fix(auth): fail fast on empty SigV4 credentials; fix stale CI comment

Author: plusplusjiajia

.github/workflows/aws_test.yml

@@ -16,8 +16,8 @@
 # under the License.
 
 # AWS-related tests. ICEBERG_S3 and ICEBERG_SIGV4 are exercised individually and
-# together; with both on, Arrow's S3 reuses SigV4's system AWS SDK
-# (AWSSDK_SOURCE=SYSTEM) so a single AWS SDK is linked (no ODR).
+# together; with both on, ICEBERG_AWSSDK_SOURCE defaults to BUNDLED so SigV4
+# reuses Arrow's bundled aws-cpp-sdk-core — a single AWS SDK is linked (no ODR).
 name: AWS Tests
 
 on:

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

@@ -430,6 +430,17 @@ Result<std::shared_ptr<AuthSession>> SigV4AuthManager::WrapSession(
   } else {
     ICEBERG_ASSIGN_OR_RAISE(credentials, MakeCredentialsProvider(properties));
   }
+  // Fail fast when the provider cannot resolve credentials (e.g. an empty
+  // default chain) instead of sending an effectively unsigned request later.
+  if (credentials->GetAWSCredentials().IsEmpty()) {
+    return std::unexpected<Error>(
+        Error{.kind = ErrorKind::kAuthenticationFailed,
+              .message = "SigV4: AWS credentials provider returned empty credentials; "
+                         "set '" +
+                         AuthProperties::kSigV4AccessKeyId + "' and '" +
+                         AuthProperties::kSigV4SecretAccessKey +
+                         "' or configure the AWS credentials chain"});
+  }
   auto session =
       std::make_shared<SigV4AuthSession>(std::move(delegate_session), std::move(region),
                                          std::move(service), std::move(credentials));