Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable FIPS and DualStack endpoint configuration #88

Merged
merged 4 commits into from
Jan 28, 2022
Merged

Enable FIPS and DualStack endpoint configuration #88

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
420da52
Removes unused test parts
gdavison Jan 25, 2022
e35db66
Updates dependencies
gdavison Jan 26, 2022
faee4e3
Adds support for FIPS and DualStack endpoints
gdavison Jan 26, 2022
81496a9
Go module cleanup
gdavison Jan 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion aws_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ func commonLoadOptions(c *Config) ([]func(*config.LoadOptions) error, error) {

loadOptions := []func(*config.LoadOptions) error{
config.WithRegion(c.Region),
config.WithEndpointResolver(endpointResolver(c)),
config.WithEndpointResolverWithOptions(endpointResolver(c)),
config.WithHTTPClient(httpClient),
config.WithAPIOptions(apiOptions),
}
Expand Down Expand Up @@ -175,5 +175,17 @@ func commonLoadOptions(c *Config) ([]func(*config.LoadOptions) error, error) {
os.Setenv("AWS_EC2_METADATA_DISABLED", "true")
}

if c.UseDualStackEndpoint {
loadOptions = append(loadOptions,
config.WithUseDualStackEndpoint(aws.DualStackEndpointStateEnabled),
)
}

if c.UseFIPSEndpoint {
loadOptions = append(loadOptions,
config.WithUseFIPSEndpoint(aws.FIPSEndpointStateEnabled),
)
}

return loadOptions, nil
}
256 changes: 237 additions & 19 deletions aws_config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ import (
smithyhttp "github.com/aws/smithy-go/transport/http"
"github.com/google/go-cmp/cmp"
"github.com/google/go-cmp/cmp/cmpopts"
"github.com/hashicorp/aws-sdk-go-base/v2/internal/awsconfig"
"github.com/hashicorp/aws-sdk-go-base/v2/internal/constants"
"github.com/hashicorp/aws-sdk-go-base/v2/mockdata"
"github.com/hashicorp/aws-sdk-go-base/v2/servicemocks"
Expand All @@ -41,7 +42,6 @@ func TestGetAwsConfig(t *testing.T) {
EnvironmentVariables map[string]string
ExpectedCredentialsValue aws.Credentials
ExpectedRegion string
ExpectedUserAgent string
ExpectedError func(err error) bool
MockStsEndpoints []*servicemocks.MockEndpoint
SharedConfigurationFile string
Expand Down Expand Up @@ -942,24 +942,6 @@ source_profile = SourceSharedCredentials
if expected, actual := testCase.ExpectedRegion, awsConfig.Region; expected != actual {
t.Fatalf("expected region (%s), got: %s", expected, actual)
}

// if testCase.ExpectedUserAgent != "" {
// clientInfo := metadata.ClientInfo{
// Endpoint: "http://endpoint",
// SigningName: "",
// }
// conn := client.New(*actualSession.Config, clientInfo, actualSession.Handlers)

// req := conn.NewRequest(&request.Operation{Name: "Operation"}, nil, nil)

// if err := req.Build(); err != nil {
// t.Fatalf("expect no Request.Build() error, got %s", err)
// }

// if e, a := testCase.ExpectedUserAgent, req.HTTPRequest.Header.Get("User-Agent"); e != a {
// t.Errorf("expected User-Agent (%s), got: %s", e, a)
// }
// }
})
}
}
Expand Down Expand Up @@ -1203,6 +1185,242 @@ func fullValueTypeName(v reflect.Value) string {
return fmt.Sprintf("%s.%s", requestType.PkgPath(), requestType.Name())
}

func TestServiceEndpointTypes(t *testing.T) {
testCases := map[string]struct {
Config *Config
EnvironmentVariables map[string]string
SharedConfigurationFile string
ExpectedUseFIPSEndpointState aws.FIPSEndpointState
ExpectedUseDualStackEndpointState aws.DualStackEndpointState
}{
"normal endpoint": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
},
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateUnset,
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateUnset,
},

// FIPS Endpoint
"FIPS endpoint config": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
UseFIPSEndpoint: true,
},
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateEnabled,
},
"FIPS endpoint envvar": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
},
EnvironmentVariables: map[string]string{
"AWS_USE_FIPS_ENDPOINT": "true",
},
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateEnabled,
},
"FIPS endpoint shared configuration file": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
},
SharedConfigurationFile: `
[default]
use_fips_endpoint = true
`,
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateEnabled,
},
"FIPS endpoint config overrides env var": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
UseFIPSEndpoint: true,
},
EnvironmentVariables: map[string]string{
"AWS_USE_FIPS_ENDPOINT": "true",
},
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateEnabled,
},
"FIPS endpoint env var overrides shared configuration file": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
},
EnvironmentVariables: map[string]string{
"AWS_USE_FIPS_ENDPOINT": "true",
},
SharedConfigurationFile: `
[default]
use_fips_endpoint = false
`,
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateEnabled,
},

// DualStack Endpoint
"DualStack endpoint config": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
UseDualStackEndpoint: true,
},
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateEnabled,
},
"DualStack endpoint envvar": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
},
EnvironmentVariables: map[string]string{
"AWS_USE_DUALSTACK_ENDPOINT": "true",
},
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateEnabled,
},
"DualStack endpoint shared configuration file": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
},
SharedConfigurationFile: `
[default]
use_dualstack_endpoint = true
`,
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateEnabled,
},
"DualStack endpoint config overrides env var": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
UseDualStackEndpoint: true,
},
EnvironmentVariables: map[string]string{
"AWS_USE_DUALSTACK_ENDPOINT": "true",
},
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateEnabled,
},
"DualStack endpoint env var overrides shared configuration file": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
},
EnvironmentVariables: map[string]string{
"AWS_USE_DUALSTACK_ENDPOINT": "true",
},
SharedConfigurationFile: `
[default]
use_dualstack_endpoint = false
`,
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateEnabled,
},

// FIPS and DualStack Endpoint
"Both endpoints config": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
UseDualStackEndpoint: true,
UseFIPSEndpoint: true,
},
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateEnabled,
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateEnabled,
},
"Both endpoints FIPS config DualStack envvar": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
UseFIPSEndpoint: true,
},
EnvironmentVariables: map[string]string{
"AWS_USE_DUALSTACK_ENDPOINT": "true",
},
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateEnabled,
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateEnabled,
},
"Both endpoints FIPS shared configuration file DualStack config": {
Config: &Config{
AccessKey: servicemocks.MockStaticAccessKey,
Region: "us-east-1",
SecretKey: servicemocks.MockStaticSecretKey,
UseDualStackEndpoint: true,
},
SharedConfigurationFile: `
[default]
use_fips_endpoint = true
`,
ExpectedUseFIPSEndpointState: aws.FIPSEndpointStateEnabled,
ExpectedUseDualStackEndpointState: aws.DualStackEndpointStateEnabled,
},
}

for testName, testCase := range testCases {
testCase := testCase

t.Run(testName, func(t *testing.T) {
oldEnv := servicemocks.InitSessionTestEnv()
defer servicemocks.PopEnv(oldEnv)

for k, v := range testCase.EnvironmentVariables {
os.Setenv(k, v)
}

if testCase.SharedConfigurationFile != "" {
file, err := ioutil.TempFile("", "aws-sdk-go-base-shared-configuration-file")

if err != nil {
t.Fatalf("unexpected error creating temporary shared configuration file: %s", err)
}

defer os.Remove(file.Name())

err = ioutil.WriteFile(file.Name(), []byte(testCase.SharedConfigurationFile), 0600)

if err != nil {
t.Fatalf("unexpected error writing shared configuration file: %s", err)
}

testCase.Config.SharedConfigFiles = []string{file.Name()}
}

testCase.Config.SkipCredsValidation = true

awsConfig, err := GetAwsConfig(context.Background(), testCase.Config)
if err != nil {
t.Fatalf("error in GetAwsConfig() '%[1]T': %[1]s", err)
}

useFIPSState, _, err := awsconfig.ResolveUseFIPSEndpoint(context.Background(), awsConfig.ConfigSources)
if err != nil {
t.Fatalf("error in ResolveUseFIPSEndpoint: %s", err)
}
if a, e := useFIPSState, testCase.ExpectedUseFIPSEndpointState; a != e {
t.Errorf("expected UseFIPSEndpoint %q, got: %q", awsconfig.FIPSEndpointStateString(e), awsconfig.FIPSEndpointStateString(a))
}

useDualStackState, _, err := awsconfig.ResolveUseDualStackEndpoint(context.Background(), awsConfig.ConfigSources)
if err != nil {
t.Fatalf("error in ResolveUseDualStackEndpoint: %s", err)
}
if a, e := useDualStackState, testCase.ExpectedUseDualStackEndpointState; a != e {
t.Errorf("expected UseDualStackEndpoint %q, got: %q", awsconfig.DualStackEndpointStateString(e), awsconfig.DualStackEndpointStateString(a))
}
})
}
}

func TestGetAwsConfigWithAccountIDAndPartition(t *testing.T) {
oldEnv := servicemocks.InitSessionTestEnv()
defer servicemocks.PopEnv(oldEnv)
Expand Down
6 changes: 3 additions & 3 deletions endpoints.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ import (
"github.com/aws/aws-sdk-go-v2/service/sts"
)

func endpointResolver(c *Config) aws.EndpointResolver {
resolver := func(service, region string) (aws.Endpoint, error) {
func endpointResolver(c *Config) aws.EndpointResolverWithOptions {
resolver := func(service, region string, options ...interface{}) (aws.Endpoint, error) {
log.Printf("[DEBUG] Resolving endpoint for %q in %q", service, region)
switch service {
case iam.ServiceID:
Expand All @@ -33,5 +33,5 @@ func endpointResolver(c *Config) aws.EndpointResolver {
return aws.Endpoint{}, &aws.EndpointNotFoundError{}
}

return aws.EndpointResolverFunc(resolver)
return aws.EndpointResolverWithOptionsFunc(resolver)
}
16 changes: 8 additions & 8 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
module github.com/hashicorp/aws-sdk-go-base/v2

require (
github.com/aws/aws-sdk-go-v2 v1.9.0
github.com/aws/aws-sdk-go-v2/config v1.7.0
github.com/aws/aws-sdk-go-v2/credentials v1.4.0
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.5.0
github.com/aws/aws-sdk-go-v2/service/iam v1.9.0
github.com/aws/aws-sdk-go-v2/service/sts v1.7.0
github.com/aws/smithy-go v1.8.0
github.com/google/go-cmp v0.5.6
github.com/aws/aws-sdk-go-v2 v1.13.0
github.com/aws/aws-sdk-go-v2/config v1.13.0
github.com/aws/aws-sdk-go-v2/credentials v1.8.0
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.10.0
github.com/aws/aws-sdk-go-v2/service/iam v1.16.0
github.com/aws/aws-sdk-go-v2/service/sts v1.14.0
github.com/aws/smithy-go v1.10.0
github.com/google/go-cmp v0.5.7
github.com/hashicorp/go-cleanhttp v0.5.2
github.com/hashicorp/go-multierror v1.1.1
)
Expand Down
Loading