Skip to content

feature(s3/manager): add option to control default checksums #3151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

stanhu
Copy link
Contributor

@stanhu stanhu commented Jul 25, 2025

As announced in #2960, AWS SDK for Go v2 service/s3 v1.73.0 shipped a change (#2808) that adopted new default integrity protections, automatically calculating CRC32 checksums for operations like PutObject and UploadPart.

While it is possible to revert to the previous behavior by setting AWS_REQUEST_CHECKSUM_CALCULATION=when_required, this config setting did not apply to the S3 Manager multipart uploader, which always enabled CRC32 checksums by default regardless of the global setting.

This commit adds a new RequestChecksumCalculation field to the Uploader struct that allows users to control checksum behavior:

  • RequestChecksumCalculationWhenSupported (default): Always calculates CRC32 checksums for multipart uploads
  • RequestChecksumCalculationWhenRequired: Only calculates checksums when explicitly set by the user, preserving backwards compatibility

For example:

uploader := manager.NewUploader(client, func(u *manager.Uploader) {
    u.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired
})

S3 Express One Zone buckets always require CRC32 checksums regardless of this setting, as mandated by the S3 Express service requirements. The uploader automatically detects S3 Express buckets (names ending with --x-s3) and applies CRC32 checksums unconditionally.

Fixes #3007

@stanhu stanhu requested a review from a team as a code owner July 25, 2025 17:22
@stanhu stanhu force-pushed the sh-fix-issue-3007-checksums-try2 branch from d755c3b to b32d2b6 Compare July 25, 2025 17:22
@stanhu stanhu force-pushed the sh-fix-issue-3007-checksums-try2 branch from b32d2b6 to a6b9cb3 Compare July 25, 2025 20:21
// isS3ExpressBucket returns true if the bucket has the S3 Express suffix.
func (u *multiuploader) isS3ExpressBucket() bool {
bucketName := aws.ToString(u.in.Bucket)
return strings.HasSuffix(bucketName, "--x-s3")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe this is actually necessary -- if you look at line 336 in this file, we add a post-endpoint-resolution check that defaults the checksum if the endpoint resolution process determined that we were using an express bucket. You should be able to just verify this with an additional unit test.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lucix-aws Thanks. I'm not quite sure how to add a unit test here because that checksum is added in HandleFinalize, and the mock request doesn't seem to get there.

Copy link
Contributor

@lucix-aws lucix-aws Aug 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the mock request doesn't seem to get there

I don't really understand what this means. No you're right actually, because that middleware is added in the low-level s3 client which the tests in this package would all be mocking. So this would have to be done in an integration test, which we as the SDK team would have to handle.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will try to find some time to take care of that next week.

@lucix-aws lucix-aws added the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Jul 28, 2025
Copy link

github-actions bot commented Aug 8, 2025

Greetings! It looks like this PR hasn’t been active in longer than a week, add a comment or an upvote to prevent automatic closure, or if the issue is already closed, please feel free to open a new one.

@stanhu stanhu force-pushed the sh-fix-issue-3007-checksums-try2 branch from a6b9cb3 to 36f5784 Compare August 8, 2025 13:47
As announced in aws#2960,
AWS SDK for Go v2 service/s3 v1.73.0 shipped a change
(aws#2808) that adopted new
default integrity protections, automatically calculating CRC32 checksums
for operations like PutObject and UploadPart.

While it is possible to revert to the previous behavior by setting
`AWS_REQUEST_CHECKSUM_CALCULATION=when_required`, this config setting
did not apply to the S3 Manager multipart uploader, which always enabled
CRC32 checksums by default regardless of the global setting.

This commit adds a new `RequestChecksumCalculation` field to the Uploader
struct that allows users to control checksum behavior:

- `RequestChecksumCalculationWhenSupported` (default): Always calculates
  CRC32 checksums for multipart uploads
- `RequestChecksumCalculationWhenRequired`: Only calculates checksums
  when explicitly set by the user, preserving backwards compatibility

For example:

```go
uploader := manager.NewUploader(client, func(u *manager.Uploader) {
    u.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired
})
```

S3 Express One Zone buckets always require CRC32 checksums regardless of
this setting, as mandated by the S3 Express service requirements.  The
uploader automatically detects S3 Express buckets (names ending with
`--x-s3`) and applies CRC32 checksums unconditionally.

Fixes aws#3007

Signed-off-by: Stan Hu <[email protected]>
@stanhu stanhu force-pushed the sh-fix-issue-3007-checksums-try2 branch from 24798f7 to fb4dd5a Compare August 8, 2025 13:48
@lucix-aws lucix-aws added response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. and removed response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. no-pr-activity labels Aug 8, 2025
@lucix-aws
Copy link
Contributor

Patch looks fine, approval pending integration tests but I'll run CI now.

Ignore failing codegen and integration tests, those don't work in forks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

add option to disable integrity check for multipart upload
2 participants