Skip to content

Commit

Permalink
Add ability to sign requests for all AWS services
Browse files Browse the repository at this point in the history
This add the ability to utilize sigv4 signing for all AWS services not
just "aps". When the newly introduced property "service" is not set in
config it will default to "aps".
  • Loading branch information
Boris Petersen committed May 17, 2022
1 parent 627089d commit 136f390
Show file tree
Hide file tree
Showing 4 changed files with 24 additions and 7 deletions.
19 changes: 12 additions & 7 deletions sigv4/sigv4.go
Original file line number Diff line number Diff line change
Expand Up @@ -36,9 +36,10 @@ var sigv4HeaderDenylist = []string{
}

type sigV4RoundTripper struct {
region string
next http.RoundTripper
pool sync.Pool
region string
next http.RoundTripper
pool sync.Pool
service string

signer *signer.Signer
}
Expand Down Expand Up @@ -81,11 +82,15 @@ func NewSigV4RoundTripper(cfg *SigV4Config, next http.RoundTripper) (http.RoundT
if cfg.RoleARN != "" {
signerCreds = stscreds.NewCredentials(sess, cfg.RoleARN)
}
if cfg.Service == "" {
cfg.Service = "aps"
}

rt := &sigV4RoundTripper{
region: cfg.Region,
next: next,
signer: signer.NewSigner(signerCreds),
region: cfg.Region,
next: next,
signer: signer.NewSigner(signerCreds),
service: cfg.Service,
}
rt.pool.New = rt.newBuf
return rt, nil
Expand Down Expand Up @@ -126,7 +131,7 @@ func (rt *sigV4RoundTripper) RoundTrip(req *http.Request) (*http.Response, error
signReq.Header.Del(header)
}

headers, err := rt.signer.Sign(signReq, seeker, "aps", rt.region, time.Now().UTC())
headers, err := rt.signer.Sign(signReq, seeker, rt.service, rt.region, time.Now().UTC())
if err != nil {
return nil, fmt.Errorf("failed to sign request: %w", err)
}
Expand Down
1 change: 1 addition & 0 deletions sigv4/sigv4_config.go
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ type SigV4Config struct {
SecretKey config.Secret `yaml:"secret_key,omitempty"`
Profile string `yaml:"profile,omitempty"`
RoleARN string `yaml:"role_arn,omitempty"`
Service string `yaml:"service,omitempty"`
}

func (c *SigV4Config) Validate() error {
Expand Down
7 changes: 7 additions & 0 deletions sigv4/sigv4_config_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,13 @@ func TestGoodSigV4Configs(t *testing.T) {
}
}

func TestGoodSigV4ServiceConfigs(t *testing.T) {
filesToTest := []string{"testdata/sigv4_good_service.yaml", "testdata/sigv4_good_service.yaml"}
for _, filename := range filesToTest {
testGoodConfig(t, filename)
}
}

func TestBadSigV4Config(t *testing.T) {
filename := "testdata/sigv4_bad.yaml"
_, err := loadSigv4Config(filename)
Expand Down
4 changes: 4 additions & 0 deletions sigv4/testdata/sigv4_good_service.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
region: us-east-2
profile: profile
role_arn: blah:role/arn
service: exectute-api

0 comments on commit 136f390

Please sign in to comment.