AWS credentials, in the two flavours the platform actually offers.
assumed_role mints an STS session: short, narrowable to a bucket and
prefix by a session policy, and impossible to revoke. iam_user mints a
throwaway IAM user with one access key, mirroring the Postgres engine's
create/drop pattern: long-lived until deleted, but genuinely revocable.
Those are different promises, so a credential declares its own guarantees
rather than inheriting this engine's headline shape — see
GeneratedCredential::with_shape.
See docs/delegation/aws.md for the mechanism and
docs/delegation/setup/aws.md for the operator walkthrough.