aws-sdk-s3 1.114.0 → 1.125.0

data/lib/aws-sdk-s3/plugins/s3_signer.rb

@@ -5,28 +5,13 @@ require 'aws-sigv4'
 module Aws
   module S3
     module Plugins
-      # This plugin is an implementation detail and may be modified.
+      # This plugin used to have a V4 signer but it was removed in favor of
+      # generic Sign plugin that uses endpoint auth scheme.
+      #
       # @api private
       class S3Signer < Seahorse::Client::Plugin
         option(:signature_version, 'v4')
 
-        option(:sigv4_signer) do |cfg|
-          S3Signer.build_v4_signer(
-            service: 's3',
-            region: cfg.sigv4_region,
-            credentials: cfg.credentials
-          )
-        end
-
-        option(:sigv4_region) do |cfg|
-          # S3 removes core's signature_v4 plugin that checks for this
-          raise Aws::Errors::MissingRegionError if cfg.region.nil?
-
-          Aws::Partitions::EndpointProvider.signing_region(
-            cfg.region, 's3'
-          )
-        end
-
         def add_handlers(handlers, cfg)
           case cfg.signature_version
           when 'v4' then add_v4_handlers(handlers)
@@ -39,11 +24,11 @@ module Aws
 
         def add_v4_handlers(handlers)
           handlers.add(CachedBucketRegionHandler, step: :sign, priority: 60)
-          handlers.add(V4Handler, step: :sign)
           handlers.add(BucketRegionErrorHandler, step: :sign, priority: 40)
         end
 
         def add_legacy_handler(handlers)
+          # generic Sign plugin will be skipped if it sees sigv2
           handlers.add(LegacyHandler, step: :sign)
         end
 
@@ -54,53 +39,6 @@ module Aws
           end
         end
 
-        class V4Handler < Seahorse::Client::Handler
-          def call(context)
-            Aws::Plugins::SignatureV4.apply_signature(
-              context: context,
-              signer: sigv4_signer(context)
-            )
-            @handler.call(context)
-          end
-
-          private
-
-          def sigv4_signer(context)
-            # If the client was configured with the wrong region,
-            # we have to build a new signer.
-            if context[:cached_sigv4_region] &&
-               context[:cached_sigv4_region] != context.config.sigv4_signer.region
-              S3Signer.build_v4_signer(
-                service: 's3',
-                region: context[:cached_sigv4_region],
-                credentials: context.config.credentials
-              )
-            elsif (arn = context.metadata[:s3_arn])
-              if arn[:arn].is_a?(MultiRegionAccessPointARN)
-                signing_region = '*'
-                signing_algorithm = :sigv4a
-              else
-                signing_region = arn[:resolved_region]
-                signing_algorithm = :sigv4
-              end
-              S3Signer.build_v4_signer(
-                service: arn[:arn].service,
-                signing_algorithm: signing_algorithm,
-                region: signing_region,
-                credentials: context.config.credentials
-              )
-            elsif context.operation.name == 'WriteGetObjectResponse'
-              S3Signer.build_v4_signer(
-                service: 's3-object-lambda',
-                region: context.config.sigv4_region,
-                credentials: context.config.credentials
-              )
-            else
-              context.config.sigv4_signer
-            end
-          end
-        end
-
         # This handler will update the http endpoint when the bucket region
         # is known/cached.
         class CachedBucketRegionHandler < Seahorse::Client::Handler
@@ -114,11 +52,13 @@ module Aws
 
           def check_for_cached_region(context, bucket)
             cached_region = S3::BUCKET_REGIONS[bucket]
-            if cached_region && cached_region != context.config.region
+            if cached_region &&
+               cached_region != context.config.region &&
+               !S3Signer.custom_endpoint?(context)
               context.http_request.endpoint.host = S3Signer.new_hostname(
                 context, cached_region
               )
-              context[:cached_sigv4_region] = cached_region
+              context[:sigv4_region] = cached_region # Sign plugin will use this
             end
           end
         end
@@ -126,7 +66,8 @@ module Aws
         # This handler detects when a request fails because of a mismatched bucket
         # region. It follows up by making a request to determine the correct
         # region, then finally a version 4 signed request against the correct
-        # regional endpoint.
+        # regional endpoint. This is intended for s3's global endpoint which
+        # will return 400 if the bucket is not in region.
         class BucketRegionErrorHandler < Seahorse::Client::Handler
           def call(context)
             response = @handler.call(context)
@@ -138,7 +79,7 @@ module Aws
           def handle_region_errors(response)
             if wrong_sigv4_region?(response) &&
                !fips_region?(response) &&
-               !custom_endpoint?(response) &&
+               !S3Signer.custom_endpoint?(response.context) &&
                !expired_credentials?(response)
               get_region_and_retry(response.context)
             else
@@ -160,25 +101,13 @@ module Aws
           end
 
           def fips_region?(resp)
-            resp.context.http_request.endpoint.host.include?('fips')
+            resp.context.http_request.endpoint.host.include?('s3-fips.')
           end
 
           def expired_credentials?(resp)
             resp.context.http_response.body_contents.match(/<Code>ExpiredToken<\/Code>/)
           end
 
-          def custom_endpoint?(resp)
-            resolved_suffix = Aws::Partitions::EndpointProvider.dns_suffix_for(
-              resp.context.config.region,
-              's3',
-              {
-                dualstack: resp.context[:use_dualstack_endpoint],
-                fips: resp.context.config.use_fips_endpoint
-              }
-            )
-            !resp.context.http_request.endpoint.hostname.include?(resolved_suffix)
-          end
-
           def wrong_sigv4_region?(resp)
             resp.context.http_response.status_code == 400 &&
               (resp.context.http_response.headers['x-amz-bucket-region'] ||
@@ -191,18 +120,14 @@ module Aws
               context, actual_region
             )
             context.metadata[:redirect_region] = actual_region
-            # if it's an ARN, use the service in the ARN
-            if (arn = context.metadata[:s3_arn])
-              service = arn[:arn].service
-            end
-            Aws::Plugins::SignatureV4.apply_signature(
-              context: context,
-              signer: S3Signer.build_v4_signer(
-                service: service || 's3',
-                region: actual_region,
-                credentials: context.config.credentials
-              )
+
+            signer = Aws::Plugins::Sign.signer_for(
+              context[:auth_scheme],
+              context.config,
+              actual_region
             )
+
+            signer.sign(context)
           end
 
           def region_from_body(body)
@@ -228,41 +153,22 @@ module Aws
         end
 
         class << self
-          # @option options [required, String] :region
-          # @option options [required, #credentials] :credentials
-          # @api private
-          def build_v4_signer(options = {})
-            Aws::Sigv4::Signer.new(
-              service: options[:service],
-              region: options[:region],
-              credentials_provider: options[:credentials],
-              signing_algorithm: options.fetch(:signing_algorithm, :sigv4),
-              uri_escape_path: false,
-              unsigned_headers: ['content-length', 'x-amzn-trace-id']
-            )
+          def new_hostname(context, region)
+            endpoint_params = context[:endpoint_params].dup
+            endpoint_params.region = region
+            endpoint_params.endpoint = nil
+            endpoint =
+              context.config.endpoint_provider.resolve_endpoint(endpoint_params)
+            URI(endpoint.url).host
           end
 
-          # Check to see if the bucket is actually an ARN
-          # Otherwise it will retry with the ARN as the bucket name.
-          def new_hostname(context, region)
-            uri = URI.parse(
-              Aws::Partitions::EndpointProvider.resolve(
-                region, 's3', 'regional',
-                {
-                  dualstack: context[:use_dualstack_endpoint],
-                  fips: context.config.use_fips_endpoint
-                }
-              )
-            )
+          def custom_endpoint?(context)
+            region = context.config.region
+            partition = Aws::Endpoints::Matchers.aws_partition(region)
+            endpoint = context.http_request.endpoint
 
-            if (arn = context.metadata[:s3_arn])
-              # Retry with the response region and not the ARN resolved one
-              ARN.resolve_url!(
-                uri, arn[:arn], region, arn[:fips], arn[:dualstack]
-              ).host
-            else
-              "#{context.params[:bucket]}.#{uri.host}"
-            end
+            !endpoint.hostname.include?(partition['dnsSuffix']) &&
+              !endpoint.hostname.include?(partition['dualStackDnsSuffix'])
           end
         end
       end

data/lib/aws-sdk-s3/presigned_post.rb

@@ -629,22 +629,15 @@ module Aws
       end
 
       def bucket_url
-        url = Aws::Partitions::EndpointProvider.resolve(@bucket_region, 's3')
-        url = URI.parse(url)
-        if Plugins::BucketDns.dns_compatible?(@bucket_name, _ssl = true)
-          if @accelerate
-            url.host = "#{@bucket_name}.s3-accelerate.amazonaws.com"
-          else
-            url.host = "#{@bucket_name}.#{url.host}"
-          end
-        else
-          url.path = "/#{@bucket_name}"
-        end
-        if @bucket_region == 'us-east-1'
-          # keep legacy behavior by default
-          url.host = Plugins::IADRegionalEndpoint.legacy_host(url.host)
-        end
-        url.to_s
+        # Taken from Aws::S3::Endpoints module
+        params = Aws::S3::EndpointParameters.new(
+          bucket: @bucket_name,
+          region: @bucket_region,
+          accelerate: @accelerate,
+          use_global_endpoint: true
+        )
+        endpoint = Aws::S3::EndpointProvider.new.resolve_endpoint(params)
+        endpoint.url
       end
 
       # @return [Hash]

data/lib/aws-sdk-s3/presigner.rb

@@ -133,7 +133,7 @@ module Aws
         virtual_host = params.delete(:virtual_host)
         time = params.delete(:time)
         unsigned_headers = unsigned_headers(params)
-        scheme = http_scheme(params)
+        secure = params.delete(:secure) != false
         expires_in = expires_in(params)
 
         req = @client.build_request(method, params)
@@ -141,7 +141,7 @@ module Aws
         handle_presigned_url_context(req)
 
         x_amz_headers = sign_but_dont_send(
-          req, expires_in, scheme, time, unsigned_headers, hoist
+          req, expires_in, secure, time, unsigned_headers, hoist
         )
         [req.send_request.data, x_amz_headers]
       end
@@ -151,14 +151,6 @@ module Aws
         BLACKLISTED_HEADERS - whitelist_headers
       end
 
-      def http_scheme(params)
-        if params.delete(:secure) == false
-          'http'
-        else
-          @client.config.endpoint.scheme
-        end
-      end
-
       def expires_in(params)
         if (expires_in = params.delete(:expires_in))
           if expires_in > ONE_WEEK
@@ -175,8 +167,7 @@ module Aws
       end
 
       def use_bucket_as_hostname(req)
-        req.handlers.remove(Plugins::BucketDns::Handler)
-        req.handle do |context|
+        req.handle(priority: 35) do |context|
           uri = context.http_request.endpoint
           uri.host = context.params[:bucket]
           uri.path.sub!("/#{context.params[:bucket]}", '')
@@ -197,22 +188,21 @@ module Aws
 
       # @param [Seahorse::Client::Request] req
       def sign_but_dont_send(
-        req, expires_in, scheme, time, unsigned_headers, hoist = true
+        req, expires_in, secure, time, unsigned_headers, hoist = true
       )
         x_amz_headers = {}
 
         http_req = req.context.http_request
 
         req.handlers.remove(Aws::S3::Plugins::S3Signer::LegacyHandler)
-        req.handlers.remove(Aws::S3::Plugins::S3Signer::V4Handler)
+        req.handlers.remove(Aws::Plugins::Sign::Handler)
         req.handlers.remove(Seahorse::Client::Plugins::ContentLength::Handler)
 
         req.handle(step: :send) do |context|
-          if scheme != http_req.endpoint.scheme
-            endpoint = http_req.endpoint.dup
-            endpoint.scheme = scheme
-            endpoint.port = (scheme == 'http' ? 80 : 443)
-            http_req.endpoint = URI.parse(endpoint.to_s)
+          # if an endpoint was not provided, force secure or insecure
+          if context.config.regional_endpoint
+            http_req.endpoint.scheme = secure ? 'https' : 'http'
+            http_req.endpoint.port = secure ? 443 : 80
           end
 
           query = http_req.endpoint.query ? http_req.endpoint.query.split('&') : []
@@ -231,24 +221,21 @@ module Aws
           end
           http_req.endpoint.query = query.join('&') unless query.empty?
 
-          signing_algorithm = :sigv4
-
-          # If it's an ARN, get the resolved region and service
-          if (arn = context.metadata[:s3_arn])
-            region = arn[:resolved_region]
-            service = arn[:arn].service
-            region = arn[:arn].is_a?(MultiRegionAccessPointARN) ? '*': arn[:resolved_region]
-            signing_algorithm = arn[:arn].is_a?(MultiRegionAccessPointARN) ? :sigv4a : :sigv4
-          end
-
+          auth_scheme = context[:auth_scheme]
+          scheme_name = auth_scheme['name']
+          region = if scheme_name == 'sigv4a'
+                     auth_scheme['signingRegionSet'].first
+                   else
+                     auth_scheme['signingRegion']
+                   end
           signer = Aws::Sigv4::Signer.new(
-            service: service || 's3',
+            service: auth_scheme['signingName'] || 's3',
             region: region || context.config.region,
-            signing_algorithm: signing_algorithm,
             credentials_provider: context.config.credentials,
+            signing_algorithm: scheme_name.to_sym,
+            uri_escape_path: !!!auth_scheme['disableDoubleEncoding'],
             unsigned_headers: unsigned_headers,
-            apply_checksum_header: false,
-            uri_escape_path: false
+            apply_checksum_header: false
           )
 
           url = signer.presign_url(

data/lib/aws-sdk-s3/resource.rb

@@ -41,7 +41,7 @@ module Aws::S3
     #     acl: "private", # accepts private, public-read, public-read-write, authenticated-read
     #     bucket: "BucketName", # required
     #     create_bucket_configuration: {
-    #       location_constraint: "af-south-1", # accepts af-south-1, ap-east-1, ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, cn-north-1, cn-northwest-1, EU, eu-central-1, eu-north-1, eu-south-1, eu-west-1, eu-west-2, eu-west-3, me-south-1, sa-east-1, us-east-2, us-gov-east-1, us-gov-west-1, us-west-1, us-west-2
+    #       location_constraint: "af-south-1", # accepts af-south-1, ap-east-1, ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ap-southeast-3, ca-central-1, cn-north-1, cn-northwest-1, EU, eu-central-1, eu-north-1, eu-south-1, eu-west-1, eu-west-2, eu-west-3, me-south-1, sa-east-1, us-east-2, us-gov-east-1, us-gov-west-1, us-west-1, us-west-2
     #     },
     #     grant_full_control: "GrantFullControl",
     #     grant_read: "GrantRead",
@@ -94,7 +94,9 @@ module Aws::S3
     #   equivalent form of this ACL expressed in the XML format.
     # @return [Bucket]
     def create_bucket(options = {})
-      @client.create_bucket(options)
+      Aws::Plugins::UserAgent.feature('resource') do
+        @client.create_bucket(options)
+      end
       Bucket.new(
         name: options[:bucket],
         client: @client
@@ -120,7 +122,9 @@ module Aws::S3
     def buckets(options = {})
       batches = Enumerator.new do |y|
         batch = []
-        resp = @client.list_buckets(options)
+        resp = Aws::Plugins::UserAgent.feature('resource') do
+          @client.list_buckets(options)
+        end
         resp.data.buckets.each do |b|
           batch << Bucket.new(
             name: b.name,