Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add S3 payload signing test with SRA #4804

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add S3 payload signing test with SRA #4804

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
73 changes: 72 additions & 1 deletion services/s3/src/test/java/software/amazon/awssdk/services/s3/PayloadSigningDisabledTest.java
View file
Open in desktop
Expand Up @@ -17,14 +17,23 @@

import static org.assertj.core.api.Assertions.assertThat;

import java.util.Arrays;
import java.util.List;
import java.util.stream.Collectors;
import org.junit.jupiter.api.Test;
import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
import software.amazon.awssdk.auth.signer.S3SignerExecutionAttribute;
import software.amazon.awssdk.core.client.config.ClientOverrideConfiguration;
import software.amazon.awssdk.http.HttpExecuteResponse;
import software.amazon.awssdk.http.SdkHttpResponse;
import software.amazon.awssdk.http.auth.aws.scheme.AwsV4AuthScheme;
import software.amazon.awssdk.http.auth.aws.scheme.AwsV4aAuthScheme;
import software.amazon.awssdk.http.auth.aws.signer.AwsV4FamilyHttpSigner;
import software.amazon.awssdk.http.auth.spi.scheme.AuthSchemeOption;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.s3.auth.scheme.S3AuthSchemeParams;
import software.amazon.awssdk.services.s3.auth.scheme.S3AuthSchemeProvider;
import software.amazon.awssdk.testutils.service.http.MockAsyncHttpClient;
import software.amazon.awssdk.testutils.service.http.MockSyncHttpClient;

Expand Down Expand Up @@ -78,6 +87,26 @@ public void asyncPayloadSigningIsDisabled() {

@Test
public void syncPayloadSigningCanBeEnabled() {
try (MockSyncHttpClient httpClient = new MockSyncHttpClient();
S3Client s3 = S3Client.builder()
.region(Region.US_WEST_2)
.credentialsProvider(CREDENTIALS)
.httpClient(httpClient)
.authSchemeProvider(new PayloadSigningEnabledS3AuthSchemeProvider())
.build()) {
httpClient.stubNextResponse(HttpExecuteResponse.builder()
.response(SdkHttpResponse.builder().statusCode(200).build())
.build());

s3.createBucket(r -> r.bucket("foo"));

assertThat(httpClient.getLastRequest().firstMatchingHeader("x-amz-content-sha256"))
.hasValue("a40ef303139635de59992f34c1c7da763f89200f2d55b71016f7c156527d63a0");
}
}

@Test
public void syncPayloadSigningCanBeEnabledUsingExecutionAttribute() {
try (MockSyncHttpClient httpClient = new MockSyncHttpClient();
S3Client s3 = S3Client.builder()
.region(Region.US_WEST_2)
Expand All @@ -103,7 +132,7 @@ public void asyncPayloadSigningCanBeEnabled() {
.region(Region.US_WEST_2)
.credentialsProvider(CREDENTIALS)
.httpClient(httpClient)
.overrideConfiguration(ENABLE_PAYLOAD_SIGNING_CONFIG)
.authSchemeProvider(new PayloadSigningEnabledS3AuthSchemeProvider())
.build()) {
httpClient.stubNextResponse(HttpExecuteResponse.builder()
.response(SdkHttpResponse.builder().statusCode(200).build())
Expand All @@ -115,4 +144,46 @@ public void asyncPayloadSigningCanBeEnabled() {
.hasValue("a40ef303139635de59992f34c1c7da763f89200f2d55b71016f7c156527d63a0");
}
}

@Test
public void asyncPayloadSigningCanBeEnabledUsingExecutionAttribute() {
try (MockAsyncHttpClient httpClient = new MockAsyncHttpClient();
S3AsyncClient s3 = S3AsyncClient.builder()
.region(Region.US_WEST_2)
.credentialsProvider(CREDENTIALS)
.httpClient(httpClient)
.overrideConfiguration(ENABLE_PAYLOAD_SIGNING_CONFIG)
.build()) {
httpClient.stubNextResponse(HttpExecuteResponse.builder()
.response(SdkHttpResponse.builder().statusCode(200).build())
.build());

s3.createBucket(r -> r.bucket("foo")).join();

assertThat(httpClient.getLastRequest().firstMatchingHeader("x-amz-content-sha256"))
.hasValue("a40ef303139635de59992f34c1c7da763f89200f2d55b71016f7c156527d63a0");
}
}

private static class PayloadSigningEnabledS3AuthSchemeProvider implements S3AuthSchemeProvider {
private static final List<String> SIGV4_SCHEMES = Arrays.asList(
AwsV4AuthScheme.SCHEME_ID, AwsV4aAuthScheme.SCHEME_ID);
private S3AuthSchemeProvider defaultS3AuthSchemeProvider = S3AuthSchemeProvider.defaultProvider();

@Override
public List<AuthSchemeOption> resolveAuthScheme(S3AuthSchemeParams authSchemeParams) {
return defaultS3AuthSchemeProvider
.resolveAuthScheme(authSchemeParams)
.stream()
.map(authSchemeOption -> {
if (SIGV4_SCHEMES.contains(authSchemeOption.schemeId())) {
return authSchemeOption.toBuilder()
.putSignerProperty(AwsV4FamilyHttpSigner.PAYLOAD_SIGNING_ENABLED, true)
.build();
}
return authSchemeOption;
})
.collect(Collectors.toList());
}
}
}