feat: support per-source AWS profiles

[deinspanjer]

Summary

• Add optional aws_profile configuration for AWS RDS IAM-authenticated sources.
• Resolve an explicitly configured profile through the AWS shared-config provider.
• Fail closed when the named profile is missing or cannot provide credentials, preventing fallback to an unintended AWS identity.
• Preserve the existing AWS SDK default credential chain when aws_profile is omitted.
• Validate that aws_profile is non-empty and only used with aws_iam_auth = true.
• Forward the selected profile through connection creation and IAM token refresh.
• Include the credential-provider dependency in normal builds while preserving MCPB packaging behavior.
• Document the configuration and security decision.

Security behavior

An explicitly configured aws_profile is authoritative. If that profile cannot resolve credentials, DBHub reports an authentication failure rather than falling through to environment, container, or instance credentials.

Sources without aws_profile retain the existing default credential-chain behavior.

Testing

• pnpm test:unit — 962 tests passed
• pnpm run build
• pnpm run test:build — 6 connector checks passed
• pnpm run build:mcpb
• pnpm run test:mcpb

Manual validation also succeeded with two AWS shared-config profiles using credential_process against Aurora PostgreSQL endpoints.

[Copilot]

Pull request overview

Adds strict, per-source AWS profile selection for RDS IAM authentication while retaining the default credential chain when omitted.

Changes:

• Validates and forwards aws_profile during token generation and refresh.
• Adds credential-provider packaging and build configuration.
• Adds tests and configuration/security documentation.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tsup.config.ts	Externalizes the credential provider.
src/utils/aws-rds-signer.ts	Resolves named AWS profiles.
src/utils/__tests__/aws-rds-signer.test.ts	Tests profile provider selection.
src/types/config.ts	Adds the profile configuration field.
src/connectors/manager.ts	Forwards profiles during token creation.
src/connectors/__tests__/manager.test.ts	Tests profile forwarding.
src/config/toml-loader.ts	Validates profile configuration.
src/config/__tests__/toml-loader.test.ts	Covers profile validation.
scripts/build-mcpb.mjs	Excludes cloud credentials from MCPB.
package.json	Declares the credential provider dependency.
pnpm-lock.yaml	Locks the new dependency.
docs/config/toml.mdx	Documents AWS IAM profile configuration.
docs/adr/0001-strict-per-source-aws-profiles.md	Records the security decision.
dbhub.toml.example	Adds profile examples.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tianzhou]

LGTM. Thanks for the contribution.