Add native OIDC authentication support to Modal cloud bucket mounts

[dabao12321]

Add OIDC support for Modal cloud bucket mounts

Modal supports CloudBucketMount(oidc_auth_role_arn=...), but the Agents SDK ModalCloudBucketMountStrategy only supports static credentials or a named Modal Secret.

Some deployments cannot create long-lived AWS keys and instead require Modal to assume an IAM role through OIDC.

Could the adapter support:

ModalCloudBucketMountStrategy(
    oidc_auth_role_arn="arn:aws:iam::123456789012:role/modal-s3-reader",
)

The role ARN should pass through ModalCloudBucketMountConfig into:

modal.CloudBucketMount(
    ...,
    oidc_auth_role_arn=config.oidc_auth_role_arn,
)

OIDC should be mutually exclusive with secret_name and inline credentials. Existing Secret-backed behavior should remain unchanged.

[teachershuang]

Hi, I would like to work on this.

I verified that current main models only inline credentials or a named Modal Secret, while the locked Modal SDK supports oidc_auth_role_arn on CloudBucketMount. I plan to append an optional role ARN to ModalCloudBucketMountStrategy and ModalCloudBucketMountConfig, pass it through when creating the native Modal mount, and keep existing credential behavior unchanged.

The validation will reject an empty ARN, combinations with secret_name or inline credentials, and use on non-S3 mounts. I will add focused coverage for manifest parsing, config construction, the provider call, and the mutual-exclusion/error paths. I found no assignee or open implementation PR for this scope.

[seratch]

Thanks for raising this. For now, we recommend creating the Modal sandbox with the OIDC-authenticated CloudBucketMount in application-controlled code and passing it to ModalSandboxClient through ModalSandboxSelector.from_sandbox(...). This keeps role selection within the existing trusted application and Modal boundary without expanding manifest persistence and resume authority semantics.

We will leave this issue open because native SDK-managed support may still be worth considering longer term. However, we do not expect to prioritize or actively review external implementation PRs for this in the near term, so please hold off on submitting a PR for now. We can revisit this once we have clearer requirements for manifest-driven creation, persistence, and resume behavior.