Support AWS default credential provider chain for OpenSearch client SigV4 signing

[jheimbach]

Affected capability

Other

Feature description

The opensearch client factory only signs requests with static aws_key/aws_secret from config — there's no way to use the AWS default credential provider chain (instance role, ECS task role, EKS IRSA), which is the recommended way to talk to AWS OpenSearch Service.

When aws_region is set but aws_key/aws_secret aren't, no signing happens at all (src/OpenSearchClientFactory.php, lines 63–68):

if (isset($config['aws_key'], $config['aws_secret'])) {
    $clientBuilder->setSigV4CredentialProvider([
        'key' => $config['aws_key'],
        'secret' => $config['aws_secret'],
    ]);
}

Requests go out unsigned; AWS OpenSearch Service rejects with:

Authorization header requires 'Credential' parameter.
Authorization header requires 'Signature' parameter.
Authorization header requires 'SignedHeaders' parameter.
Authorization header requires existence of either a 'X-Amz-Date' or a 'Date' header.

Suggested fix

Backwards-compatible: when aws_region is set without credentials, fall back to setSigV4CredentialProvider(true) — the boolean form that the underlying opensearch-php SDK already documents as the way to activate Aws\Credentials\CredentialProvider::defaultProvider().

if (isset($config['aws_region'])) {
    $clientBuilder->setSigV4Region($config['aws_region']);
    $clientBuilder->setSigV4Service($config['aws_service'] ?? 'es');

    if (isset($config['aws_key'], $config['aws_secret'])) {
        $clientBuilder->setSigV4CredentialProvider([
            'key' => $config['aws_key'],
            'secret' => $config['aws_secret'],
        ]);
    } else {
        $clientBuilder->setSigV4CredentialProvider(true);
    }
}

I'd happily send a PR for the upstream fix + tests — just say the word.