[dagnir]

Motivation

S3Presigner built a new S3 Express auth scheme, with its own empty session cache, on every presign call. Each presign for a directory bucket made a blocking CreateSession call and started a background refresh that nothing ever stopped. A long-running application that presigns S3 Express URLs leaked one refresh loop per presign call and sent growing CreateSession traffic.

Changes

1. Add UncachedS3ExpressAuthScheme, an internal S3 Express auth scheme whose identity provider calls CreateSession on every identity resolution, with no cache and no background refresh.
2. S3Presigner uses this scheme for directory buckets, so a presign call leaves nothing running after it returns.
3. Extract the CreateSession call in S3ExpressIdentityCache into a static createSession(key) so both paths share it.
4. Add a bugfix changelog entry for Amazon S3.

Compatibility

1. Each presigned URL still gets a session from its own CreateSession call, the same as before, so URLs keep the full session lifetime (about 5 minutes).
2. Each presign for a directory bucket still makes one blocking CreateSession call. This matches the current behavior.
3. S3Client and its session cache are unchanged.

Testing

A new unit test class uses a mocked S3Client whose CreateSession returns a distinct token each call, with credentials that expire about 62 seconds out. A cached session would refresh in the background within a few seconds. Two tests cover the change:

• Three presigns of one directory bucket call CreateSession three times, and each URL carries its own session token.
• After one presign, no further CreateSession call happens within 6 seconds.

The existing presigner and S3 Express unit tests pass.

Alternatives Considered

1. Share one session cache per presigner and close it in S3Presigner.close(). This fixes the leak, but presigns reuse a cached session until it refreshes about 60 seconds before it expires. A URL could then be valid for only about a minute, or about 15 seconds if the background refresh is skipped, even when signatureDuration asks for more.
2. Close the per-call cache at the end of each presign. This has the same CreateSession cost as this change, but it still builds a cache and schedules a refresh only to cancel it.
3. Reuse the session cache of the presigner's S3Client. The client does not expose its auth schemes, and the presigner would use a cache it does not own.