Added S3 support: --aws-profile, --include-extensions, --exclude-extensions

[ustayready]

Description:

Explain the purpose of the PR.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Medium risk because it changes S3 credential resolution (introducing shared profile support and altering how credentials providers are configured), which could affect access/assume-role behavior and scan coverage; also adds new filtering that can skip objects if misconfigured.

Overview
Adds new S3 scan configuration and CLI flags for AWS shared credentials profile (--aws-profile/AWS_PROFILE) and object key extension filtering (--include-extensions/--exclude-extensions).

Updates the S3 scan pipeline end-to-end (CLI → sources.S3Config → protobuf sourcespb.S3 → S3 source) to enforce mutual exclusivity between profile/static creds/cloud creds and between include/exclude extension lists, and to skip S3 objects based on the configured extension filter during enumeration.

Also updates generated protobuf outputs and ignores .claude in .gitignore.

^{Reviewed by Cursor Bugbot for commit 7135cca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 7135cca. Configure here.}

[cursor]

AWS_PROFILE env var breaks existing --cloud-environment usage

High Severity

The --aws-profile flag binds to AWS_PROFILE via .Envar("AWS_PROFILE"). Since AWS_PROFILE is a standard, widely-set AWS environment variable, any user who has it configured will now get an error when using --cloud-environment, because the validation in ScanS3 rejects hasProfile && c.CloudCred. Previously, AWS_PROFILE was transparently handled by the AWS SDK's default credential chain and didn't conflict with --cloud-environment. This is a regression that breaks existing workflows.

Additional Locations (1)

• pkg/engine/s3.go#L25-L27

 

^{Reviewed by Cursor Bugbot for commit 7135cca. Configure here.}