Fall back to AWS credential chain (IAM role) for DynamoDB when no keys set (#1285) (#1289)

DynamoDBConnection always built the client via
new AmazonDynamoDBClient(mCredentials, mConfig). When the datastore's
User_id / User_password properties are left empty (to authenticate via the
EC2 instance's IAM role), mCredentials is null and passing it explicitly
prevents the AWS SDK from using its default credential resolution chain, so
requests go out unsigned and fail with "Request is missing Authentication
Token".

Mirror what ExternalProviderS3 already does:

- Only build BasicAWSCredentials when both User_id and User_password are
  present AND non-empty (previously a present-but-empty value produced empty
  credentials).
- When there are no explicit credentials, use the config-only constructor
  new AmazonDynamoDBClient(mConfig), which engages the default credential
  chain (incl. the EC2 instance profile / IAM role).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: claudiamurialdo

dotnet/src/dotnetcommon/DynService.Dynamo/DynamoDBConnection.cs

@@ -52,7 +52,8 @@ private void InitializeDBConnection()
 			{
 				mLocalUrl = localUrl.ToString();
 			}
-			if (builder.TryGetValue(CLIENT_ID, out object clientId) && builder.TryGetValue(CLIENT_SECRET, out object clientSecret))
+			if (builder.TryGetValue(CLIENT_ID, out object clientId) && builder.TryGetValue(CLIENT_SECRET, out object clientSecret)
+				&& !string.IsNullOrEmpty(clientId?.ToString()) && !string.IsNullOrEmpty(clientSecret?.ToString()))
 			{
 				mCredentials = new BasicAWSCredentials(clientId.ToString(), clientSecret.ToString());
 			}
@@ -75,7 +76,12 @@ private void Initialize()
 		{
 			InitializeDBConnection();
 			State = ConnectionState.Executing;
-			mDynamoDB = new AmazonDynamoDBClient(mCredentials, mConfig);
+			// When no explicit credentials are provided, use the config-only constructor so the
+			// AWS default credential resolution chain (incl. the EC2 instance profile / IAM role)
+			// kicks in, mirroring how ExternalProviderS3 builds its client.
+			mDynamoDB = mCredentials != null
+				? new AmazonDynamoDBClient(mCredentials, mConfig)
+				: new AmazonDynamoDBClient(mConfig);
 		}
 
 		private const string FILTER_PATTERN = @"\((.*) = :(.*)\)";