"region"`
 			Endpoint                      string        `mapstructure:"endpoint"`
-			StreamingChunkSize            int           `mapstructure:"streaming_chunk_size"`
-			StreamingChunkTimeout         time.Duration `mapstructure:"streaming_chunk_timeout"`
 			MaxRetries                    int           `mapstructure:"max_retries"`
 			ForcePathStyle                bool          `mapstructure:"force_path_style"`
 			DiscoverBucketRegion          bool          `mapstructure:"discover_bucket_region"`
@@ -251,6 +242,8 @@ type Config struct {
 			PreSignedExpiry               time.Duration `mapstructure:"pre_signed_expiry"`
 			DisablePreSigned              bool          `mapstructure:"disable_pre_signed"`
 			DisablePreSignedUI            bool          `mapstructure:"disable_pre_signed_ui"`
+			ClientLogRetries              bool          `mapstructure:"client_log_retries"`
+			ClientLogRequest              bool          `mapstructure:"client_log_request"`
 			WebIdentity                   *struct {
 				SessionDuration     time.Duration `mapstructure:"session_duration"`
 				SessionExpiryWindow time.Duration `mapstructure:"session_expiry_window"`
@@ -447,49 +440,6 @@ func (c *Config) Validate() error {
 	return nil
 }
 
-func (c *Config) GetAwsConfig() *aws.Config {
-	logger := logging.ContextUnavailable().WithField("sdk", "aws")
-	cfg := &aws.Config{
-		Logger: &logging.AWSAdapter{Logger: logger},
-	}
-	if c.Blockstore.S3.Region != "" {
-		cfg.Region = aws.String(c.Blockstore.S3.Region)
-	}
-	level := strings.ToLower(logging.Level())
-	if level == "trace" {
-		cfg.LogLevel = aws.LogLevel(aws.LogDebugWithRequestRetries | aws.LogDebugWithRequestErrors)
-	}
-	if c.Blockstore.S3.Profile != "" || c.Blockstore.S3.CredentialsFile != "" {
-		cfg.Credentials = credentials.NewSharedCredentials(
-			c.Blockstore.S3.CredentialsFile,
-			c.Blockstore.S3.Profile,
-		)
-	}
-	if c.Blockstore.S3.Credentials != nil {
-		secretAccessKey := c.Blockstore.S3.Credentials.SecretAccessKey
-		if secretAccessKey == "" {
-			logging.ContextUnavailable().Warn("blockstore.s3.credentials.access_secret_key is deprecated. Use instead: blockstore.s3.credentials.secret_access_key.")
-			secretAccessKey = c.Blockstore.S3.Credentials.AccessSecretKey
-		}
-		cfg.Credentials = credentials.NewStaticCredentials(
-			c.Blockstore.S3.Credentials.AccessKeyID.SecureValue(),
-			secretAccessKey.SecureValue(),
-			c.Blockstore.S3.Credentials.SessionToken.SecureValue(),
-		)
-	}
-
-	s3Endpoint := c.Blockstore.S3.Endpoint
-	if len(s3Endpoint) > 0 {
-		cfg = cfg.WithEndpoint(s3Endpoint)
-	}
-	s3ForcePathStyle := c.Blockstore.S3.ForcePathStyle
-	if s3ForcePathStyle {
-		cfg = cfg.WithS3ForcePathStyle(true)
-	}
-	cfg = cfg.WithMaxRetries(c.Blockstore.S3.MaxRetries)
-	return cfg
-}
-
 func (c *Config) BlockstoreType() string {
 	return c.Blockstore.Type
 }
@@ -502,10 +452,22 @@ func (c *Config) BlockstoreS3Params() (blockparams.S3, error) {
 			SessionExpiryWindow: c.Blockstore.S3.WebIdentity.SessionExpiryWindow,
 		}
 	}
+
+	var creds blockparams.S3Credentials
+	if c.Blockstore.S3.Credentials != nil {
+		creds.AccessKeyID = c.Blockstore.S3.Credentials.AccessKeyID.SecureValue()
+		creds.SecretAccessKey = c.Blockstore.S3.Credentials.SecretAccessKey.SecureValue()
+		creds.SessionToken = c.Blockstore.S3.Credentials.SessionToken.SecureValue()
+	}
+
 	return blockparams.S3{
-		AwsConfig:                     c.GetAwsConfig(),
-		StreamingChunkSize:            c.Blockstore.S3.StreamingChunkSize,
-		StreamingChunkTimeout:         c.Blockstore.S3.StreamingChunkTimeout,
+		Region:                        c.Blockstore.S3.Region,
+		Profile:                       c.Blockstore.S3.Profile,
+		CredentialsFile:               c.Blockstore.S3.CredentialsFile,
+		Credentials:                   creds,
+		MaxRetries:                    c.Blockstore.S3.MaxRetries,
+		Endpoint:                      c.Blockstore.S3.Endpoint,
+		ForcePathStyle:                c.Blockstore.S3.ForcePathStyle,
 		DiscoverBucketRegion:          c.Blockstore.S3.DiscoverBucketRegion,
 		SkipVerifyCertificateTestOnly: c.Blockstore.S3.SkipVerifyCertificateTestOnly,
 		ServerSideEncryption:          c.Blockstore.S3.ServerSideEncryption,
@@ -513,6 +475,8 @@ func (c *Config) BlockstoreS3Params() (blockparams.S3, error) {
 		PreSignedExpiry:               c.Blockstore.S3.PreSignedExpiry,
 		DisablePreSigned:              c.Blockstore.S3.DisablePreSigned,
 		DisablePreSignedUI:            c.Blockstore.S3.DisablePreSignedUI,
+		ClientLogRetries:              c.Blockstore.S3.ClientLogRetries,
+		ClientLogRequest:              c.Blockstore.S3.ClientLogRequest,
 		WebIdentity:                   webIdentity,
 	}, nil
 }
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index b5ea181117d..7217e6f5310 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -168,29 +168,3 @@ func TestConfig_JSONLogger(t *testing.T) {
 		t.Fatalf("expected a msg field, could not find one")
 	}
 }
-
-func verifyAWSConfig(t *testing.T, c *config.Config) {
-	s3Params, err := c.BlockstoreS3Params()
-	testutil.Must(t, err)
-	credentials, err := s3Params.AwsConfig.Credentials.Get()
-	testutil.Must(t, err)
-	if credentials.AccessKeyID != "my-key-id" {
-		t.Fatalf("unexpected key id in credentials. expected %s got %s", "my-key-id", credentials.AccessKeyID)
-	}
-	if credentials.SecretAccessKey != "my-secret-key" {
-		t.Fatalf("unexpected secret access key in credentials. expected %s got %s", "my-secret-key", credentials.SecretAccessKey)
-	}
-}
-
-func TestConfig_AWSConfig(t *testing.T) {
-	t.Run("use secret_access_key configuration", func(t *testing.T) {
-		c, err := newConfigFromFile("testdata/aws_credentials.yaml")
-		testutil.Must(t, err)
-		verifyAWSConfig(t, c)
-	})
-	t.Run("use alias access_secret_key configuration", func(t *testing.T) {
-		c, err := newConfigFromFile("testdata/aws_credentials_with_alias.yaml")
-		testutil.Must(t, err)
-		verifyAWSConfig(t, c)
-	})
-}
diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go
index 34fd690a911..5fcb486bef6 100644
--- a/pkg/config/defaults.go
+++ b/pkg/config/defaults.go
@@ -62,8 +62,6 @@ func setDefaults(cfgType string) {
 
 	viper.SetDefault("blockstore.local.path", "~/lakefs/data/block")
 	viper.SetDefault("blockstore.s3.region", "us-east-1")
-	viper.SetDefault("blockstore.s3.streaming_chunk_size", 2<<19)          // 1MiB by default per chunk
-	viper.SetDefault("blockstore.s3.streaming_chunk_timeout", time.Second) // or 1 seconds, whatever comes first
 	viper.SetDefault("blockstore.s3.max_retries", 5)
 	viper.SetDefault("blockstore.s3.discover_bucket_region", true)
 	viper.SetDefault("blockstore.s3.pre_signed_expiry", 15*time.Minute)
diff --git a/pkg/gateway/middleware.go b/pkg/gateway/middleware.go
index 5b233939216..cb1f7282c36 100644
--- a/pkg/gateway/middleware.go
+++ b/pkg/gateway/middleware.go
@@ -35,8 +35,9 @@ func AuthenticationHandler(authService auth.GatewayService, next http.Handler) h
 		o := ctx.Value(ContextKeyOperation).(*operations.Operation)
 		authenticator := sig.ChainedAuthenticator(
 			sig.NewV4Authenticator(req),
-			sig.NewV2SigAuthenticator(req))
-		authContext, err := authenticator.Parse(req.Context())
+			sig.NewV2SigAuthenticator(req, o.FQDN),
+		)
+		authContext, err := authenticator.Parse()
 		if err != nil {
 			o.Log(req).WithError(err).Warn("failed to parse signature")
 			_ = o.EncodeError(w, req, err, getAPIErrOrDefault(err, gatewayerrors.ErrAccessDenied))
@@ -44,7 +45,7 @@ func AuthenticationHandler(authService auth.GatewayService, next http.Handler) h
 		}
 		accessKeyID := authContext.GetAccessKeyID()
 		creds, err := authService.GetCredentials(ctx, accessKeyID)
-		logger := o.Log(req).WithField("key", accessKeyID)
+		logger := o.Log(req)
 		if err != nil {
 			if !errors.Is(err, auth.ErrNotFound) {
 				logger.WithError(err).Warn("error getting access key")
@@ -55,8 +56,7 @@ func AuthenticationHandler(authService auth.GatewayService, next http.Handler) h
 			}
 			return
 		}
-		err = authenticator.Verify(creds, o.FQDN)
-		logger = logger.WithField("authenticator", authenticator)
+		err = authenticator.Verify(creds)
 		if err != nil {
 			logger.WithError(err).Warn("error verifying credentials for key")
 			_ = o.EncodeError(w, req, err, getAPIErrOrDefault(err, gatewayerrors.ErrAccessDenied))
diff --git a/pkg/gateway/parse_request_parts_test.go b/pkg/gateway/middleware_test.go
similarity index 100%
rename from pkg/gateway/parse_request_parts_test.go
rename to pkg/gateway/middleware_test.go
diff --git a/pkg/gateway/operations/mock_adapter_test.go b/pkg/gateway/operations/mock_adapter_test.go
index 8292d7bf56a..30e648e2e4a 100644
--- a/pkg/gateway/operations/mock_adapter_test.go
+++ b/pkg/gateway/operations/mock_adapter_test.go
@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/treeverse/lakefs/pkg/block"
-	"github.com/treeverse/lakefs/pkg/logging"
 )
 
 type mockAdapter struct {
@@ -96,10 +95,6 @@ func (a *mockAdapter) UploadCopyPartRange(_ context.Context, _, _ block.ObjectPo
 	panic("try to upload copy part range in mock adapter")
 }
 
-func (a *mockAdapter) GenerateInventory(_ context.Context, _ logging.Logger, _ string, _ bool, _ []string) (block.Inventory, error) {
-	return nil, nil
-}
-
 func (a *mockAdapter) BlockstoreType() string {
 	return "s3"
 }
diff --git a/pkg/gateway/sig/sig.go b/pkg/gateway/sig/sig.go
index 73cd8b1f39e..305c7cc19de 100644
--- a/pkg/gateway/sig/sig.go
+++ b/pkg/gateway/sig/sig.go
@@ -1,7 +1,6 @@
 package sig
 
 import (
-	"context"
 	"crypto/hmac"
 	"encoding/hex"
 	"errors"
@@ -81,8 +80,8 @@ type SigContext interface {
 }
 
 type SigAuthenticator interface {
-	Parse(ctx context.Context) (SigContext, error)
-	Verify(*model.Credential, string) error
+	Parse() (SigContext, error)
+	Verify(*model.Credential) error
 }
 
 type chainedAuthenticator struct {
@@ -94,9 +93,9 @@ func ChainedAuthenticator(methods ...SigAuthenticator) SigAuthenticator {
 	return &chainedAuthenticator{methods, nil}
 }
 
-func (c *chainedAuthenticator) Parse(ctx context.Context) (SigContext, error) {
+func (c *chainedAuthenticator) Parse() (SigContext, error) {
 	for _, method := range c.methods {
-		sigContext, err := method.Parse(ctx)
+		sigContext, err := method.Parse()
 		if err == nil {
 			c.chosen = method
 			return sigContext, nil
@@ -109,8 +108,8 @@ func Equal(sig1, sig2 []byte) bool {
 	return hmac.Equal(sig1, sig2)
 }
 
-func (c *chainedAuthenticator) Verify(creds *model.Credential, fqdn string) error {
-	return c.chosen.Verify(creds, fqdn)
+func (c *chainedAuthenticator) Verify(creds *model.Credential) error {
+	return c.chosen.Verify(creds)
 }
 
 func (c *chainedAuthenticator) String() string {
diff --git a/pkg/gateway/sig/sig_test.go b/pkg/gateway/sig/sig_test.go
index ffcd96c7877..d71d0d269c7 100644
--- a/pkg/gateway/sig/sig_test.go
+++ b/pkg/gateway/sig/sig_test.go
@@ -81,28 +81,31 @@ func MakeV4Signer(keyID, secretKey, location string) Signer {
 
 func MakeV2Verifier(keyID, secretKey, bareDomain string) Verifier {
 	return func(req *http.Request) error {
-		authenticator := sig.NewV2SigAuthenticator(req)
-		_, err := authenticator.Parse(req.Context())
+		authenticator := sig.NewV2SigAuthenticator(req, bareDomain)
+		_, err := authenticator.Parse()
 		if err != nil {
 			return fmt.Errorf("sigV2 parse failed: %w", err)
 		}
 		return authenticator.Verify(
-			&model.Credential{BaseCredential: model.BaseCredential{AccessKeyID: keyID, SecretAccessKey: secretKey}},
-			bareDomain,
+			&model.Credential{
+				BaseCredential: model.BaseCredential{
+					AccessKeyID:     keyID,
+					SecretAccessKey: secretKey,
+				},
+			},
 		)
 	}
 }
 
-func MakeV4Verifier(keyID, secretKey, bareDomain string) Verifier {
+func MakeV4Verifier(keyID, secretKey string) Verifier {
 	return func(req *http.Request) error {
 		authenticator := sig.NewV4Authenticator(req)
-		_, err := authenticator.Parse(req.Context())
+		_, err := authenticator.Parse()
 		if err != nil {
 			return fmt.Errorf("sigV4 parse failed: %w", err)
 		}
 		return authenticator.Verify(
 			&model.Credential{BaseCredential: model.BaseCredential{AccessKeyID: keyID, SecretAccessKey: secretKey}},
-			bareDomain,
 		)
 	}
 }
@@ -145,12 +148,12 @@ var signatures = []SignCase{
 	}, {
 		Name:     "V4Host",
 		Signer:   MakeV4Signer(keyID, secretKey, location),
-		Verifier: MakeV4Verifier(keyID, secretKey, domain),
+		Verifier: MakeV4Verifier(keyID, secretKey),
 		Style:    "host",
 	}, {
 		Name:     "V4Path",
 		Signer:   MakeV4Signer(keyID, secretKey, location),
-		Verifier: MakeV4Verifier(keyID, secretKey, domain),
+		Verifier: MakeV4Verifier(keyID, secretKey),
 		Style:    "path",
 	},
 }
diff --git a/pkg/gateway/sig/v2.go b/pkg/gateway/sig/v2.go
index d03077fc39e..b58924e8d6e 100644
--- a/pkg/gateway/sig/v2.go
+++ b/pkg/gateway/sig/v2.go
@@ -1,7 +1,6 @@
 package sig
 
 import (
-	"context"
 	"crypto/hmac"
 	"crypto/sha1" //nolint:gosec
 	"encoding/base64"
@@ -76,23 +75,26 @@ func (a v2Context) GetAccessKeyID() string {
 }
 
 type V2SigAuthenticator struct {
-	r      *http.Request
-	sigCtx v2Context
+	req        *http.Request
+	bareDomain string
+	sigCtx     v2Context
 }
 
-func NewV2SigAuthenticator(r *http.Request) *V2SigAuthenticator {
+func NewV2SigAuthenticator(r *http.Request, bareDomain string) *V2SigAuthenticator {
 	return &V2SigAuthenticator{
-		r: r,
+		req:        r,
+		bareDomain: bareDomain,
 	}
 }
 
-func (a *V2SigAuthenticator) Parse(ctx context.Context) (SigContext, error) {
+func (a *V2SigAuthenticator) Parse() (SigContext, error) {
+	ctx := a.req.Context()
 	var sigCtx v2Context
-	headerValue := a.r.Header.Get(v2authHeaderName)
+	headerValue := a.req.Header.Get(v2authHeaderName)
 	if len(headerValue) > 0 {
 		match := V2AuthHeaderRegexp.FindStringSubmatch(headerValue)
 		if len(match) == 0 {
-			logging.FromContext(ctx).WithField("header", v2authHeaderName).Error("log header does not match v2 structure")
+			logging.FromContext(ctx).Error("log header does not match v2 structure")
 			return sigCtx, ErrHeaderMalformed
 		}
 		result := make(map[string]string)
@@ -105,7 +107,7 @@ func (a *V2SigAuthenticator) Parse(ctx context.Context) (SigContext, error) {
 		// parse signature
 		sig, err := base64.StdEncoding.DecodeString(result["Signature"])
 		if err != nil {
-			logging.FromContext(ctx).WithField("header", v2authHeaderName).Error("log header does not match v2 structure (isn't proper base64)")
+			logging.FromContext(ctx).Error("log header does not match v2 structure (isn't proper base64)")
 			return sigCtx, ErrHeaderMalformed
 		}
 		sigCtx.signature = sig
@@ -220,7 +222,7 @@ func buildPath(host string, bareDomain string, path string) string {
 	return ""
 }
 
-func (a *V2SigAuthenticator) Verify(creds *model.Credential, bareDomain string) error {
+func (a *V2SigAuthenticator) Verify(creds *model.Credential) error {
 	/*
 		s3 sigV2 implementation:
 		the s3 signature is somewhat different from general aws signature implementation.
@@ -240,10 +242,10 @@ func (a *V2SigAuthenticator) Verify(creds *model.Credential, bareDomain string)
 	*/
 
 	// Prefer the raw path if it exists -- *this* is what SigV2 signs
-	rawPath := a.r.URL.EscapedPath()
+	rawPath := a.req.URL.EscapedPath()
 
-	path := buildPath(a.r.Host, bareDomain, rawPath)
-	stringToSign := canonicalString(a.r.Method, a.r.URL.Query(), path, a.r.Header)
+	path := buildPath(a.req.Host, a.bareDomain, rawPath)
+	stringToSign := canonicalString(a.req.Method, a.req.URL.Query(), path, a.req.Header)
 	digest := signCanonicalString(stringToSign, []byte(creds.SecretAccessKey))
 	if !Equal(digest, a.sigCtx.signature) {
 		return errors.ErrSignatureDoesNotMatch
diff --git a/pkg/gateway/sig/v4.go b/pkg/gateway/sig/v4.go
index a5c100a796f..5b75fede406 100644
--- a/pkg/gateway/sig/v4.go
+++ b/pkg/gateway/sig/v4.go
@@ -2,7 +2,6 @@ package sig
 
 import (
 	"bufio"
-	"context"
 	"crypto/hmac"
 	"crypto/sha256"
 	"encoding/hex"
@@ -75,16 +74,15 @@ func ParseV4AuthContext(r *http.Request) (V4Auth, error) {
 				result[name] = match[i]
 			}
 		}
-		headers := splitHeaders(result["SignatureHeaders"])
 		ctx.AccessKeyID = result["AccessKeyId"]
 		ctx.Date = result["Date"]
 		ctx.Region = result["Region"]
 		ctx.Service = result["Service"]
-
 		ctx.Signature = result["Signature"]
 
-		ctx.SignedHeaders = headers
-		ctx.SignedHeadersString = result["SignatureHeaders"]
+		signatureHeaders := result["SignatureHeaders"]
+		ctx.SignedHeaders = splitHeaders(signatureHeaders)
+		ctx.SignedHeadersString = signatureHeaders
 		return ctx, nil
 	}
 
@@ -317,11 +315,8 @@ func (ctx *verificationCtx) buildSignedString(canonicalRequest string) (string,
 	if err != nil {
 		return "", err
 	}
-	h := sha256.New()
-	if _, err := h.Write([]byte(canonicalRequest)); err != nil {
-		return "", err
-	}
-	hashedCanonicalRequest := hex.EncodeToString(h.Sum(nil))
+	h := sha256.Sum256([]byte(canonicalRequest))
+	hashedCanonicalRequest := hex.EncodeToString(h[:])
 	stringToSign := strings.Join([]string{
 		algorithm,
 		amzDate,
@@ -378,32 +373,29 @@ func (ctx *verificationCtx) reader(reader io.ReadCloser, creds *model.Credential
 
 type V4Authenticator struct {
 	request *http.Request
-	ctx     V4Auth
+	sigCtx  V4Auth
 }
 
-func (a *V4Authenticator) Parse(_ context.Context) (SigContext, error) {
-	var ctx V4Auth
-	var err error
-	ctx, err = ParseV4AuthContext(a.request)
+func (a *V4Authenticator) Parse() (SigContext, error) {
+	sigCtx, err := ParseV4AuthContext(a.request)
 	if err != nil {
-		return ctx, err
+		return nil, err
 	}
-	a.ctx = ctx
-	return a.ctx, nil
+	a.sigCtx = sigCtx
+	return a.sigCtx, nil
 }
 
 func (a *V4Authenticator) String() string {
 	return "sigv4"
 }
 
-func (a *V4Authenticator) Verify(creds *model.Credential, _ string) error {
-	err := V4Verify(a.ctx, creds, a.request)
-	return err
+func (a *V4Authenticator) Verify(creds *model.Credential) error {
+	return V4Verify(a.sigCtx, creds, a.request)
 }
 
-func NewV4Authenticator(r *http.Request) SigAuthenticator {
+func NewV4Authenticator(r *http.Request) *V4Authenticator {
 	return &V4Authenticator{
 		request: r,
-		ctx:     V4Auth{},
+		sigCtx:  V4Auth{},
 	}
 }
diff --git a/pkg/gateway/sig/v4_streaming_reader.go b/pkg/gateway/sig/v4_streaming_reader.go
index e411d85f50c..b272b3f6dea 100644
--- a/pkg/gateway/sig/v4_streaming_reader.go
+++ b/pkg/gateway/sig/v4_streaming_reader.go
@@ -35,8 +35,8 @@ import (
 
 // Streaming AWS Signature Version '4' constants.
 const (
-	emptySHA256            = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-	signV4ChunkedAlgorithm = "AWS4-HMAC-SHA256-PAYLOAD"
+	emptySHA256            = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" //nolint:gosec
+	signV4ChunkedAlgorithm = "AWS4-HMAC-SHA256-PAYLOAD"                                         //nolint:gosec
 	SlashSeparator         = "/"
 )
 
@@ -76,7 +76,7 @@ var (
 	// lineTooLong is generated as chunk header is bigger than 4KiB.
 	errLineTooLong = errors.New("header line too long")
 
-	// Malformed encoding is generated when chunk header is wrongly formed.
+	// Malformed encoding is generated when a chunk header is wrongly formed.
 	errMalformedEncoding = errors.New("malformed chunked encoding")
 
 	ErrInvalidByte   = errors.New("invalid byte in chunk length")
@@ -106,7 +106,7 @@ func newSignV4ChunkedReader(reader *bufio.Reader, amzDate string, auth V4Auth, c
 	}, nil
 }
 
-// Represents the overall state that is required for decoding a
+// Represents the overall state that is required for decoding an
 // AWS Signature V4 chunked reader.
 type s3ChunkedReader struct {
 	reader            *bufio.Reader
diff --git a/pkg/gateway/sig/v4_test.go b/pkg/gateway/sig/v4_test.go
index ae5fab6755a..a26286f2607 100644
--- a/pkg/gateway/sig/v4_test.go
+++ b/pkg/gateway/sig/v4_test.go
@@ -2,6 +2,10 @@ package sig_test
 
 import (
 	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -9,19 +13,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws/credentials"
-
-	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
-
+	"github.com/aws/aws-sdk-go-v2/aws"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
 	"github.com/treeverse/lakefs/pkg/auth/model"
-
+	gtwerrors "github.com/treeverse/lakefs/pkg/gateway/errors"
 	"github.com/treeverse/lakefs/pkg/gateway/sig"
-
-	"github.com/treeverse/lakefs/pkg/gateway/errors"
 )
 
-const sigV4NoDomain = ""
-
 var mockCreds = &model.Credential{
 	BaseCredential: model.BaseCredential{
 		AccessKeyID:     "AKIAIOSFODNN7EXAMPLE",
@@ -90,7 +88,7 @@ func TestDoesPolicySignatureMatch(t *testing.T) {
 			// Do the same for the headers.
 			req.Header = tc.Header
 			authenticator := sig.NewV4Authenticator(req)
-			_, err := authenticator.Parse(req.Context())
+			_, err := authenticator.Parse()
 			if err != nil {
 				if !tc.ExpectedParseError {
 					t.Fatal(err)
@@ -98,7 +96,7 @@ func TestDoesPolicySignatureMatch(t *testing.T) {
 				return
 			}
 
-			err = authenticator.Verify(mockCreds, sigV4NoDomain)
+			err = authenticator.Verify(mockCreds)
 			if err != nil {
 				if !tc.ExpectedError {
 					t.Fatal(err)
@@ -126,7 +124,7 @@ func TestSingleChunkPut(t *testing.T) {
 			Name:              "amazon example should fail",
 			RequestBody:       "Welcome to Amazon S3",
 			SignBody:          "Welcome to Amazon S3.",
-			ExpectedReadError: errors.ErrSignatureDoesNotMatch,
+			ExpectedReadError: gtwerrors.ErrSignatureDoesNotMatch,
 		},
 		{
 			Name:        "empty body",
@@ -135,49 +133,57 @@ func TestSingleChunkPut(t *testing.T) {
 		},
 	}
 	const (
-		PATH   = "http://example.test/foo"
-		ID     = "AKIAIOSFODNN7EXAMPLE"
-		SECRET = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+		testURL             = "https://example.test/foo"
+		testAccessKeyID     = "AKIAIOSFODNN7EXAMPLE"
+		testSecretAccessKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
 	)
+	ctx := context.Background()
+	creds := aws.Credentials{
+		AccessKeyID:     testAccessKeyID,
+		SecretAccessKey: testSecretAccessKey,
+	}
+
 	for _, tc := range tt {
 		t.Run(tc.Name, func(t *testing.T) {
 			// build request with amazons sdk
-			creds := credentials.NewStaticCredentials(ID, SECRET, "")
-			signer := v4.NewSigner(creds)
-
-			req, err := http.NewRequest(http.MethodPut, PATH, nil)
+			req, err := http.NewRequest(http.MethodPut, testURL, nil)
 			if err != nil {
-				t.Errorf("expect not no error, got %v", err)
+				t.Fatalf("expect not no error, got %v", err)
 			}
 
-			_, err = signer.Sign(req, strings.NewReader(tc.SignBody), "s3", "us-east-1", time.Now())
+			h := sha256.Sum256([]byte(tc.SignBody))
+			payloadHash := hex.EncodeToString(h[:])
+			req.Header.Set("X-Amz-Content-Sha256", payloadHash)
+
+			sigTime := time.Now()
+			signer := v4.NewSigner()
+			err = signer.SignHTTP(ctx, creds, req, payloadHash, "s3", "us-east-1", sigTime)
 			if err != nil {
-				t.Errorf("expect not no error, got %v", err)
+				t.Fatalf("expect not no error, got %v", err)
 			}
 
-			req.Body = io.NopCloser(strings.NewReader(tc.RequestBody))
 			// verify request with our authenticator
-
+			req.Body = io.NopCloser(strings.NewReader(tc.RequestBody))
 			authenticator := sig.NewV4Authenticator(req)
-			_, err = authenticator.Parse(req.Context())
+			_, err = authenticator.Parse()
 			if err != nil {
-				t.Errorf("expect not no error, got %v", err)
+				t.Fatalf("expect not no error, got %v", err)
 			}
 
 			err = authenticator.Verify(&model.Credential{
 				BaseCredential: model.BaseCredential{
-					AccessKeyID:     ID,
-					SecretAccessKey: SECRET,
-					IssuedDate:      time.Now(),
+					AccessKeyID:     testAccessKeyID,
+					SecretAccessKey: testSecretAccessKey,
+					IssuedDate:      sigTime,
 				},
-			}, sigV4NoDomain)
+			})
 			if err != nil {
-				t.Errorf("expect not no error, got %v", err)
+				t.Fatalf("expect not no error, got %v", err)
 			}
 
 			// read all
 			_, err = io.ReadAll(req.Body)
-			if err != tc.ExpectedReadError {
+			if !errors.Is(err, tc.ExpectedReadError) {
 				t.Errorf("expect Error %v error, got %s", tc.ExpectedReadError, err)
 			}
 		})
@@ -221,7 +227,7 @@ func TestStreaming(t *testing.T) {
 
 	// now test it
 	authenticator := sig.NewV4Authenticator(req)
-	_, err = authenticator.Parse(req.Context())
+	_, err = authenticator.Parse()
 	if err != nil {
 		t.Errorf("expect not no error, got %v", err)
 	}
@@ -232,7 +238,7 @@ func TestStreaming(t *testing.T) {
 			SecretAccessKey: SECRET,
 			IssuedDate:      time.Now(),
 		},
-	}, sigV4NoDomain)
+	})
 	if err != nil {
 		t.Error(err)
 	}
@@ -279,7 +285,7 @@ func TestStreamingLastByteWrong(t *testing.T) {
 
 	// now test it
 	authenticator := sig.NewV4Authenticator(req)
-	_, err = authenticator.Parse(req.Context())
+	_, err = authenticator.Parse()
 	if err != nil {
 		t.Errorf("expect not no error, got %v", err)
 	}
@@ -290,14 +296,14 @@ func TestStreamingLastByteWrong(t *testing.T) {
 			SecretAccessKey: SECRET,
 			IssuedDate:      time.Now(),
 		},
-	}, sigV4NoDomain)
+	})
 	if err != nil {
 		t.Errorf("expect not no error, got %v", err)
 	}
 
 	_, err = io.ReadAll(req.Body)
-	if err != errors.ErrSignatureDoesNotMatch {
-		t.Errorf("expect %v, got %v", errors.ErrSignatureDoesNotMatch, err)
+	if err != gtwerrors.ErrSignatureDoesNotMatch {
+		t.Errorf("expect %v, got %v", gtwerrors.ErrSignatureDoesNotMatch, err)
 	}
 }
 
@@ -326,7 +332,7 @@ func TestUnsignedPayload(t *testing.T) {
 	}
 
 	authenticator := sig.NewV4Authenticator(req)
-	_, err = authenticator.Parse(req.Context())
+	_, err = authenticator.Parse()
 	if err != nil {
 		t.Errorf("expect not no error, got %v", err)
 	}
@@ -337,7 +343,7 @@ func TestUnsignedPayload(t *testing.T) {
 			SecretAccessKey: testSecret,
 			IssuedDate:      time.Now(),
 		},
-	}, sigV4NoDomain)
+	})
 	if err != nil {
 		t.Errorf("expect not no error, got %v", err)
 	}
diff --git a/pkg/graveler/graveler.go b/pkg/graveler/graveler.go
index 221945adb62..dcb95ed2608 100644
--- a/pkg/graveler/graveler.go
+++ b/pkg/graveler/graveler.go
@@ -1024,15 +1024,20 @@ type Graveler struct {
 	// logger *without context* to be used for logging.  It should be
 	// avoided in favour of g.log(ctx) in any operation where context is
 	// available.
-	logger logging.Logger
+	logger              logging.Logger
+	BranchUpdateBackOff backoff.BackOff
 }
 
 func NewGraveler(committedManager CommittedManager, stagingManager StagingManager, refManager RefManager, gcManager GarbageCollectionManager, protectedBranchesManager ProtectedBranchesManager) *Graveler {
+	branchUpdateBackOff := backoff.NewExponentialBackOff()
+	branchUpdateBackOff.MaxInterval = BranchUpdateMaxInterval
+
 	return &Graveler{
 		hooks:                    &HooksNoOp{},
 		CommittedManager:         committedManager,
 		RefManager:               refManager,
 		StagingManager:           stagingManager,
+		BranchUpdateBackOff:      branchUpdateBackOff,
 		protectedBranchesManager: protectedBranchesManager,
 		garbageCollectionManager: gcManager,
 		logger:                   logging.ContextUnavailable().WithField("service_name", "graveler_graveler"),
@@ -1645,7 +1650,8 @@ func (g *Graveler) Set(ctx context.Context, repository *RepositoryRecord, branch
 // if the staging token changes during the write.  It never backs off.  It
 // returns the number of times it tried -- between 1 and options.MaxTries.
 func (g *Graveler) safeBranchWrite(ctx context.Context, log logging.Logger, repository *RepositoryRecord, branchID BranchID,
-	options safeBranchWriteOptions, stagingOperation func(branch *Branch) error, operation string) error {
+	options safeBranchWriteOptions, stagingOperation func(branch *Branch) error, operation string,
+) error {
 	if options.MaxTries == 0 {
 		options.MaxTries = BranchWriteMaxTries
 	}
@@ -1997,9 +2003,6 @@ func (g *Graveler) Commit(ctx context.Context, repository *RepositoryRecord, bra
 // BranchUpdateMaxInterval.  It returns the number of times it tried --
 // between 1 and BranchUpdateMaxTries.
 func (g *Graveler) retryBranchUpdate(ctx context.Context, repository *RepositoryRecord, branchID BranchID, f BranchUpdateFunc, operation string) error {
-	bo := backoff.NewExponentialBackOff()
-	bo.MaxInterval = BranchUpdateMaxInterval
-
 	tries := 0
 	defer g.monitorRetries(ctx, tries, repository.RepositoryID, branchID, operation)
 	err := backoff.Retry(func() error {
@@ -2016,7 +2019,7 @@ func (g *Graveler) retryBranchUpdate(ctx context.Context, repository *Repository
 			return backoff.Permanent(err)
 		}
 		return nil
-	}, bo)
+	}, g.BranchUpdateBackOff)
 	if errors.Is(err, kv.ErrPredicateFailed) && tries >= BranchUpdateMaxTries {
 		return fmt.Errorf("update branch: %w (last %s)", ErrTooManyTries, err)
 	}
diff --git a/pkg/graveler/graveler_v2_test.go b/pkg/graveler/graveler_v2_test.go
index 3266e258e78..b232b8604a7 100644
--- a/pkg/graveler/graveler_v2_test.go
+++ b/pkg/graveler/graveler_v2_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/cenkalti/backoff/v4"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"github.com/treeverse/lakefs/pkg/catalog/testutils"
@@ -256,6 +257,11 @@ func TestGravelerMerge(t *testing.T) {
 
 	t.Run("merge successful with branchUpdate retry", func(t *testing.T) {
 		test := testutil.InitGravelerTest(t)
+
+		// upgrade graveler branch update back-off to shorten test duration
+		const updateRetryDuration = 200 * time.Millisecond
+		test.Sut.BranchUpdateBackOff = backoff.NewConstantBackOff(updateRetryDuration)
+
 		firstUpdateBranch(test)
 		emptyStagingTokenCombo(test, 2)
 		test.RefManager.EXPECT().GetCommit(ctx, repository, commit1ID).Times(3).Return(&commit1, nil)
diff --git a/pkg/ingest/store/factory.go b/pkg/ingest/store/factory.go
index e7d953f4859..f7a2b2145a1 100644
--- a/pkg/ingest/store/factory.go
+++ b/pkg/ingest/store/factory.go
@@ -8,8 +8,9 @@ import (
 	"strings"
 
 	"cloud.google.com/go/storage"
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	awss3 "github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/treeverse/lakefs/pkg/block"
 	"github.com/treeverse/lakefs/pkg/block/azure"
 	"github.com/treeverse/lakefs/pkg/block/factory"
@@ -60,24 +61,24 @@ func NewFactory(params params.AdapterConfig) *WalkerFactory {
 }
 
 func (f *WalkerFactory) buildS3Walker(opts WalkerOptions) (*s3.Walker, error) {
-	var sess *session.Session
+	var client *awss3.Client
 	if f.params != nil {
 		s3params, err := f.params.BlockstoreS3Params()
 		if err != nil {
 			return nil, err
 		}
-		sess, err = factory.BuildS3Client(s3params.AwsConfig, s3params.WebIdentity, s3params.SkipVerifyCertificateTestOnly)
+		client, err = factory.BuildS3Client(context.Background(), s3params)
 		if err != nil {
 			return nil, err
 		}
 	} else {
 		var err error
-		sess, err = getS3Client(opts.S3EndpointURL)
+		client, err = getS3Client(opts.S3EndpointURL)
 		if err != nil {
 			return nil, err
 		}
 	}
-	return s3.NewS3Walker(sess), nil
+	return s3.NewS3Walker(client), nil
 }
 
 func (f *WalkerFactory) buildGCSWalker(ctx context.Context) (*gs.GCSWalker, error) {
@@ -116,7 +117,7 @@ func (f *WalkerFactory) buildAzureWalker(importURL *url.URL, skipOutOfOrder bool
 		}
 	}
 
-	// Use StorageAccessKey to initialize storage account client only if it was provided for this given storage account
+	// Use StorageAccessKey to initialize the storage account client only if it was provided for this given storage account
 	// Otherwise fall back to the default credentials
 	if azureParams.StorageAccount != storageAccount {
 		azureParams.StorageAccount = storageAccount
@@ -195,17 +196,18 @@ func (f *WalkerFactory) buildLocalWalker() (*local.Walker, error) {
 	return local.NewLocalWalker(localParams), nil
 }
 
-func getS3Client(s3EndpointURL string) (*session.Session, error) {
-	var config aws.Config
-	if s3EndpointURL != "" {
-		config = aws.Config{
-			Endpoint:         aws.String(s3EndpointURL),
-			Region:           aws.String("us-east-1"), // Needs region for validation as it is AWS client
-			S3ForcePathStyle: aws.Bool(true),
-		}
+func getS3Client(s3EndpointURL string) (*awss3.Client, error) {
+	cfg, err := awsconfig.LoadDefaultConfig(context.Background())
+	if err != nil {
+		return nil, err
 	}
-	return session.NewSessionWithOptions(session.Options{
-		SharedConfigState: session.SharedConfigEnable,
-		Config:            config,
+	client := awss3.NewFromConfig(cfg, func(o *awss3.Options) {
+		if s3EndpointURL != "" {
+			o.BaseEndpoint = aws.String(s3EndpointURL)
+			o.Region = "us-east-1"
+			o.UsePathStyle = true
+		}
 	})
+	// TODO(barak): do we require SharedConfigState: session.SharedConfigEnable,
+	return client, nil
 }
diff --git a/pkg/kv/dynamodb/store.go b/pkg/kv/dynamodb/store.go
index fd857c6f4e5..4f1e9cb6840 100644
--- a/pkg/kv/dynamodb/store.go
+++ b/pkg/kv/dynamodb/store.go
@@ -10,13 +10,14 @@ import (
 	"sync"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/dynamodb"
-	"github.com/aws/aws-sdk-go/service/dynamodb/dynamodbattribute"
-	"github.com/aws/aws-sdk-go/service/dynamodb/expression"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue"
+	"github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression"
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
 	"github.com/cenkalti/backoff/v4"
 	"github.com/treeverse/lakefs/pkg/kv"
 	"github.com/treeverse/lakefs/pkg/kv/kvparams"
@@ -26,7 +27,7 @@ import (
 type Driver struct{}
 
 type Store struct {
-	svc    *dynamodb.DynamoDB
+	svc    *dynamodb.Client
 	params *kvparams.DynamoDB
 	wg     sync.WaitGroup
 	logger logging.Logger
@@ -36,7 +37,7 @@ type Store struct {
 type EntriesIterator struct {
 	partitionKey      []byte
 	startKey          []byte
-	exclusiveStartKey map[string]*dynamodb.AttributeValue
+	exclusiveStartKey map[string]types.AttributeValue
 
 	scanCtx      context.Context
 	entry        *kv.Entry
@@ -74,39 +75,38 @@ func (d *Driver) Open(ctx context.Context, kvParams kvparams.Config) (kv.Store,
 		return nil, fmt.Errorf("missing %s settings: %w", DriverName, kv.ErrDriverConfiguration)
 	}
 
-	sess, err := session.NewSessionWithOptions(session.Options{
-		SharedConfigState: session.SharedConfigEnable,
-		Profile:           params.AwsProfile,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	cfg := aws.NewConfig()
-	if params.Endpoint != "" {
-		cfg.Endpoint = aws.String(params.Endpoint)
-	}
+	var opts []func(*config.LoadOptions) error
 	if params.AwsRegion != "" {
-		cfg = cfg.WithRegion(params.AwsRegion)
+		opts = append(opts, config.WithRegion(params.AwsRegion))
+	}
+	if params.AwsProfile != "" {
+		opts = append(opts, config.WithSharedConfigProfile(params.AwsProfile))
 	}
 	if params.AwsAccessKeyID != "" {
-		cfg = cfg.WithCredentials(credentials.NewCredentials(
-			&credentials.StaticProvider{
-				Value: credentials.Value{
-					AccessKeyID:     params.AwsAccessKeyID,
-					SecretAccessKey: params.AwsSecretAccessKey,
-				},
-			}))
+		opts = append(opts, config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
+			params.AwsAccessKeyID,
+			params.AwsSecretAccessKey,
+			"",
+		)))
 	}
 	const maxConnectionPerHost = 10
-	cfg = cfg.WithHTTPClient(&http.Client{
-		Transport: &http.Transport{
-			MaxConnsPerHost: maxConnectionPerHost,
-		},
-	})
+	opts = append(opts, config.WithHTTPClient(
+		awshttp.NewBuildableClient().WithTransportOptions(func(transport *http.Transport) {
+			transport.MaxConnsPerHost = maxConnectionPerHost
+		})))
+
+	cfg, err := config.LoadDefaultConfig(ctx, opts...)
+	if err != nil {
+		return nil, err
+	}
 
 	// Create DynamoDB client
-	svc := dynamodb.New(sess, cfg)
+	svc := dynamodb.NewFromConfig(cfg, func(o *dynamodb.Options) {
+		if params.Endpoint != "" {
+			o.BaseEndpoint = &params.Endpoint
+		}
+	})
+
 	err = setupKeyValueDatabase(ctx, svc, params)
 	if err != nil {
 		return nil, fmt.Errorf("%w: %s", kv.ErrSetupFailed, err)
@@ -125,53 +125,55 @@ func (d *Driver) Open(ctx context.Context, kvParams kvparams.Config) (kv.Store,
 }
 
 // isTableExist will try to describeTable and return bool status, error is returned only in case err != ResourceNotFoundException
-func isTableExist(ctx context.Context, svc *dynamodb.DynamoDB, table string) (bool, error) {
-	_, err := svc.DescribeTableWithContext(ctx, &dynamodb.DescribeTableInput{
+func isTableExist(ctx context.Context, svc *dynamodb.Client, table string) (bool, error) {
+	_, err := svc.DescribeTable(ctx, &dynamodb.DescribeTableInput{
 		TableName: aws.String(table),
 	})
 	if err != nil {
-		if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == dynamodb.ErrCodeResourceNotFoundException {
+		var errResNotFound *types.ResourceNotFoundException
+		if errors.As(err, &errResNotFound) {
 			return false, nil
 		}
-		return false, handleClientError(err)
+		return false, err
 	}
 	return true, nil
 }
 
 // setupKeyValueDatabase setup everything required to enable kv over postgres
-func setupKeyValueDatabase(ctx context.Context, svc *dynamodb.DynamoDB, params *kvparams.DynamoDB) error {
+func setupKeyValueDatabase(ctx context.Context, svc *dynamodb.Client, params *kvparams.DynamoDB) error {
 	// main kv table
 	exist, err := isTableExist(ctx, svc, params.TableName)
 	if exist || err != nil {
 		return err
 	}
 
-	table, err := svc.CreateTableWithContext(ctx, &dynamodb.CreateTableInput{
+	table, err := svc.CreateTable(ctx, &dynamodb.CreateTableInput{
 		TableName:   aws.String(params.TableName),
-		BillingMode: aws.String(dynamodb.BillingModePayPerRequest), // On-Demand
-		AttributeDefinitions: []*dynamodb.AttributeDefinition{
+		BillingMode: types.BillingModePayPerRequest, // On-Demand
+		AttributeDefinitions: []types.AttributeDefinition{
 			{
 				AttributeName: aws.String(PartitionKey),
-				AttributeType: aws.String("B"),
+				AttributeType: types.ScalarAttributeTypeB,
 			},
 			{
 				AttributeName: aws.String(ItemKey),
-				AttributeType: aws.String("B"),
+				AttributeType: types.ScalarAttributeTypeB,
 			},
 		},
-		KeySchema: []*dynamodb.KeySchemaElement{
+		KeySchema: []types.KeySchemaElement{
 			{
 				AttributeName: aws.String(PartitionKey),
-				KeyType:       aws.String("HASH"),
+				KeyType:       types.KeyTypeHash,
 			},
 			{
 				AttributeName: aws.String(ItemKey),
-				KeyType:       aws.String("RANGE"),
+				KeyType:       types.KeyTypeRange,
 			},
 		},
 	})
 	if err != nil {
-		if _, ok := err.(*dynamodb.ResourceInUseException); ok {
+		var errResInUse *types.ResourceInUseException
+		if errors.As(err, &errResInUse) {
 			return nil
 		}
 		return err
@@ -185,28 +187,28 @@ func setupKeyValueDatabase(ctx context.Context, svc *dynamodb.DynamoDB, params *
 	bo.MaxInterval = maxInterval * time.Second
 	bo.MaxElapsedTime = maxElapsed * time.Second
 	err = backoff.Retry(func() error {
-		desc, err := svc.DescribeTable(&dynamodb.DescribeTableInput{
+		desc, err := svc.DescribeTable(ctx, &dynamodb.DescribeTableInput{
 			TableName: table.TableDescription.TableName,
 		})
 		if err != nil {
 			// we shouldn't retry on anything but kv.ErrTableNotActive
 			return backoff.Permanent(err)
 		}
-		if *desc.Table.TableStatus != dynamodb.TableStatusActive {
-			return fmt.Errorf("table status(%s): %w", *desc.Table.TableStatus, kv.ErrTableNotActive)
+		if desc.Table.TableStatus != types.TableStatusActive {
+			return fmt.Errorf("table status(%s): %w", desc.Table.TableStatus, kv.ErrTableNotActive)
 		}
 		return nil
 	}, bo)
 	return err
 }
 
-func (s *Store) bytesKeyToDynamoKey(partitionKey, key []byte) map[string]*dynamodb.AttributeValue {
-	return map[string]*dynamodb.AttributeValue{
-		PartitionKey: {
-			B: partitionKey,
+func (s *Store) bytesKeyToDynamoKey(partitionKey, key []byte) map[string]types.AttributeValue {
+	return map[string]types.AttributeValue{
+		PartitionKey: &types.AttributeValueMemberB{
+			Value: partitionKey,
 		},
-		ItemKey: {
-			B: key,
+		ItemKey: &types.AttributeValueMemberB{
+			Value: key,
 		},
 	}
 }
@@ -218,16 +220,15 @@ func (s *Store) Get(ctx context.Context, partitionKey, key []byte) (*kv.ValueWit
 	if len(key) == 0 {
 		return nil, kv.ErrMissingKey
 	}
-
-	result, err := s.svc.GetItemWithContext(ctx, &dynamodb.GetItemInput{
+	result, err := s.svc.GetItem(ctx, &dynamodb.GetItemInput{
 		TableName:              aws.String(s.params.TableName),
 		Key:                    s.bytesKeyToDynamoKey(partitionKey, key),
 		ConsistentRead:         aws.Bool(true),
-		ReturnConsumedCapacity: aws.String(dynamodb.ReturnConsumedCapacityTotal),
+		ReturnConsumedCapacity: types.ReturnConsumedCapacityTotal,
 	})
 	const operation = "GetItem"
 	if err != nil {
-		return nil, fmt.Errorf("get item: %w", handleClientError(err))
+		return nil, fmt.Errorf("get item: %w", err)
 	}
 	if result.ConsumedCapacity != nil {
 		dynamoConsumedCapacity.WithLabelValues(operation).Add(*result.ConsumedCapacity.CapacityUnits)
@@ -238,7 +239,7 @@ func (s *Store) Get(ctx context.Context, partitionKey, key []byte) (*kv.ValueWit
 	}
 
 	var item DynKVItem
-	err = dynamodbattribute.UnmarshalMap(result.Item, &item)
+	err = attributevalue.UnmarshalMap(result.Item, &item)
 	if err != nil {
 		return nil, fmt.Errorf("unmarshal map: %w", err)
 	}
@@ -274,7 +275,7 @@ func (s *Store) setWithOptionalPredicate(ctx context.Context, partitionKey, key,
 		ItemValue:    value,
 	}
 
-	marshaledItem, err := dynamodbattribute.MarshalMap(item)
+	marshaledItem, err := attributevalue.MarshalMap(item)
 	if err != nil {
 		return fmt.Errorf("marshal map: %w", err)
 	}
@@ -282,7 +283,7 @@ func (s *Store) setWithOptionalPredicate(ctx context.Context, partitionKey, key,
 	input := &dynamodb.PutItemInput{
 		Item:                   marshaledItem,
 		TableName:              &s.params.TableName,
-		ReturnConsumedCapacity: aws.String(dynamodb.ReturnConsumedCapacityTotal),
+		ReturnConsumedCapacity: types.ReturnConsumedCapacityTotal,
 	}
 	if usePredicate {
 		switch valuePredicate {
@@ -292,7 +293,7 @@ func (s *Store) setWithOptionalPredicate(ctx context.Context, partitionKey, key,
 		case kv.PrecondConditionalExists: // update only if exists
 			input.ConditionExpression = aws.String("attribute_exists(" + ItemValue + ")")
 
-		default: // update only if predicate matches current stored value
+		default: // update only if predicate matches the current stored value
 			predicateCondition := expression.Name(ItemValue).Equal(expression.Value(valuePredicate.([]byte)))
 			conditionExpression, err := expression.NewBuilder().WithCondition(predicateCondition).Build()
 			if err != nil {
@@ -304,13 +305,14 @@ func (s *Store) setWithOptionalPredicate(ctx context.Context, partitionKey, key,
 		}
 	}
 
-	resp, err := s.svc.PutItemWithContext(ctx, input)
+	resp, err := s.svc.PutItem(ctx, input)
 	const operation = "PutItem"
 	if err != nil {
-		if _, ok := err.(*dynamodb.ConditionalCheckFailedException); ok && usePredicate {
+		var errConditionalCheckFailed *types.ConditionalCheckFailedException
+		if usePredicate && errors.As(err, &errConditionalCheckFailed) {
 			return kv.ErrPredicateFailed
 		}
-		return fmt.Errorf("put item: %w", handleClientError(err))
+		return fmt.Errorf("put item: %w", err)
 	}
 	if resp.ConsumedCapacity != nil {
 		dynamoConsumedCapacity.WithLabelValues(operation).Add(*resp.ConsumedCapacity.CapacityUnits)
@@ -326,14 +328,14 @@ func (s *Store) Delete(ctx context.Context, partitionKey, key []byte) error {
 		return kv.ErrMissingKey
 	}
 
-	resp, err := s.svc.DeleteItemWithContext(ctx, &dynamodb.DeleteItemInput{
+	resp, err := s.svc.DeleteItem(ctx, &dynamodb.DeleteItemInput{
 		TableName:              aws.String(s.params.TableName),
 		Key:                    s.bytesKeyToDynamoKey(partitionKey, key),
-		ReturnConsumedCapacity: aws.String(dynamodb.ReturnConsumedCapacityTotal),
+		ReturnConsumedCapacity: types.ReturnConsumedCapacityTotal,
 	})
 	const operation = "DeleteItem"
 	if err != nil {
-		return fmt.Errorf("delete item: %w", handleClientError(err))
+		return fmt.Errorf("delete item: %w", err)
 	}
 	if resp.ConsumedCapacity != nil {
 		dynamoConsumedCapacity.WithLabelValues(operation).Add(*resp.ConsumedCapacity.CapacityUnits)
@@ -371,7 +373,8 @@ func (s *Store) Close() {
 
 // DropTable used internally for testing purposes
 func (s *Store) DropTable() error {
-	_, err := s.svc.DeleteTable(&dynamodb.DeleteTableInput{
+	ctx := context.Background()
+	_, err := s.svc.DeleteTable(ctx, &dynamodb.DeleteTableInput{
 		TableName: &s.params.TableName,
 	})
 	return err
@@ -386,7 +389,7 @@ func (e *EntriesIterator) SeekGE(key []byte) {
 	}
 	var item DynKVItem
 	e.currEntryIdx = sort.Search(len(e.queryResult.Items), func(i int) bool {
-		if e.err = dynamodbattribute.UnmarshalMap(e.queryResult.Items[i], &item); e.err != nil {
+		if e.err = attributevalue.UnmarshalMap(e.queryResult.Items[i], &item); e.err != nil {
 			return false
 		}
 		return bytes.Compare(key, item.ItemKey) <= 0
@@ -408,7 +411,7 @@ func (e *EntriesIterator) Next() bool {
 		}
 	}
 	var item DynKVItem
-	e.err = dynamodbattribute.UnmarshalMap(e.queryResult.Items[e.currEntryIdx], &item)
+	e.err = attributevalue.UnmarshalMap(e.queryResult.Items[e.currEntryIdx], &item)
 	if e.err != nil {
 		return false
 	}
@@ -433,16 +436,16 @@ func (e *EntriesIterator) Close() {
 }
 
 func (e *EntriesIterator) runQuery() {
-	expressionAttributeValues := map[string]*dynamodb.AttributeValue{
-		":partitionkey": {
-			B: e.partitionKey,
+	expressionAttributeValues := map[string]types.AttributeValue{
+		":partitionkey": &types.AttributeValueMemberB{
+			Value: e.partitionKey,
 		},
 	}
 	keyConditionExpression := PartitionKey + " = :partitionkey"
 	if len(e.startKey) > 0 {
 		keyConditionExpression += " AND " + ItemKey + " >= :fromkey"
-		expressionAttributeValues[":fromkey"] = &dynamodb.AttributeValue{
-			B: e.startKey,
+		expressionAttributeValues[":fromkey"] = &types.AttributeValueMemberB{
+			Value: e.startKey,
 		}
 	}
 	queryInput := &dynamodb.QueryInput{
@@ -452,16 +455,16 @@ func (e *EntriesIterator) runQuery() {
 		ConsistentRead:            aws.Bool(true),
 		ScanIndexForward:          aws.Bool(true),
 		ExclusiveStartKey:         e.exclusiveStartKey,
-		ReturnConsumedCapacity:    aws.String(dynamodb.ReturnConsumedCapacityTotal),
+		ReturnConsumedCapacity:    types.ReturnConsumedCapacityTotal,
 	}
 	if e.limit != 0 {
-		queryInput.SetLimit(e.limit)
+		queryInput.Limit = aws.Int32(int32(e.limit))
 	}
 
-	queryResult, err := e.store.svc.QueryWithContext(e.scanCtx, queryInput)
+	queryResult, err := e.store.svc.Query(e.scanCtx, queryInput)
 	const operation = "Query"
 	if err != nil {
-		e.err = fmt.Errorf("query: %w", handleClientError(err))
+		e.err = fmt.Errorf("query: %w", err)
 		return
 	}
 	dynamoConsumedCapacity.WithLabelValues(operation).Add(*queryResult.ConsumedCapacity.CapacityUnits)
@@ -474,11 +477,11 @@ func (e *EntriesIterator) isInRange(key []byte) bool {
 		return false
 	}
 	var maxItem, minItem DynKVItem
-	e.err = dynamodbattribute.UnmarshalMap(e.queryResult.Items[0], &minItem)
+	e.err = attributevalue.UnmarshalMap(e.queryResult.Items[0], &minItem)
 	if e.err != nil {
 		return false
 	}
-	e.err = dynamodbattribute.UnmarshalMap(e.queryResult.Items[len(e.queryResult.Items)-1], &maxItem)
+	e.err = attributevalue.UnmarshalMap(e.queryResult.Items[len(e.queryResult.Items)-1], &maxItem)
 	if e.err != nil {
 		return false
 	}
@@ -527,12 +530,3 @@ func (s *Store) StopPeriodicCheck() {
 		s.cancel = nil
 	}
 }
-
-func handleClientError(err error) error {
-	// extract original error if needed
-	var reqErr awserr.Error
-	if errors.As(err, &reqErr) && errors.Is(reqErr.OrigErr(), context.Canceled) {
-		err = reqErr.OrigErr()
-	}
-	return err
-}
diff --git a/pkg/kv/mem/store.go b/pkg/kv/mem/store.go
index 4b2bf3b4dbe..66576a57da2 100644
--- a/pkg/kv/mem/store.go
+++ b/pkg/kv/mem/store.go
@@ -44,7 +44,7 @@ func init() {
 
 func (d *Driver) Open(_ context.Context, _ kvparams.Config) (kv.Store, error) {
 	return &Store{
-		m: make(map[string]PartitionMap, 0),
+		m: make(map[string]PartitionMap),
 	}, nil
 }
 
@@ -184,21 +184,20 @@ func (e *EntriesIterator) Next() bool {
 	e.store.mu.RLock()
 	defer e.store.mu.RUnlock()
 
-	l := make([]*kv.Entry, 0)
+	var l []*kv.Entry
 	if _, ok := e.store.m[e.partition]; ok {
-		for _, v := range e.store.m[e.partition] {
-			if bytes.Compare(v.Key, e.start) >= 0 {
-				entry := v
+		for _, entry := range e.store.m[e.partition] {
+			if bytes.Compare(entry.Key, e.start) >= 0 {
+				entry := entry
 				l = append(l, &entry)
 			}
 		}
 	}
-
 	if len(l) == 0 { // No results
 		e.start = nil
 		return false
 	}
-	if len(l) == 1 { // only 1 key >= start, set start to nil, so to indicate next call to return false immediately.
+	if len(l) == 1 { // only one key >= start, set start to nil, so to indicate the next call to return false immediately.
 		e.start = nil
 		e.entry = l[0]
 		return true
diff --git a/pkg/logging/aws.go b/pkg/logging/aws.go
index 4f93c19bc9a..0ac656f7dce 100644
--- a/pkg/logging/aws.go
+++ b/pkg/logging/aws.go
@@ -1,9 +1,17 @@
 package logging
 
+import (
+	"github.com/aws/smithy-go/logging"
+)
+
 type AWSAdapter struct {
 	Logger Logger
 }
 
-func (l *AWSAdapter) Log(vars ...interface{}) {
-	l.Logger.Debug(vars...)
+func (l *AWSAdapter) Logf(classification logging.Classification, format string, v ...interface{}) {
+	if classification == logging.Warn {
+		l.Logger.Warnf(format, v...)
+	} else {
+		l.Logger.Debugf(format, v...)
+	}
 }
diff --git a/pkg/logging/logger_test.go b/pkg/logging/logger_test.go
index f00d3e32bba..efbc6e3d6c0 100644
--- a/pkg/logging/logger_test.go
+++ b/pkg/logging/logger_test.go
@@ -9,9 +9,10 @@ import (
 
 func TestSetOutputs(t *testing.T) {
 	t.Run("default", func(t *testing.T) {
+		currentOut := defaultLogger.Out
 		SetOutputs(nil, 0, 0)
-		if defaultLogger.Out != os.Stderr {
-			t.Error("Logger output should be stderr by default")
+		if defaultLogger.Out != currentOut {
+			t.Error("Logger output should not change by default")
 		}
 	})
 
diff --git a/pkg/metastore/glue/converter.go b/pkg/metastore/glue/converter.go
index c1b0b86bcf5..878c2439665 100644
--- a/pkg/metastore/glue/converter.go
+++ b/pkg/metastore/glue/converter.go
@@ -3,201 +3,201 @@ package glue
 import (
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/glue"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/glue/types"
 	"github.com/treeverse/lakefs/pkg/metastore"
 )
 
-func serDeGlueToLocal(g *glue.SerDeInfo) *metastore.SerDeInfo {
+func serDeGlueToLocal(g *types.SerDeInfo) *metastore.SerDeInfo {
 	if g == nil {
 		return nil
 	}
 	return &metastore.SerDeInfo{
-		Name:             aws.StringValue(g.Name),
-		SerializationLib: aws.StringValue(g.SerializationLibrary),
-		Parameters:       aws.StringValueMap(g.Parameters),
+		Name:             aws.ToString(g.Name),
+		SerializationLib: aws.ToString(g.SerializationLibrary),
+		Parameters:       g.Parameters,
 	}
 }
 
-func skewedGlueToLocal(g *glue.SkewedInfo) *metastore.SkewedInfo {
+func skewedGlueToLocal(g *types.SkewedInfo) *metastore.SkewedInfo {
 	if g == nil {
 		return &metastore.SkewedInfo{}
 	}
 	return &metastore.SkewedInfo{
-		SkewedColNames:             aws.StringValueSlice(g.SkewedColumnNames),
-		SkewedColValues:            [][]string{aws.StringValueSlice(g.SkewedColumnValues)}, // TODO(Guys): validate this hive uses [][]string glue uses []string (????)
-		SkewedColValueLocationMaps: aws.StringValueMap(g.SkewedColumnValueLocationMaps),
+		SkewedColNames:             g.SkewedColumnNames,
+		SkewedColValues:            [][]string{g.SkewedColumnValues}, // TODO(Guys): validate this hive uses [][]string glue uses []string (????)
+		SkewedColValueLocationMaps: g.SkewedColumnValueLocationMaps,
 	}
 }
 
-func sortColumnsGlueToLocal(columns []*glue.Order) []*metastore.Order {
+func sortColumnsGlueToLocal(columns []types.Order) []*metastore.Order {
 	res := make([]*metastore.Order, len(columns))
 	for i, column := range columns {
 		res[i] = &metastore.Order{
-			Col:   aws.StringValue(column.Column),
-			Order: int(aws.Int64Value(column.SortOrder)),
+			Col:   aws.ToString(column.Column),
+			Order: int(column.SortOrder),
 		}
 	}
 	return res
 }
 
-func columnsGlueToLocal(columns []*glue.Column) []*metastore.FieldSchema {
+func columnsGlueToLocal(columns []types.Column) []*metastore.FieldSchema {
 	res := make([]*metastore.FieldSchema, len(columns))
 	for i, column := range columns {
 		res[i] = &metastore.FieldSchema{
-			Name:    aws.StringValue(column.Name),
-			Type:    aws.StringValue(column.Type),
-			Comment: aws.StringValue(column.Comment),
+			Name:    aws.ToString(column.Name),
+			Type:    aws.ToString(column.Type),
+			Comment: aws.ToString(column.Comment),
 		}
 	}
 	return res
 }
 
-func TableGlueToLocal(glueTable *glue.TableData) *metastore.Table {
+func TableGlueToLocal(glueTable *types.Table) *metastore.Table {
 	sd := SDGlueToLocal(glueTable.StorageDescriptor)
 	ht := &metastore.Table{
-		TableName:        aws.StringValue(glueTable.Name),
-		DBName:           aws.StringValue(glueTable.DatabaseName),
-		Owner:            aws.StringValue(glueTable.Owner),
-		CreateTime:       aws.TimeValue(glueTable.CreateTime).Unix(),     // TODO(Guys): check if this OK
-		LastAccessTime:   aws.TimeValue(glueTable.LastAccessTime).Unix(), // TODO(Guys): check if this OK
-		Retention:        int(aws.Int64Value(glueTable.Retention)),       // TODO(Guys): check if this OK
+		TableName:        aws.ToString(glueTable.Name),
+		DBName:           aws.ToString(glueTable.DatabaseName),
+		Owner:            aws.ToString(glueTable.Owner),
+		CreateTime:       aws.ToTime(glueTable.CreateTime).Unix(),     // TODO(Guys): check if this OK
+		LastAccessTime:   aws.ToTime(glueTable.LastAccessTime).Unix(), // TODO(Guys): check if this OK
+		Retention:        int(glueTable.Retention),                    // TODO(Guys): check if this OK
 		Sd:               sd,
 		PartitionKeys:    columnsGlueToLocal(glueTable.PartitionKeys),
-		Parameters:       aws.StringValueMap(glueTable.Parameters),
-		ViewOriginalText: aws.StringValue(glueTable.ViewOriginalText),
-		ViewExpandedText: aws.StringValue(glueTable.ViewExpandedText),
-		TableType:        aws.StringValue(glueTable.TableType),
+		Parameters:       glueTable.Parameters,
+		ViewOriginalText: aws.ToString(glueTable.ViewOriginalText),
+		ViewExpandedText: aws.ToString(glueTable.ViewExpandedText),
+		TableType:        aws.ToString(glueTable.TableType),
 		RewriteEnabled:   nil,
 		Temporary:        false,
 	}
 	return ht
 }
 
-func TablesGlueToLocal(glueTables []*glue.TableData) []*metastore.Table {
+func TablesGlueToLocal(glueTables []types.Table) []*metastore.Table {
 	tables := make([]*metastore.Table, len(glueTables))
-	for i, table := range glueTables {
-		tables[i] = TableGlueToLocal(table)
+	for i := range glueTables {
+		tables[i] = TableGlueToLocal(&glueTables[i])
 	}
 	return tables
 }
 
-func PartitionGlueToLocal(gluePartition *glue.Partition) *metastore.Partition {
+func PartitionGlueToLocal(gluePartition *types.Partition) *metastore.Partition {
 	sd := SDGlueToLocal(gluePartition.StorageDescriptor)
 	partition := &metastore.Partition{
-		Values:              aws.StringValueSlice(gluePartition.Values),
-		DBName:              aws.StringValue(gluePartition.DatabaseName),
-		TableName:           aws.StringValue(gluePartition.TableName),
-		CreateTime:          int(aws.TimeValue(gluePartition.CreationTime).Unix()),
-		LastAccessTime:      int(aws.TimeValue(gluePartition.LastAccessTime).Unix()),
+		Values:              gluePartition.Values,
+		DBName:              aws.ToString(gluePartition.DatabaseName),
+		TableName:           aws.ToString(gluePartition.TableName),
+		CreateTime:          int(aws.ToTime(gluePartition.CreationTime).Unix()),
+		LastAccessTime:      int(aws.ToTime(gluePartition.LastAccessTime).Unix()),
 		Sd:                  sd,
-		Parameters:          aws.StringValueMap(gluePartition.Parameters),
+		Parameters:          gluePartition.Parameters,
 		AWSLastAnalyzedTime: gluePartition.LastAnalyzedTime,
 	}
 	return partition
 }
 
-func PartitionsGlueToLocal(gluePartitions []*glue.Partition) []*metastore.Partition {
+func PartitionsGlueToLocal(gluePartitions []types.Partition) []*metastore.Partition {
 	partitions := make([]*metastore.Partition, len(gluePartitions))
-	for i, partition := range gluePartitions {
-		partitions[i] = PartitionGlueToLocal(partition)
+	for i := range gluePartitions {
+		partitions[i] = PartitionGlueToLocal(&gluePartitions[i])
 	}
 	return partitions
 }
 
-func serDeLocalToGlue(info *metastore.SerDeInfo) *glue.SerDeInfo {
+func serDeLocalToGlue(info *metastore.SerDeInfo) *types.SerDeInfo {
 	if info == nil {
 		return nil
 	}
 
-	// glue cannot have empty name
+	// glue cannot have an empty name
 	name := "default"
 	if info.Name != "" {
 		name = info.Name
 	}
 
-	return &glue.SerDeInfo{
+	return &types.SerDeInfo{
 		Name:                 aws.String(name),
-		Parameters:           aws.StringMap(info.Parameters),
+		Parameters:           info.Parameters,
 		SerializationLibrary: aws.String(info.SerializationLib),
 	}
 }
 
-func skewedLocalToGlue(info *metastore.SkewedInfo) *glue.SkewedInfo {
+func skewedLocalToGlue(info *metastore.SkewedInfo) *types.SkewedInfo {
 	if info == nil {
-		return &glue.SkewedInfo{}
+		return &types.SkewedInfo{}
 	}
-	return &glue.SkewedInfo{
-		SkewedColumnNames:             aws.StringSlice(info.SkewedColNames),
-		SkewedColumnValueLocationMaps: aws.StringMap(info.SkewedColValueLocationMaps),
-		SkewedColumnValues:            aws.StringSlice(info.AWSSkewedColValues), // TODO(Guys): validate this hive uses [][]string glue uses []string (????)
+	return &types.SkewedInfo{
+		SkewedColumnNames:             info.SkewedColNames,
+		SkewedColumnValueLocationMaps: info.SkewedColValueLocationMaps,
+		SkewedColumnValues:            info.AWSSkewedColValues, // TODO(Guys): validate this hive uses [][]string glue uses []string (????)
 	}
 }
 
-func sortColumnsLocalToGlue(columns []*metastore.Order) []*glue.Order {
-	res := make([]*glue.Order, len(columns))
-	for i, column := range columns {
-		res[i] = &glue.Order{
+func sortColumnsLocalToGlue(columns []*metastore.Order) []types.Order {
+	res := make([]types.Order, 0, len(columns))
+	for _, column := range columns {
+		res = append(res, types.Order{
 			Column:    aws.String(column.Col),
-			SortOrder: aws.Int64(int64(column.Order)),
-		}
+			SortOrder: int32(column.Order),
+		})
 	}
 	return res
 }
 
-func columnsLocalToGlue(columns []*metastore.FieldSchema) []*glue.Column {
-	res := make([]*glue.Column, len(columns))
-	for i, column := range columns {
-		res[i] = &glue.Column{
+func columnsLocalToGlue(columns []*metastore.FieldSchema) []types.Column {
+	res := make([]types.Column, 0, len(columns))
+	for _, column := range columns {
+		res = append(res, types.Column{
 			Comment: aws.String(column.Comment),
 			Name:    aws.String(column.Name),
-			//Parameters: nil,
+			// Parameters: nil,
 			Type: aws.String(column.Type),
-		}
+		})
 	}
 	return res
 }
 
-func DatabaseLocalToGlue(db *metastore.Database) *glue.DatabaseInput {
-	return &glue.DatabaseInput{
-		//CreateTableDefaultPermissions: db.,
+func DatabaseLocalToGlue(db *metastore.Database) *types.DatabaseInput {
+	return &types.DatabaseInput{
+		// CreateTableDefaultPermissions: db.,
 		Description:    aws.String(db.Description),
 		LocationUri:    aws.String(db.LocationURI),
 		Name:           aws.String(db.Name),
-		Parameters:     aws.StringMap(db.Parameters),
+		Parameters:     db.Parameters,
 		TargetDatabase: db.AWSTargetDatabase,
 	}
 }
 
-func DatabasesGlueToLocal(glueDatabases []*glue.Database) []*metastore.Database {
+func DatabasesGlueToLocal(glueDatabases []types.Database) []*metastore.Database {
 	databases := make([]*metastore.Database, len(glueDatabases))
-	for i, partition := range glueDatabases {
-		databases[i] = DatabaseGlueToLocal(partition)
+	for i := range glueDatabases {
+		databases[i] = DatabaseGlueToLocal(&glueDatabases[i])
 	}
 	return databases
 }
 
-func DatabaseGlueToLocal(db *glue.Database) *metastore.Database {
+func DatabaseGlueToLocal(db *types.Database) *metastore.Database {
 	return &metastore.Database{
-		Name:        aws.StringValue(db.Name),
-		Description: aws.StringValue(db.Description),
-		LocationURI: aws.StringValue(db.LocationUri),
-		Parameters:  aws.StringValueMap(db.Parameters),
+		Name:        aws.ToString(db.Name),
+		Description: aws.ToString(db.Description),
+		LocationURI: aws.ToString(db.LocationUri),
+		Parameters:  db.Parameters,
 	}
 }
 
-func TableLocalToGlue(table *metastore.Table) *glue.TableInput {
+func TableLocalToGlue(table *metastore.Table) *types.TableInput {
 	sd := SDLocalToGlue(table.Sd)
-	targetTable, _ := table.AWSTargetTable.(*glue.TableIdentifier)
-	ht := &glue.TableInput{
+	targetTable, _ := table.AWSTargetTable.(*types.TableIdentifier)
+	ht := &types.TableInput{
 		Description:       table.AWSDescription,
 		LastAccessTime:    localToAWSTime(table.LastAccessTime), // TODO(Guys): check if this OK
 		LastAnalyzedTime:  table.AWSLastAnalyzedTime,
 		Name:              aws.String(table.TableName),
 		Owner:             aws.String(table.Owner),
-		Parameters:        aws.StringMap(table.Parameters),
+		Parameters:        table.Parameters,
 		PartitionKeys:     columnsLocalToGlue(table.PartitionKeys),
-		Retention:         aws.Int64(int64(table.Retention)), // TODO(Guys): check if this OK
+		Retention:         int32(table.Retention), // TODO(Guys): check if this OK
 		StorageDescriptor: sd,
 		TableType:         aws.String(table.TableType),
 		TargetTable:       targetTable,
@@ -207,71 +207,71 @@ func TableLocalToGlue(table *metastore.Table) *glue.TableInput {
 	return ht
 }
 
-func PartitionLocalToGlue(partition *metastore.Partition) *glue.PartitionInput {
+func PartitionLocalToGlue(partition *metastore.Partition) *types.PartitionInput {
 	sd := SDLocalToGlue(partition.Sd)
-	ht := &glue.PartitionInput{
-		//IsRegisteredWithLakeFormation: partition.AWSIsRegisteredWithLakeFormation,
+	ht := &types.PartitionInput{
+		// IsRegisteredWithLakeFormation: partition.AWSIsRegisteredWithLakeFormation,
 		LastAccessTime:    localToAWSTime(int64(partition.LastAccessTime)), // TODO(Guys): check if this OK
 		LastAnalyzedTime:  partition.AWSLastAnalyzedTime,
-		Parameters:        aws.StringMap(partition.Parameters),
+		Parameters:        partition.Parameters,
 		StorageDescriptor: sd,
-		Values:            aws.StringSlice(partition.Values),
+		Values:            partition.Values,
 	}
 	return ht
 }
 
-func PartitionsLocalToGlue(partitions []*metastore.Partition) []*glue.PartitionInput {
-	gluePartitions := make([]*glue.PartitionInput, len(partitions))
+func PartitionsLocalToGlue(partitions []*metastore.Partition) []*types.PartitionInput {
+	gluePartitions := make([]*types.PartitionInput, len(partitions))
 	for i, partition := range partitions {
 		gluePartitions[i] = PartitionLocalToGlue(partition)
 	}
 	return gluePartitions
 }
 
-func SDLocalToGlue(sd *metastore.StorageDescriptor) *glue.StorageDescriptor {
+func SDLocalToGlue(sd *metastore.StorageDescriptor) *types.StorageDescriptor {
 	if sd == nil {
 		return nil
 	}
-	schemaRef, _ := sd.AWSSchemaReference.(*glue.SchemaReference)
-	return &glue.StorageDescriptor{
-		BucketColumns:          aws.StringSlice(sd.BucketCols),
+	schemaRef, _ := sd.AWSSchemaReference.(*types.SchemaReference)
+	return &types.StorageDescriptor{
+		BucketColumns:          sd.BucketCols,
 		Columns:                columnsLocalToGlue(sd.Cols),
-		Compressed:             aws.Bool(sd.Compressed),
+		Compressed:             sd.Compressed,
 		InputFormat:            aws.String(sd.InputFormat),
 		Location:               aws.String(sd.Location),
-		NumberOfBuckets:        aws.Int64(int64(sd.NumBuckets)),
+		NumberOfBuckets:        int32(sd.NumBuckets),
 		OutputFormat:           aws.String(sd.OutputFormat),
-		Parameters:             aws.StringMap(sd.Parameters),
+		Parameters:             sd.Parameters,
 		SchemaReference:        schemaRef,
 		SerdeInfo:              serDeLocalToGlue(sd.SerdeInfo),
 		SkewedInfo:             skewedLocalToGlue(sd.SkewedInfo),
 		SortColumns:            sortColumnsLocalToGlue(sd.SortCols),
-		StoredAsSubDirectories: sd.StoredAsSubDirectories,
+		StoredAsSubDirectories: aws.ToBool(sd.StoredAsSubDirectories),
 	}
 }
 
-func SDGlueToLocal(sd *glue.StorageDescriptor) *metastore.StorageDescriptor {
+func SDGlueToLocal(sd *types.StorageDescriptor) *metastore.StorageDescriptor {
 	if sd == nil {
 		return nil
 	}
 	return &metastore.StorageDescriptor{
 		Cols:                   columnsGlueToLocal(sd.Columns),
-		Location:               aws.StringValue(sd.Location),
-		InputFormat:            aws.StringValue(sd.InputFormat),
-		OutputFormat:           aws.StringValue(sd.OutputFormat),
-		Compressed:             aws.BoolValue(sd.Compressed),
-		NumBuckets:             int(aws.Int64Value(sd.NumberOfBuckets)),
+		Location:               aws.ToString(sd.Location),
+		InputFormat:            aws.ToString(sd.InputFormat),
+		OutputFormat:           aws.ToString(sd.OutputFormat),
+		Compressed:             sd.Compressed,
+		NumBuckets:             int(sd.NumberOfBuckets),
 		SerdeInfo:              serDeGlueToLocal(sd.SerdeInfo),
-		BucketCols:             aws.StringValueSlice(sd.BucketColumns),
+		BucketCols:             sd.BucketColumns,
 		SortCols:               sortColumnsGlueToLocal(sd.SortColumns),
-		Parameters:             aws.StringValueMap(sd.Parameters),
+		Parameters:             sd.Parameters,
 		SkewedInfo:             skewedGlueToLocal(sd.SkewedInfo),
-		StoredAsSubDirectories: sd.StoredAsSubDirectories,
+		StoredAsSubDirectories: aws.Bool(sd.StoredAsSubDirectories),
 		AWSSchemaReference:     sd.SchemaReference,
 	}
 }
 
 func localToAWSTime(t int64) *time.Time {
-	res := aws.MillisecondsTimeValue(aws.Int64(t))
-	return &res
+	tm := time.UnixMilli(t).UTC()
+	return &tm
 }
diff --git a/pkg/metastore/glue/metastore_client.go b/pkg/metastore/glue/metastore_client.go
index aadde209727..dbc653752b6 100644
--- a/pkg/metastore/glue/metastore_client.go
+++ b/pkg/metastore/glue/metastore_client.go
@@ -7,11 +7,9 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/glue"
-	"github.com/aws/aws-sdk-go/service/glue/glueiface"
-
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/glue"
+	"github.com/aws/aws-sdk-go-v2/service/glue/types"
 	"github.com/treeverse/lakefs/pkg/logging"
 	"github.com/treeverse/lakefs/pkg/metastore"
 	mserrors "github.com/treeverse/lakefs/pkg/metastore/errors"
@@ -20,7 +18,7 @@ import (
 const MaxParts = 1000 // max possible 1000
 
 type MSClient struct {
-	client          glueiface.GlueAPI
+	client          *glue.Client
 	catalogID       string
 	baseLocationURI string
 }
@@ -33,15 +31,12 @@ func (g *MSClient) NormalizeDBName(db string) string {
 	return db
 }
 
-func NewMSClient(cfg *aws.Config, catalogID, baselLocationURI string) (metastore.Client, error) {
-	sess := session.Must(session.NewSession(cfg))
-	sess.ClientConfig("glue")
-	gl := glue.New(sess)
+func NewMSClient(client *glue.Client, catalogID, baselLocationURI string) (metastore.Client, error) {
 	if catalogID == "" {
 		logging.ContextUnavailable().Warn("Glue catalog id is empty")
 	}
 	return &MSClient{
-		client:          gl,
+		client:          client,
 		catalogID:       catalogID,
 		baseLocationURI: strings.TrimRight(baselLocationURI, "/"),
 	}, nil
@@ -49,15 +44,15 @@ func NewMSClient(cfg *aws.Config, catalogID, baselLocationURI string) (metastore
 
 func (g *MSClient) HasTable(ctx context.Context, dbName string, tableName string) (bool, error) {
 	table, err := g.GetTable(ctx, dbName, tableName)
-	var noSuchObjectErr *glue.EntityNotFoundException // TODO(Guys): validate this one
-	if err != nil && !errors.As(err, &noSuchObjectErr) {
+	var errEnityNotFound *types.EntityNotFoundException // TODO(Guys): validate this one
+	if err != nil && !errors.As(err, &errEnityNotFound) {
 		return false, err
 	}
 	return table != nil, nil
 }
 
 func (g *MSClient) GetDatabase(ctx context.Context, name string) (*metastore.Database, error) {
-	db, err := g.client.GetDatabaseWithContext(ctx, &glue.GetDatabaseInput{
+	db, err := g.client.GetDatabase(ctx, &glue.GetDatabaseInput{
 		CatalogId: aws.String(g.catalogID),
 		Name:      aws.String(name),
 	})
@@ -68,11 +63,10 @@ func (g *MSClient) GetDatabase(ctx context.Context, name string) (*metastore.Dat
 }
 
 func (g *MSClient) getDatabaseFromGlue(ctx context.Context, token *string, parts int) (*glue.GetDatabasesOutput, error) {
-	return g.client.GetDatabasesWithContext(ctx, &glue.GetDatabasesInput{
-		CatalogId:         aws.String(g.catalogID),
-		MaxResults:        aws.Int64(int64(parts)),
-		NextToken:         token,
-		ResourceShareType: nil,
+	return g.client.GetDatabases(ctx, &glue.GetDatabasesInput{
+		CatalogId:  aws.String(g.catalogID),
+		MaxResults: aws.Int32(int32(parts)),
+		NextToken:  token,
 	})
 }
 
@@ -99,7 +93,7 @@ func (g *MSClient) GetDatabases(ctx context.Context, pattern string) ([]*metasto
 	return allDatabases, nil
 }
 
-func filterDatabases(databases []*glue.Database, pattern string) ([]*glue.Database, error) {
+func filterDatabases(databases []types.Database, pattern string) ([]types.Database, error) {
 	if pattern == "" {
 		return databases, nil
 	}
@@ -107,9 +101,9 @@ func filterDatabases(databases []*glue.Database, pattern string) ([]*glue.Databa
 	if err != nil {
 		return nil, err
 	}
-	res := make([]*glue.Database, 0)
+	res := make([]types.Database, 0)
 	for _, database := range databases {
-		if r.MatchString(aws.StringValue(database.Name)) {
+		if r.MatchString(aws.ToString(database.Name)) {
 			res = append(res, database)
 		}
 	}
@@ -120,11 +114,11 @@ func (g *MSClient) GetTables(ctx context.Context, dbName string, pattern string)
 	var nextToken *string
 	allTables := make([]*metastore.Table, 0)
 	for {
-		getTablesOutput, err := g.client.GetTablesWithContext(ctx, &glue.GetTablesInput{
+		getTablesOutput, err := g.client.GetTables(ctx, &glue.GetTablesInput{
 			CatalogId:    aws.String(g.catalogID),
 			DatabaseName: aws.String(dbName),
 			Expression:   aws.String(pattern),
-			MaxResults:   aws.Int64(MaxParts),
+			MaxResults:   aws.Int32(MaxParts),
 			NextToken:    nextToken,
 		})
 		if err != nil {
@@ -143,7 +137,7 @@ func (g *MSClient) GetTables(ctx context.Context, dbName string, pattern string)
 
 func (g *MSClient) AlterTable(ctx context.Context, dbName string, _ string, newTable *metastore.Table) error {
 	table := TableLocalToGlue(newTable)
-	_, err := g.client.UpdateTableWithContext(ctx, &glue.UpdateTableInput{
+	_, err := g.client.UpdateTable(ctx, &glue.UpdateTableInput{
 		CatalogId:    aws.String(g.catalogID),
 		DatabaseName: aws.String(dbName),
 		SkipArchive:  aws.Bool(false), // UpdateTable always creates an archived version of the table before updating it. However, if skipArchive is set to true, UpdateTable does not create the archived version.
@@ -153,10 +147,10 @@ func (g *MSClient) AlterTable(ctx context.Context, dbName string, _ string, newT
 }
 
 func (g *MSClient) DropPartition(ctx context.Context, dbName string, tableName string, values []string) error {
-	_, err := g.client.DeletePartitionWithContext(ctx, &glue.DeletePartitionInput{
+	_, err := g.client.DeletePartition(ctx, &glue.DeletePartitionInput{
 		CatalogId:       aws.String(g.catalogID),
 		DatabaseName:    aws.String(dbName),
-		PartitionValues: aws.StringSlice(values),
+		PartitionValues: values,
 		TableName:       aws.String(tableName),
 	})
 	return err
@@ -164,19 +158,19 @@ func (g *MSClient) DropPartition(ctx context.Context, dbName string, tableName s
 
 func (g *MSClient) CreateDatabase(ctx context.Context, database *metastore.Database) error {
 	databaseInput := DatabaseLocalToGlue(database)
-	_, err := g.client.CreateDatabaseWithContext(ctx, &glue.CreateDatabaseInput{
+	_, err := g.client.CreateDatabase(ctx, &glue.CreateDatabaseInput{
 		CatalogId:     aws.String(g.catalogID),
 		DatabaseInput: databaseInput,
 	})
-	var ErrExists *glue.AlreadyExistsException
-	if errors.As(err, &ErrExists) {
+	var errExists *types.AlreadyExistsException
+	if errors.As(err, &errExists) {
 		return mserrors.ErrSchemaExists
 	}
 	return err
 }
 
-func (g *MSClient) getTableData(ctx context.Context, dbName string, tblName string) (*glue.TableData, error) {
-	table, err := g.client.GetTableWithContext(ctx,
+func (g *MSClient) getTableData(ctx context.Context, dbName string, tblName string) (*types.Table, error) {
+	table, err := g.client.GetTable(ctx,
 		&glue.GetTableInput{
 			CatalogId:    aws.String(g.catalogID),
 			DatabaseName: aws.String(dbName),
@@ -199,7 +193,7 @@ func (g *MSClient) GetTable(ctx context.Context, dbName string, tableName string
 func (g *MSClient) CreateTable(ctx context.Context, tbl *metastore.Table) error {
 	table := TableLocalToGlue(tbl)
 	dbName := tbl.DBName
-	_, err := g.client.CreateTableWithContext(ctx,
+	_, err := g.client.CreateTable(ctx,
 		&glue.CreateTableInput{
 			CatalogId:    aws.String(g.catalogID),
 			DatabaseName: aws.String(dbName),
@@ -209,11 +203,11 @@ func (g *MSClient) CreateTable(ctx context.Context, tbl *metastore.Table) error
 }
 
 func (g *MSClient) GetPartition(ctx context.Context, dbName string, tableName string, values []string) (*metastore.Partition, error) {
-	output, err := g.client.GetPartitionWithContext(ctx,
+	output, err := g.client.GetPartition(ctx,
 		&glue.GetPartitionInput{
 			CatalogId:       aws.String(g.catalogID),
 			DatabaseName:    aws.String(dbName),
-			PartitionValues: aws.StringSlice(values),
+			PartitionValues: values,
 			TableName:       aws.String(tableName),
 		})
 	if err != nil {
@@ -232,19 +226,19 @@ func (g *MSClient) GetPartitions(ctx context.Context, dbName string, tableName s
 }
 
 func (g *MSClient) getPartitionsFromGlue(ctx context.Context, dbName, tableName string, nextToken *string, maxParts int16) (*glue.GetPartitionsOutput, error) {
-	return g.client.GetPartitionsWithContext(ctx,
+	return g.client.GetPartitions(ctx,
 		&glue.GetPartitionsInput{
 			CatalogId:    aws.String(g.catalogID),
 			DatabaseName: aws.String(dbName),
-			MaxResults:   aws.Int64(int64(maxParts)),
+			MaxResults:   aws.Int32(int32(maxParts)),
 			NextToken:    nextToken,
 			TableName:    aws.String(tableName),
 		})
 }
 
-func (g *MSClient) GetAllPartitions(ctx context.Context, dbName, tableName string) ([]*glue.Partition, error) {
+func (g *MSClient) GetAllPartitions(ctx context.Context, dbName, tableName string) ([]types.Partition, error) {
 	var nextToken *string
-	var allPartitions []*glue.Partition
+	var allPartitions []types.Partition
 	for {
 		getPartitionsOutput, err := g.getPartitionsFromGlue(ctx, dbName, tableName, nextToken, MaxParts)
 		if err != nil {
@@ -262,7 +256,7 @@ func (g *MSClient) GetAllPartitions(ctx context.Context, dbName, tableName strin
 
 func (g *MSClient) AddPartition(ctx context.Context, tableName string, dbName string, newPartition *metastore.Partition) error {
 	gluePartition := PartitionLocalToGlue(newPartition)
-	_, err := g.client.CreatePartitionWithContext(ctx,
+	_, err := g.client.CreatePartition(ctx,
 		&glue.CreatePartitionInput{
 			CatalogId:      aws.String(g.catalogID),
 			DatabaseName:   aws.String(dbName),
@@ -275,9 +269,9 @@ func (g *MSClient) AddPartition(ctx context.Context, tableName string, dbName st
 func (g *MSClient) AddPartitions(ctx context.Context, tableName string, dbName string, newParts []*metastore.Partition) error {
 	gluePartitions := PartitionsLocalToGlue(newParts)
 
-	partitionList := make([]*glue.PartitionInput, 0, len(gluePartitions))
+	partitionList := make([]types.PartitionInput, 0, len(gluePartitions))
 	for _, partition := range gluePartitions {
-		partitionList = append(partitionList, &glue.PartitionInput{
+		partitionList = append(partitionList, types.PartitionInput{
 			LastAccessTime:    partition.LastAccessTime,
 			LastAnalyzedTime:  partition.LastAnalyzedTime,
 			Parameters:        partition.Parameters,
@@ -285,7 +279,7 @@ func (g *MSClient) AddPartitions(ctx context.Context, tableName string, dbName s
 			Values:            partition.Values,
 		})
 	}
-	_, err := g.client.BatchCreatePartitionWithContext(ctx,
+	_, err := g.client.BatchCreatePartition(ctx,
 		&glue.BatchCreatePartitionInput{
 			CatalogId:          aws.String(g.catalogID),
 			DatabaseName:       aws.String(dbName),
@@ -300,7 +294,7 @@ func (g *MSClient) AlterPartition(ctx context.Context, dbName string, tableName
 	// No batch alter partitions we will need to do it one by one
 	gluePartition := PartitionLocalToGlue(partition)
 
-	_, err := g.client.UpdatePartitionWithContext(ctx,
+	_, err := g.client.UpdatePartition(ctx,
 		&glue.UpdatePartitionInput{
 			CatalogId:          aws.String(g.catalogID),
 			DatabaseName:       aws.String(dbName),
diff --git a/pkg/metastore/metastore.go b/pkg/metastore/metastore.go
index 4a9d3eac146..25c2725a535 100644
--- a/pkg/metastore/metastore.go
+++ b/pkg/metastore/metastore.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/service/glue"
+	"github.com/aws/aws-sdk-go-v2/service/glue/types"
 	"github.com/davecgh/go-spew/spew"
 	"github.com/treeverse/lakefs/pkg/logging"
 )
@@ -115,7 +115,7 @@ type Database struct {
 	HivePrivileges    interface{}
 	OwnerName         *string
 	HiveOwnerType     interface{}
-	AWSTargetDatabase *glue.DatabaseIdentifier
+	AWSTargetDatabase *types.DatabaseIdentifier
 }
 
 type Table struct {
diff --git a/pkg/pyramid/tier_fs_test.go b/pkg/pyramid/tier_fs_test.go
index 7b61657af4a..fe7f08f6b62 100644
--- a/pkg/pyramid/tier_fs_test.go
+++ b/pkg/pyramid/tier_fs_test.go
@@ -3,8 +3,8 @@ package pyramid
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
 	"io"
-	"math/rand"
 	"os"
 	"path"
 	"path/filepath"
@@ -145,7 +145,10 @@ func testEviction(t *testing.T, namespaces ...string) {
 	content := make([]byte, fileBytes)
 	for i := 0; i < numFiles; i++ {
 		filename := "file_" + strconv.Itoa(i)
-		rand.Read(content)
+		_, err := rand.Read(content)
+		if err != nil {
+			t.Fatal("rand.Read", err)
+		}
 		writeToFile(t, ctx, namespaces[i%len(namespaces)], filename, content)
 	}
 
@@ -169,7 +172,7 @@ func TestMultipleConcurrentReads(t *testing.T) {
 
 	defer func() { _ = os.RemoveAll(baseDir) }()
 
-	// write a single file to lookup later
+	// write a single file to look up later
 	namespace := uniqueNamespace()
 	filename := "1/2/file1.txt"
 	content := []byte("hello world!")
@@ -183,7 +186,7 @@ func TestMultipleConcurrentReads(t *testing.T) {
 		return nil
 	})
 	require.NoError(t, err)
-	// try to read that file - only a single access to block storage is expected
+	// try to read that file - only single access to block storage is expected
 	const concurrencyLevel = 50
 	adapter.wait = make(chan struct{})
 	var wg sync.WaitGroup
diff --git a/pkg/stats/collector.go b/pkg/stats/collector.go
index 6f0608b94f8..5e201dc429a 100644
--- a/pkg/stats/collector.go
+++ b/pkg/stats/collector.go
@@ -346,7 +346,7 @@ func (s *BufferedCollector) Stop() {
 		return
 	}
 
-	// wait until no new  in-flight requests
+	// wait until no new in-flight requests
 	s.inFlight.Wait()
 
 	// close update channel as no more updates will arrive,
@@ -407,15 +407,16 @@ func (s *BufferedCollector) CollectCommPrefs(email, installationID string, featu
 	}
 	ctx := context.Background()
 	err := s.sender.UpdateCommPrefs(ctx, commPrefs)
-	eventName := "update_comm_prefs_success"
+	ev := Event{
+		Class: "global",
+	}
 	if err != nil {
 		s.log.WithError(err).Info("could not update comm prefs")
-		eventName = "update_comm_prefs_failed"
+		ev.Name = "update_comm_prefs_failed"
+	} else {
+		ev.Name = "update_comm_prefs_success"
 	}
-	s.CollectEvent(Event{
-		Class: "global",
-		Name:  eventName,
-	})
+	s.CollectEvent(ev)
 }
 
 func (s *BufferedCollector) SetInstallationID(installationID string) {
diff --git a/pkg/stats/metadata.go b/pkg/stats/metadata.go
index 8901fddecae..b22a6087e70 100644
--- a/pkg/stats/metadata.go
+++ b/pkg/stats/metadata.go
@@ -56,22 +56,23 @@ func (n *noopMetadataProvider) GetMetadata() map[string]string {
 }
 
 func BuildMetadataProvider(logger logging.Logger, c *config.Config) cloud.MetadataProvider {
-	var provider cloud.MetadataProvider
 	switch c.Blockstore.Type {
 	case block.BlockstoreTypeGS:
-		provider = gcp.NewMetadataProvider(logger)
+		return gcp.NewMetadataProvider(logger)
 	case block.BlockstoreTypeS3:
 		s3Params, err := c.BlockstoreS3Params()
 		if err != nil {
 			logger.WithError(err).Warn("Failed to create S3 client for MetadataProvider")
-		} else {
-			provider = aws.NewMetadataProvider(logger, s3Params.AwsConfig)
+			return &noopMetadataProvider{}
 		}
+		provider, err := aws.NewMetadataProvider(logger, s3Params)
+		if err != nil {
+			logger.WithError(err).Warn("Failed to create S3 client for MetadataProvider")
+			return &noopMetadataProvider{}
+		}
+		return provider
 	case block.BlockstoreTypeAzure:
-		provider = azure.NewMetadataProvider(logger)
-	}
-	if provider == nil {
-		return &noopMetadataProvider{}
+		return azure.NewMetadataProvider(logger)
 	}
-	return provider
+	return &noopMetadataProvider{}
 }
diff --git a/pkg/testutil/db.go b/pkg/testutil/db.go
index caa3451f8d5..54671172b34 100644
--- a/pkg/testutil/db.go
+++ b/pkg/testutil/db.go
@@ -10,16 +10,14 @@ import (
 	"testing"
 
 	"cloud.google.com/go/storage"
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/jackc/pgx/v5/pgxpool"
 	_ "github.com/jackc/pgx/v5/stdlib"
 	"github.com/ory/dockertest/v3"
 	"github.com/treeverse/lakefs/pkg/block"
 	"github.com/treeverse/lakefs/pkg/block/gs"
 	"github.com/treeverse/lakefs/pkg/block/mem"
-	lakefsS3 "github.com/treeverse/lakefs/pkg/block/s3"
+	"github.com/treeverse/lakefs/pkg/block/params"
+	blocks3 "github.com/treeverse/lakefs/pkg/block/s3"
 )
 
 const (
@@ -155,9 +153,9 @@ func MustDo(t testing.TB, what string, err error) {
 }
 
 func NewBlockAdapterByType(t testing.TB, blockstoreType string) block.Adapter {
+	ctx := context.Background()
 	switch blockstoreType {
 	case block.BlockstoreTypeGS:
-		ctx := context.Background()
 		client, err := storage.NewClient(ctx)
 		if err != nil {
 			t.Fatal("Google Storage new client", err)
@@ -165,22 +163,23 @@ func NewBlockAdapterByType(t testing.TB, blockstoreType string) block.Adapter {
 		return gs.NewAdapter(client)
 
 	case block.BlockstoreTypeS3:
-		awsRegion, regionOk := os.LookupEnv(envKeyAwsRegion)
-		if !regionOk {
-			awsRegion = "us-east-1"
-		}
-		cfg := &aws.Config{
-			Region: aws.String(awsRegion),
+		var s3Params params.S3
+		if awsRegion, ok := os.LookupEnv(envKeyAwsRegion); ok {
+			s3Params.Region = awsRegion
+		} else {
+			s3Params.Region = "us-east-1"
 		}
-		awsSecret, secretOk := os.LookupEnv(envKeyAwsSecretKey)
 		awsKey, keyOk := os.LookupEnv(envKeyAwsKeyID)
+		awsSecret, secretOk := os.LookupEnv(envKeyAwsSecretKey)
 		if keyOk && secretOk {
-			cfg.Credentials = credentials.NewStaticCredentials(awsKey, awsSecret, "")
-		} else {
-			cfg.Credentials = credentials.NewSharedCredentials("", "default")
+			s3Params.Credentials.AccessKeyID = awsKey
+			s3Params.Credentials.SecretAccessKey = awsSecret
+		}
+		blockAdapter, err := blocks3.NewAdapter(ctx, s3Params)
+		if err != nil {
+			t.Fatal("Failed to create S3 block adapter", err)
 		}
-		sess := session.Must(session.NewSession(cfg))
-		return lakefsS3.NewAdapter(sess)
+		return blockAdapter
 
 	default:
 		return mem.New(context.Background())
diff --git a/pkg/testutil/dynamodb.go b/pkg/testutil/dynamodb.go
index 670b9657af3..7b47cd1f1dc 100644
--- a/pkg/testutil/dynamodb.go
+++ b/pkg/testutil/dynamodb.go
@@ -20,8 +20,6 @@ const (
 	DynamodbLocalURI          = "http://localhost:6432"
 	chars                     = "abcdef1234567890"
 	charsSize                 = 8
-	DynamoDBReadCapacity      = 1000
-	DynamoDBWriteCapacity     = 1000
 	DynamoDBScanLimit         = 10
 )
 
@@ -59,9 +57,9 @@ func GetDynamoDBInstance() (string, func(), error) {
 	}
 
 	err = dockerPool.Retry(func() error {
-		// waiting for dynamodb container to be ready by issuing an HTTP get request with
-		// exponential backoff retry. The response is not really meaningful for that case
-		// and so is ignored
+		// Waiting for dynamodb container to be ready by issuing an HTTP get request with
+		// exponential backoff retry.
+		// The response is not really meaningful for that case and so is ignored.
 		resp, err := http.Get(DynamodbLocalURI)
 		if err != nil {
 			return err
diff --git a/pkg/testutil/setup.go b/pkg/testutil/setup.go
index 517655524e5..48f6481bc72 100644
--- a/pkg/testutil/setup.go
+++ b/pkg/testutil/setup.go
@@ -9,10 +9,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/deepmap/oapi-codegen/pkg/securityprovider"
 	"github.com/spf13/viper"
 	"github.com/treeverse/lakefs/pkg/api/apigen"
@@ -33,7 +33,7 @@ type SetupTestingEnvParams struct {
 	AdminSecretAccessKey string
 }
 
-func SetupTestingEnv(params *SetupTestingEnvParams) (logging.Logger, apigen.ClientWithResponsesInterface, *s3.S3, string) {
+func SetupTestingEnv(params *SetupTestingEnvParams) (logging.Logger, apigen.ClientWithResponsesInterface, *s3.Client, string) {
 	logger := logging.ContextUnavailable()
 	viper.AddConfigPath(".")
 	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_")) // support nested config
@@ -112,35 +112,38 @@ func SetupTestingEnv(params *SetupTestingEnvParams) (logging.Logger, apigen.Clie
 		viper.Set("secret_access_key", params.AdminSecretAccessKey)
 	}
 
-	client, err = NewClientFromCreds(logger, viper.GetString("access_key_id"), viper.GetString("secret_access_key"), endpointURL)
+	key := viper.GetString("access_key_id")
+	secret := viper.GetString("secret_access_key")
+	client, err = NewClientFromCreds(logger, key, secret, endpointURL)
 	if err != nil {
 		logger.WithError(err).Fatal("could not initialize API client with security provider")
 	}
 
 	s3Endpoint := viper.GetString("s3_endpoint")
-	key := viper.GetString("access_key_id")
-	secret := viper.GetString("secret_access_key")
-	svc := SetupTestS3Client(s3Endpoint, key, secret)
+	svc, err := SetupTestS3Client(s3Endpoint, key, secret)
+	if err != nil {
+		logger.WithError(err).Fatal("could not initialize S3 client")
+	}
 	return logger, client, svc, endpointURL
 }
 
-func SetupTestS3Client(endpoint, key, secret string) *s3.S3 {
-	awsSession := session.Must(session.NewSession())
+func SetupTestS3Client(endpoint, key, secret string) (*s3.Client, error) {
+	if !strings.HasPrefix(endpoint, "http") {
+		endpoint = "http://" + endpoint
+	}
+	cfg, err := awsconfig.LoadDefaultConfig(context.Background(),
+		awsconfig.WithRegion("us-east-1"),
+		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(key, secret, "")),
+	)
+	if err != nil {
+		return nil, err
+	}
 	forcePathStyleS3Client := viper.GetBool("force_path_style")
-	svc := s3.New(awsSession,
-		aws.NewConfig().
-			WithRegion("us-east-1").
-			WithEndpoint(endpoint).
-			WithS3ForcePathStyle(forcePathStyleS3Client).
-			WithDisableSSL(true).
-			WithCredentials(credentials.NewCredentials(
-				&credentials.StaticProvider{
-					Value: credentials.Value{
-						AccessKeyID:     key,
-						SecretAccessKey: secret,
-					},
-				})))
-	return svc
+	svc := s3.NewFromConfig(cfg, func(options *s3.Options) {
+		options.BaseEndpoint = aws.String(endpoint)
+		options.UsePathStyle = forcePathStyleS3Client
+	})
+	return svc, nil
 }
 
 // ParseEndpointURL parses the given endpoint string