diff --git a/.editorconfig b/.editorconfig
index 774fd201ef8d..15f919078a15 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -226,5 +226,8 @@ indent_size = 2
[*.{xsd,xml}]
indent_size = 4
+[verification-metadata.xml]
+indent_size = 3
+
[*.{csv,sql}-spec]
trim_trailing_whitespace = false
diff --git a/build-tools-internal/version.properties b/build-tools-internal/version.properties
index cb5f385bf3f5..a0341c9c5035 100644
--- a/build-tools-internal/version.properties
+++ b/build-tools-internal/version.properties
@@ -18,7 +18,7 @@ netty = 4.1.118.Final
commons_lang3 = 3.9
google_oauth_client = 1.34.1
awsv1sdk = 1.12.746
-awsv2sdk = 2.28.13
+awsv2sdk = 2.30.38
reactive_streams = 1.0.4
antlr4 = 4.13.1
diff --git a/docs/changelog/124738.yaml b/docs/changelog/124738.yaml
new file mode 100644
index 000000000000..dd2d20af5e7e
--- /dev/null
+++ b/docs/changelog/124738.yaml
@@ -0,0 +1,5 @@
+pr: 124738
+summary: Upgrade AWS v2 SDK to 2.30.38
+area: Machine Learning
+type: upgrade
+issues: []
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 8a2ae18cd3d1..328b696ebf67 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -4679,129 +4679,129 @@
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
diff --git a/x-pack/plugin/inference/build.gradle b/x-pack/plugin/inference/build.gradle
index cb3ccbd17130..283abf123900 100644
--- a/x-pack/plugin/inference/build.gradle
+++ b/x-pack/plugin/inference/build.gradle
@@ -391,8 +391,6 @@ tasks.named("thirdPartyAudit").configure {
'software.amazon.awssdk.crt.auth.signing.AwsSigningConfig$AwsSignedBodyHeaderType',
'software.amazon.awssdk.crt.auth.signing.AwsSigningConfig$AwsSigningAlgorithm',
'software.amazon.awssdk.crt.auth.signing.AwsSigningResult',
- 'software.amazon.awssdk.crt.checksums.CRC32',
- 'software.amazon.awssdk.crt.checksums.CRC32C',
'software.amazon.awssdk.crt.http.HttpHeader',
'software.amazon.awssdk.crt.http.HttpRequest',
'software.amazon.awssdk.crt.http.HttpRequestBodyStream',
diff --git a/x-pack/plugin/inference/src/main/plugin-metadata/entitlement-policy.yaml b/x-pack/plugin/inference/src/main/plugin-metadata/entitlement-policy.yaml
index 641f68985a71..36ac851acf1e 100644
--- a/x-pack/plugin/inference/src/main/plugin-metadata/entitlement-policy.yaml
+++ b/x-pack/plugin/inference/src/main/plugin-metadata/entitlement-policy.yaml
@@ -22,14 +22,3 @@ io.netty.common:
io.netty.transport:
- manage_threads
- outbound_network
-# AWS Clients always try to access the credentials and config files, even if we configure otherwise
-# This should be "fixed" (as in, it will handle SecurityException correctly)
-# by https://github.com/aws/aws-sdk-java-v2/pull/5904. Once confirmed and libraries are updated, these could be removed.
-software.amazon.awssdk.profiles:
- - files:
- - relative_path: .aws/credentials
- relative_to: home
- mode: read
- - relative_path: .aws/config
- relative_to: home
- mode: read
diff --git a/x-pack/plugin/inference/src/main/plugin-metadata/plugin-security.policy b/x-pack/plugin/inference/src/main/plugin-metadata/plugin-security.policy
index 8ec8ff9ad4dd..e36b553d2def 100644
--- a/x-pack/plugin/inference/src/main/plugin-metadata/plugin-security.policy
+++ b/x-pack/plugin/inference/src/main/plugin-metadata/plugin-security.policy
@@ -22,8 +22,6 @@ grant {
// also, AWS Bedrock client opens socket connections and needs resolve for to access to resources
permission java.net.SocketPermission "*", "connect,resolve";
- // AWS Clients always try to access the credentials and config files, even if we configure otherwise
- permission java.io.FilePermission "${user.home}/.aws/credentials", "read";
- permission java.io.FilePermission "${user.home}/.aws/config", "read";
+ // AWS Clients always try to check the http.proxyHost system property
permission java.util.PropertyPermission "http.proxyHost", "read";
};