A lakehouse spine: Trino, Iceberg and Polaris, with credentials that expire
Build Trino 483 on Iceberg with Apache Polaris as the REST catalog, then prove the vended S3 credentials cannot read the table next door.
~45 min to a working stack; the credential-vending section is the part that takes the time