Skip to content

Commit 6c0b6b4

Browse files
skmcgrailskmcgrail
authored
Update S3 ARN Handling for AccessPoints and Outpost ARNs (#1278)
1 parent 9865633 commit 6c0b6b4

File tree

11 files changed

+183
-68
lines changed

11 files changed

+183
-68
lines changed

‎service/internal/s3shared/arn/accesspoint_arn.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ func ParseAccessPointResource(a arn.ARN, resParts []string) (AccessPointARN, err
2828
if len(a.Region) == 0 {
2929
return AccessPointARN{}, InvalidARNError{ARN: a, Reason: "region not set"}
3030
}
31+
if isFIPS(a.Region) {
32+
return AccessPointARN{}, InvalidARNError{ARN: a, Reason: "FIPS region not allowed in ARN"}
33+
}
3134
if len(a.AccountID) == 0 {
3235
return AccessPointARN{}, InvalidARNError{ARN: a, Reason: "account-id not set"}
3336
}
@@ -48,3 +51,7 @@ func ParseAccessPointResource(a arn.ARN, resParts []string) (AccessPointARN, err
4851
AccessPointName: resID,
4952
}, nil
5053
}
54+
55+
func isFIPS(region string) bool {
56+
return strings.HasPrefix(region, "fips-") || strings.HasSuffix(region, "-fips")
57+
}

‎service/internal/s3shared/arn/accesspoint_arn_test.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,26 @@ func TestParseAccessPointResource(t *testing.T) {
8181
AccessPointName: "endpoint",
8282
},
8383
},
84+
"invalid FIPS pseudo region in ARN (prefix)": {
85+
ARN: arn.ARN{
86+
Partition: "aws",
87+
Service: "s3",
88+
Region: "fips-us-west-2",
89+
AccountID: "012345678901",
90+
Resource: "accesspoint/endpoint",
91+
},
92+
ExpectErr: "FIPS region not allowed in ARN",
93+
},
94+
"invalid FIPS pseudo region in ARN (suffix)": {
95+
ARN: arn.ARN{
96+
Partition: "aws",
97+
Service: "s3",
98+
Region: "us-west-2-fips",
99+
AccountID: "012345678901",
100+
Resource: "accesspoint/endpoint",
101+
},
102+
ExpectErr: "FIPS region not allowed in ARN",
103+
},
84104
}
85105

86106
for name, c := range cases {

‎service/internal/s3shared/arn/outpost_arn.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ func ParseOutpostARNResource(a arn.ARN, resParts []string) (OutpostARN, error) {
3131
return nil, InvalidARNError{ARN: a, Reason: "region not set"}
3232
}
3333

34+
if isFIPS(a.Region) {
35+
return nil, InvalidARNError{ARN: a, Reason: "FIPS region not allowed in ARN"}
36+
}
37+
3438
if len(a.AccountID) == 0 {
3539
return nil, InvalidARNError{ARN: a, Reason: "account-id not set"}
3640
}

‎service/internal/s3shared/arn/outpost_arn_test.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,26 @@ func TestParseOutpostAccessPointARNResource(t *testing.T) {
9494
OutpostID: "myoutpost",
9595
},
9696
},
97+
"invalid FIPS pseudo region in ARN (prefix)": {
98+
ARN: arn.ARN{
99+
Partition: "aws",
100+
Service: "s3-outposts",
101+
Region: "fips-us-west-2",
102+
AccountID: "012345678901",
103+
Resource: "outpost/myoutpost/accesspoint/myendpoint",
104+
},
105+
ExpectErr: "FIPS region not allowed in ARN",
106+
},
107+
"invalid FIPS pseudo region in ARN (suffix)": {
108+
ARN: arn.ARN{
109+
Partition: "aws",
110+
Service: "s3-outposts",
111+
Region: "us-west-2-fips",
112+
AccountID: "012345678901",
113+
Resource: "outpost/myoutpost/accesspoint/myendpoint",
114+
},
115+
ExpectErr: "FIPS region not allowed in ARN",
116+
},
97117
}
98118

99119
for name, c := range cases {

‎service/internal/s3shared/endpoint_error.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ func NewInvalidARNWithUnsupportedPartitionError(resource arn.Resource, err error
5858
}
5959

6060
// NewInvalidARNWithFIPSError ARN not supported for FIPS region
61+
//
62+
// Deprecated: FIPS will not appear in the ARN region component.
6163
func NewInvalidARNWithFIPSError(resource arn.Resource, err error) InvalidARNError {
6264
return InvalidARNError{
6365
message: "resource ARN not supported for FIPS region",
@@ -136,6 +138,17 @@ func NewClientConfiguredForFIPSError(resource arn.Resource, clientPartitionID, c
136138
}
137139
}
138140

141+
// NewFIPSConfigurationError denotes a configuration error when a client or request is configured for FIPS
142+
func NewFIPSConfigurationError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
143+
return ConfigurationError{
144+
message: "use of ARN is not supported when client or request is configured for FIPS",
145+
origErr: err,
146+
resource: resource,
147+
clientPartitionID: clientPartitionID,
148+
clientRegion: clientRegion,
149+
}
150+
}
151+
139152
// NewClientConfiguredForAccelerateError denotes client config error for unsupported S3 accelerate
140153
func NewClientConfiguredForAccelerateError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
141154
return ConfigurationError{

‎service/internal/s3shared/resource_request.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ func (r ResourceRequest) UseFips() bool {
3535
}
3636

3737
// ResourceConfiguredForFIPS returns true if resource ARNs region is FIPS
38+
//
39+
// Deprecated: FIPS will not be present in the ARN region
3840
func (r ResourceRequest) ResourceConfiguredForFIPS() bool {
3941
return IsFIPS(r.ARN().Region)
4042
}
@@ -68,8 +70,8 @@ func (r ResourceRequest) IsCrossRegion() bool {
6870
return !strings.EqualFold(v, r.Resource.GetARN().Region)
6971
}
7072

71-
// IsFIPS returns true if region is a fips region
72-
func IsFIPS(clientRegion string) bool {
73-
return (strings.HasPrefix(clientRegion, "fips-") ||
74-
strings.HasSuffix(clientRegion, "-fips"))
73+
// IsFIPS returns true if region is a fips pseudo-region
74+
func IsFIPS(region string) bool {
75+
return strings.HasPrefix(region, "fips-") ||
76+
strings.HasSuffix(region, "-fips")
7577
}

‎service/s3/internal/customizations/process_arn_resource.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -185,9 +185,10 @@ func (m *processARNResource) HandleSerialize(
185185
resourceRequest.PartitionID, resourceRequest.RequestRegion, nil)
186186
}
187187

188-
// check if resource arn region is FIPS
189-
if resourceRequest.ResourceConfiguredForFIPS() {
190-
return out, metadata, s3shared.NewInvalidARNWithFIPSError(tv, nil)
188+
// check if request region is FIPS
189+
if resourceRequest.UseFips() {
190+
return out, metadata, s3shared.NewFIPSConfigurationError(tv, resourceRequest.PartitionID,
191+
resourceRequest.RequestRegion, nil)
191192
}
192193

193194
// build outpost access point request

‎service/s3/internal/customizations/update_endpoint_test.go‎

Lines changed: 57 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -442,31 +442,28 @@ func TestEndpointWithARN(t *testing.T) {
442442
expectedSigningName: "s3-outposts",
443443
expectedSigningRegion: "us-gov-east-1",
444444
},
445-
"Outpost AccessPoint Fips region": {
445+
"Outpost AccessPoint FIPS cross-region": {
446446
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
447447
options: s3.Options{
448448
Region: "fips-us-gov-west-1",
449449
},
450450
expectedErr: "ConfigurationError : client region does not match provided ARN region",
451451
},
452-
"Outpost AccessPoint Fips region in Arn": {
453-
bucket: "arn:aws-us-gov:s3-outposts:fips-us-gov-west-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
452+
"Outpost AccessPoint with FIPS client cross-region": {
453+
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
454454
options: s3.Options{
455-
Region: "fips-us-gov-west-1",
456-
EndpointOptions: endpoints.Options{DisableHTTPS: true},
457-
UseARNRegion: true,
455+
Region: "fips-us-gov-west-1",
456+
UseARNRegion: true,
458457
},
459-
expectedErr: "InvalidARNError : resource ARN not supported for FIPS region",
458+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
460459
},
461-
"Outpost AccessPoint Fips region with valid ARN region": {
462-
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
460+
"Outpost AccessPoint with FIPS client matching region": {
461+
bucket: "arn:aws-us-gov:s3-outposts:us-gov-west-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
463462
options: s3.Options{
464463
Region: "fips-us-gov-west-1",
465464
UseARNRegion: true,
466465
},
467-
expectedReqURL: "https://myaccesspoint-123456789012.op-01234567890123456.s3-outposts.us-gov-east-1.amazonaws.com/testkey?x-id=GetObject",
468-
expectedSigningName: "s3-outposts",
469-
expectedSigningRegion: "us-gov-east-1",
466+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
470467
},
471468
"Outpost AccessPoint with Immutable Endpoint": {
472469
bucket: "arn:aws:s3-outposts:us-west-2:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
@@ -809,6 +806,54 @@ func TestEndpointWithARN(t *testing.T) {
809806
expectedSigningName: "s3",
810807
expectedSigningRegion: "us-west-2",
811808
},
809+
"Invalid AccessPoint ARN with FIPS pseudo-region (prefix)": {
810+
bucket: "arn:aws:s3:fips-us-east-1:123456789012:accesspoint:myendpoint",
811+
options: s3.Options{
812+
Region: "us-west-2",
813+
UseARNRegion: true,
814+
},
815+
expectedErr: "FIPS region not allowed in ARN",
816+
},
817+
"Invalid AccessPoint ARN with FIPS pseudo-region (suffix)": {
818+
bucket: "arn:aws:s3:us-east-1-fips:123456789012:accesspoint:myendpoint",
819+
options: s3.Options{
820+
Region: "us-west-2",
821+
UseARNRegion: true,
822+
},
823+
expectedErr: "FIPS region not allowed in ARN",
824+
},
825+
"Invalid Outpost AccessPoint ARN with FIPS pseudo-region (prefix)": {
826+
bucket: "arn:aws:s3-outposts:fips-us-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
827+
options: s3.Options{
828+
Region: "us-west-2",
829+
UseARNRegion: true,
830+
},
831+
expectedErr: "FIPS region not allowed in ARN",
832+
},
833+
"Invalid Outpost AccessPoint ARN with FIPS pseudo-region (suffix)": {
834+
bucket: "arn:aws:s3-outposts:us-east-1-fips:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
835+
options: s3.Options{
836+
Region: "us-west-2",
837+
UseARNRegion: true,
838+
},
839+
expectedErr: "FIPS region not allowed in ARN",
840+
},
841+
"Invalid Object Lambda ARN with FIPS pseudo-region (prefix)": {
842+
bucket: "arn:aws:s3-object-lambda:fips-us-east-1:123456789012:accesspoint/myap",
843+
options: s3.Options{
844+
Region: "us-west-2",
845+
UseARNRegion: true,
846+
},
847+
expectedErr: "FIPS region not allowed in ARN",
848+
},
849+
"Invalid Object Lambda ARN with FIPS pseudo-region (suffix)": {
850+
bucket: "arn:aws:s3-object-lambda:us-east-1-fips:123456789012:accesspoint/myap",
851+
options: s3.Options{
852+
Region: "us-west-2",
853+
UseARNRegion: true,
854+
},
855+
expectedErr: "FIPS region not allowed in ARN",
856+
},
812857
}
813858

814859
for name, c := range cases {

‎service/s3control/internal/customizations/process_arn_resource.go‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,9 @@ func (m *processARNResource) HandleSerialize(
112112
}
113113

114114
// check if resource arn region is FIPS
115-
if resourceRequest.ResourceConfiguredForFIPS() {
116-
return out, metadata, s3shared.NewInvalidARNWithFIPSError(tv, nil)
115+
if resourceRequest.UseFips() {
116+
return out, metadata, s3shared.NewFIPSConfigurationError(tv, resourceRequest.PartitionID,
117+
resourceRequest.RequestRegion, nil)
117118
}
118119

119120
// Disable endpoint host prefix for s3-control
@@ -129,11 +130,6 @@ func (m *processARNResource) HandleSerialize(
129130
return out, metadata, fmt.Errorf("error updating arnable field while serializing")
130131
}
131132

132-
// check if request region is FIPS and ARN region usage is not allowed
133-
if resourceRequest.UseFips() && !m.UseARNRegion {
134-
return out, metadata, s3shared.NewInvalidARNWithFIPSError(tv, nil)
135-
}
136-
137133
// Add outpostID header
138134
req.Header.Add(outpostIDHeader, tv.OutpostID)
139135

@@ -158,8 +154,9 @@ func (m *processARNResource) HandleSerialize(
158154
}
159155

160156
// check if resource arn region is FIPS
161-
if resourceRequest.ResourceConfiguredForFIPS() {
162-
return out, metadata, s3shared.NewInvalidARNWithFIPSError(tv, nil)
157+
if resourceRequest.UseFips() {
158+
return out, metadata, s3shared.NewFIPSConfigurationError(tv, resourceRequest.PartitionID,
159+
resourceRequest.RequestRegion, nil)
163160
}
164161

165162
// Disable endpoint host prefix for s3-control
@@ -224,11 +221,6 @@ func validateResourceRequest(resourceRequest s3shared.ResourceRequest) error {
224221
resourceRequest.PartitionID, resourceRequest.RequestRegion, nil)
225222
}
226223

227-
// resource configured with FIPS as region is not supported by outposts
228-
if resourceRequest.ResourceConfiguredForFIPS() {
229-
return s3shared.NewInvalidARNWithFIPSError(resourceRequest.Resource, nil)
230-
}
231-
232224
return nil
233225
}
234226

‎service/s3control/internal/customizations/process_outpost_id.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,11 @@ import (
55
"fmt"
66
"strings"
77

8-
"github.com/aws/smithy-go/middleware"
9-
smithyhttp "github.com/aws/smithy-go/transport/http"
10-
118
"github.com/aws/aws-sdk-go-v2/aws"
129
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
1310
"github.com/aws/aws-sdk-go-v2/service/internal/s3shared"
11+
"github.com/aws/smithy-go/middleware"
12+
smithyhttp "github.com/aws/smithy-go/transport/http"
1413
)
1514

1615
// processOutpostIDMiddleware is special customization middleware to be applied for operations

0 commit comments

Comments
 (0)