feat: add cross-account IAM role support for S3 operations and update docs/tests

[nasudadada]

Brief

• Add cross-account IAM role support to S3 modules (role_arn/external_id)
• Update tests and docs accordingly

Points to Check

• role_arn must not be combined with keys or profile

Test

• Local E2E (A→B with external_id):
  • Upload → Exists → Download → DownloadFileDelete → Upload → Delete

Review Limit

• None

Fixes: #462

[skxeve]

Hi, it seems that our CI build is failing after the dependency packages were updated.
Would you mind syncing your branch with the latest master and ensuring that all CI checks pass? I appreciate your help.

[nasudadada]

Hi, it seems that our CI build is failing after the dependency packages were updated. Would you mind syncing your branch with the latest master and ensuring that all CI checks pass? I appreciate your help.

@skxeve
Thank you for the heads-up. I’ve synced the branch with the latest master and fixed the failing tests caused by the dependency updates.

[skxeve]

Overall, the logic looks good, but I've left a few comments with some refactoring suggestions.
Please take a look and either make the changes or let me know your thoughts on them. I look forward to your response.

[skxeve]

I understand you'd like to check for a state where only one of three is specified. Is that correct?
In Python, since a bool is also an int, it would be smarter to check the three boolean conditions at once, like A + B + C == 1.

[nasudadada]

Thanks! Your interpretation is correct.
I updated the validation to allow “at most one” auth method (zero or one). access_key+secret_key count as one, and profile and role_arn each count as one. Does this match your intent?

[skxeve]

This function seems to share a lot of logic with the preceding _get_cross_account_client function.
Wouldn't it be better to refactor them into a single function and use a parameter to handle the different cases? If there's a reason for keeping them separate, I'd appreciate it if you could let me know.

[nasudadada]

Thanks for calling this out — you’re right, these two functions share most of the logic.
I’ve refactored to extract the common part into a helper that builds the cross-account session, and then use a single function that switches by a parameter.

[skxeve]

LGTM! Thank you for your contribution.