Skip to content

Commit 12bd884

Browse files
zoewanggzoewangg
authored
Update GeneratePresignUrlInterceptor to use HttpSigner instead of legacy signer (#6619)
# Conflicts: # services/ec2/src/main/java/software/amazon/awssdk/services/ec2/transform/internal/GeneratePreSignUrlInterceptor.java
1 parent 3d826f1 commit 12bd884

File tree

2 files changed

+56
-28
lines changed

2 files changed

+56
-28
lines changed

‎services/ec2/src/main/java/software/amazon/awssdk/services/ec2/transform/internal/GeneratePreSignUrlInterceptor.java‎

Lines changed: 50 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -15,20 +15,20 @@
1515

1616
package software.amazon.awssdk.services.ec2.transform.internal;
1717

18-
import static software.amazon.awssdk.auth.signer.AwsSignerExecutionAttribute.AWS_CREDENTIALS;
1918
import static software.amazon.awssdk.core.interceptor.SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME;
2019

2120
import java.net.URI;
2221
import java.time.Clock;
22+
import java.time.Duration;
23+
import java.time.Instant;
24+
import java.time.ZoneOffset;
25+
import java.util.concurrent.CompletableFuture;
2326
import software.amazon.awssdk.annotations.SdkInternalApi;
2427
import software.amazon.awssdk.annotations.SdkTestInternalApi;
25-
import software.amazon.awssdk.auth.credentials.AwsCredentials;
26-
import software.amazon.awssdk.auth.credentials.CredentialUtils;
27-
import software.amazon.awssdk.auth.signer.Aws4Signer;
28-
import software.amazon.awssdk.auth.signer.params.Aws4PresignerParams;
2928
import software.amazon.awssdk.awscore.util.AwsHostNameUtils;
3029
import software.amazon.awssdk.core.ClientEndpointProvider;
3130
import software.amazon.awssdk.core.SdkRequest;
31+
import software.amazon.awssdk.core.SelectedAuthScheme;
3232
import software.amazon.awssdk.core.client.config.SdkClientConfiguration;
3333
import software.amazon.awssdk.core.client.config.SdkClientOption;
3434
import software.amazon.awssdk.core.exception.SdkClientException;
@@ -38,7 +38,14 @@
3838
import software.amazon.awssdk.http.SdkHttpFullRequest;
3939
import software.amazon.awssdk.http.SdkHttpMethod;
4040
import software.amazon.awssdk.http.SdkHttpRequest;
41-
import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
41+
import software.amazon.awssdk.http.auth.aws.signer.AwsV4FamilyHttpSigner;
42+
import software.amazon.awssdk.http.auth.aws.signer.AwsV4HttpSigner;
43+
import software.amazon.awssdk.http.auth.aws.signer.SignerConstant;
44+
import software.amazon.awssdk.http.auth.spi.scheme.AuthSchemeOption;
45+
import software.amazon.awssdk.http.auth.spi.signer.HttpSigner;
46+
import software.amazon.awssdk.http.auth.spi.signer.SignRequest;
47+
import software.amazon.awssdk.http.auth.spi.signer.SignedRequest;
48+
import software.amazon.awssdk.identity.spi.Identity;
4249
import software.amazon.awssdk.protocols.query.AwsEc2ProtocolFactory;
4350
import software.amazon.awssdk.regions.Region;
4451
import software.amazon.awssdk.services.ec2.Ec2Client;
@@ -123,38 +130,54 @@ public SdkHttpRequest modifyHttpRequest(Context.ModifyHttpRequest context, Execu
123130
.method(SdkHttpMethod.GET)
124131
.build();
125132

126-
Aws4Signer signer = Aws4Signer.create();
127-
Aws4PresignerParams signingParams = getPresignerParams(executionAttributes, sourceRegion, serviceName);
128-
129-
SdkHttpFullRequest presignedRequest = signer.presign(requestForPresigning, signingParams);
133+
URI presignedUrl =
134+
sraPresignRequest(executionAttributes, requestForPresigning, sourceRegion);
130135

131136
return request.toBuilder()
132137
.putRawQueryParameter("DestinationRegion", destinationRegion)
133-
.putRawQueryParameter("PresignedUrl", presignedRequest.getUri().toString())
138+
.putRawQueryParameter("PresignedUrl", presignedUrl.toString())
134139
.build();
135140
}
136141

137142
return request;
138143
}
139144

140-
private Aws4PresignerParams getPresignerParams(ExecutionAttributes attributes, String signingRegion, String signingName) {
141-
return Aws4PresignerParams.builder()
142-
.signingRegion(Region.of(signingRegion))
143-
.signingName(signingName)
144-
.awsCredentials(resolveCredentials(attributes))
145-
.signingClockOverride(testClock)
146-
.build();
145+
private URI sraPresignRequest(ExecutionAttributes executionAttributes, SdkHttpFullRequest request,
146+
String signingRegion) {
147+
SelectedAuthScheme<?> selectedAuthScheme = executionAttributes.getAttribute(SELECTED_AUTH_SCHEME);
148+
Instant signingInstant;
149+
if (testClock != null) {
150+
signingInstant = testClock.instant();
151+
} else {
152+
signingInstant = Instant.now();
153+
}
154+
155+
Clock signingClock = Clock.fixed(signingInstant, ZoneOffset.UTC);
156+
Duration expirationDuration = SignerConstant.PRESIGN_URL_MAX_EXPIRATION_DURATION;
157+
return doSraPresign(request, selectedAuthScheme, signingRegion, signingClock, expirationDuration);
147158
}
148159

149-
private AwsCredentials resolveCredentials(ExecutionAttributes attributes) {
150-
return attributes.getOptionalAttribute(SELECTED_AUTH_SCHEME)
151-
.map(selectedAuthScheme -> selectedAuthScheme.identity())
152-
.map(identityFuture -> CompletableFutureUtils.joinLikeSync(identityFuture))
153-
.filter(identity -> identity instanceof AwsCredentialsIdentity)
154-
.map(identity -> {
155-
AwsCredentialsIdentity awsCredentialsIdentity = (AwsCredentialsIdentity) identity;
156-
return CredentialUtils.toCredentials(awsCredentialsIdentity);
157-
}).orElse(attributes.getAttribute(AWS_CREDENTIALS));
160+
private <T extends Identity> URI doSraPresign(SdkHttpFullRequest request,
161+
SelectedAuthScheme<T> selectedAuthScheme,
162+
String signingRegion,
163+
Clock signingClock,
164+
Duration expirationDuration) {
165+
CompletableFuture<? extends T> identityFuture = selectedAuthScheme.identity();
166+
T identity = CompletableFutureUtils.joinLikeSync(identityFuture);
167+
168+
SignRequest.Builder<T> signRequestBuilder = SignRequest
169+
.builder(identity)
170+
.putProperty(AwsV4FamilyHttpSigner.AUTH_LOCATION, AwsV4FamilyHttpSigner.AuthLocation.QUERY_STRING)
171+
.putProperty(AwsV4FamilyHttpSigner.EXPIRATION_DURATION, expirationDuration)
172+
.putProperty(HttpSigner.SIGNING_CLOCK, signingClock)
173+
.request(request)
174+
.payload(request.contentStreamProvider().orElse(null));
175+
AuthSchemeOption authSchemeOption = selectedAuthScheme.authSchemeOption();
176+
authSchemeOption.forEachSignerProperty(signRequestBuilder::putProperty);
177+
signRequestBuilder.putProperty(AwsV4HttpSigner.REGION_NAME, signingRegion);
178+
HttpSigner<T> signer = selectedAuthScheme.signer();
179+
SignedRequest signedRequest = signer.sign(signRequestBuilder.build());
180+
return signedRequest.request().getUri();
158181
}
159182

160183
/**

‎services/ec2/src/test/java/software/amazon/awssdk/services/ec2/transform/internal/GeneratePreSignUrlInterceptorTest.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
import static org.assertj.core.api.Assertions.assertThat;
1919
import static org.mockito.Mockito.when;
2020
import static software.amazon.awssdk.auth.signer.AwsSignerExecutionAttribute.AWS_CREDENTIALS;
21+
import static software.amazon.awssdk.core.interceptor.SdkExecutionAttribute.SERVICE_NAME;
22+
2123
import java.net.URI;
2224
import java.time.Clock;
2325
import java.time.Instant;
@@ -28,6 +30,7 @@
2830
import org.mockito.Mock;
2931
import org.mockito.junit.MockitoJUnitRunner;
3032
import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
33+
import software.amazon.awssdk.auth.signer.AwsSignerExecutionAttribute;
3134
import software.amazon.awssdk.core.interceptor.Context;
3235
import software.amazon.awssdk.core.interceptor.ExecutionAttributes;
3336
import software.amazon.awssdk.http.SdkHttpFullRequest;
@@ -59,6 +62,7 @@ public void copySnapshotRequest_httpsProtocolAddedToEndpoint() {
5962

6063
ExecutionAttributes attrs = new ExecutionAttributes();
6164
attrs.putAttribute(AWS_CREDENTIALS, AwsBasicCredentials.create("foo", "bar"));
65+
attrs.putAttribute(AwsSignerExecutionAttribute.SERVICE_SIGNING_NAME, "ec2");
6266

6367
SdkHttpRequest modifiedRequest = INTERCEPTOR.modifyHttpRequest(mockContext, attrs);
6468

@@ -82,8 +86,8 @@ public void copySnapshotRequest_generatesCorrectPresignedUrl() {
8286
"&X-Amz-Algorithm=AWS4-HMAC-SHA256" +
8387
"&X-Amz-Date=20200107T205609Z" +
8488
"&X-Amz-SignedHeaders=host" +
85-
"&X-Amz-Expires=604800" +
8689
"&X-Amz-Credential=akid%2F20200107%2Fus-west-2%2Fec2%2Faws4_request" +
90+
"&X-Amz-Expires=604800" +
8791
"&X-Amz-Signature=c1f5e34834292a86ff2b46b5e97cebaf2967b09641b4e2e60a382a37d137a03b";
8892

8993
ZoneId utcZone = ZoneId.of("UTC").normalized();
@@ -111,6 +115,7 @@ public void copySnapshotRequest_generatesCorrectPresignedUrl() {
111115

112116
ExecutionAttributes attrs = new ExecutionAttributes();
113117
attrs.putAttribute(AWS_CREDENTIALS, AwsBasicCredentials.create("akid", "skid"));
118+
attrs.putAttribute(AwsSignerExecutionAttribute.SERVICE_SIGNING_NAME, "ec2");
114119

115120
SdkHttpRequest modifiedRequest = interceptor.modifyHttpRequest(mockContext, attrs);
116121

0 commit comments

Comments
 (0)