aws-sdk-s3 1.96.2 → 1.117.2

data/lib/aws-sdk-s3/plugins/endpoints.rb

@@ -0,0 +1,262 @@
+# frozen_string_literal: true
+
+# WARNING ABOUT GENERATED CODE
+#
+# This file is generated. See the contributing guide for more information:
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
+#
+# WARNING ABOUT GENERATED CODE
+
+
+module Aws::S3
+  module Plugins
+    class Endpoints < Seahorse::Client::Plugin
+      option(
+        :endpoint_provider,
+        doc_type: 'Aws::S3::EndpointProvider',
+        docstring: 'The endpoint provider used to resolve endpoints. Any '\
+                   'object that responds to `#resolve_endpoint(parameters)` '\
+                   'where `parameters` is a Struct similar to '\
+                   '`Aws::S3::EndpointParameters`'
+      ) do |cfg|
+        Aws::S3::EndpointProvider.new
+      end
+
+      # @api private
+      class Handler < Seahorse::Client::Handler
+        def call(context)
+          # If endpoint was discovered, do not resolve or apply the endpoint.
+          unless context[:discovered_endpoint]
+            params = parameters_for_operation(context)
+            endpoint = context.config.endpoint_provider.resolve_endpoint(params)
+
+            context.http_request.endpoint = endpoint.url
+            apply_endpoint_headers(context, endpoint.headers)
+          end
+
+          context[:endpoint_params] = params
+          context[:auth_scheme] =
+            Aws::Endpoints.resolve_auth_scheme(context, endpoint)
+
+          @handler.call(context)
+        end
+
+        private
+
+        def apply_endpoint_headers(context, headers)
+          headers.each do |key, values|
+            value = values
+              .compact
+              .map { |s| Seahorse::Util.escape_header_list_string(s.to_s) }
+              .join(',')
+
+            context.http_request.headers[key] = value
+          end
+        end
+
+        def parameters_for_operation(context)
+          case context.operation_name
+          when :abort_multipart_upload
+            Aws::S3::Endpoints::AbortMultipartUpload.build(context)
+          when :complete_multipart_upload
+            Aws::S3::Endpoints::CompleteMultipartUpload.build(context)
+          when :copy_object
+            Aws::S3::Endpoints::CopyObject.build(context)
+          when :create_bucket
+            Aws::S3::Endpoints::CreateBucket.build(context)
+          when :create_multipart_upload
+            Aws::S3::Endpoints::CreateMultipartUpload.build(context)
+          when :delete_bucket
+            Aws::S3::Endpoints::DeleteBucket.build(context)
+          when :delete_bucket_analytics_configuration
+            Aws::S3::Endpoints::DeleteBucketAnalyticsConfiguration.build(context)
+          when :delete_bucket_cors
+            Aws::S3::Endpoints::DeleteBucketCors.build(context)
+          when :delete_bucket_encryption
+            Aws::S3::Endpoints::DeleteBucketEncryption.build(context)
+          when :delete_bucket_intelligent_tiering_configuration
+            Aws::S3::Endpoints::DeleteBucketIntelligentTieringConfiguration.build(context)
+          when :delete_bucket_inventory_configuration
+            Aws::S3::Endpoints::DeleteBucketInventoryConfiguration.build(context)
+          when :delete_bucket_lifecycle
+            Aws::S3::Endpoints::DeleteBucketLifecycle.build(context)
+          when :delete_bucket_metrics_configuration
+            Aws::S3::Endpoints::DeleteBucketMetricsConfiguration.build(context)
+          when :delete_bucket_ownership_controls
+            Aws::S3::Endpoints::DeleteBucketOwnershipControls.build(context)
+          when :delete_bucket_policy
+            Aws::S3::Endpoints::DeleteBucketPolicy.build(context)
+          when :delete_bucket_replication
+            Aws::S3::Endpoints::DeleteBucketReplication.build(context)
+          when :delete_bucket_tagging
+            Aws::S3::Endpoints::DeleteBucketTagging.build(context)
+          when :delete_bucket_website
+            Aws::S3::Endpoints::DeleteBucketWebsite.build(context)
+          when :delete_object
+            Aws::S3::Endpoints::DeleteObject.build(context)
+          when :delete_object_tagging
+            Aws::S3::Endpoints::DeleteObjectTagging.build(context)
+          when :delete_objects
+            Aws::S3::Endpoints::DeleteObjects.build(context)
+          when :delete_public_access_block
+            Aws::S3::Endpoints::DeletePublicAccessBlock.build(context)
+          when :get_bucket_accelerate_configuration
+            Aws::S3::Endpoints::GetBucketAccelerateConfiguration.build(context)
+          when :get_bucket_acl
+            Aws::S3::Endpoints::GetBucketAcl.build(context)
+          when :get_bucket_analytics_configuration
+            Aws::S3::Endpoints::GetBucketAnalyticsConfiguration.build(context)
+          when :get_bucket_cors
+            Aws::S3::Endpoints::GetBucketCors.build(context)
+          when :get_bucket_encryption
+            Aws::S3::Endpoints::GetBucketEncryption.build(context)
+          when :get_bucket_intelligent_tiering_configuration
+            Aws::S3::Endpoints::GetBucketIntelligentTieringConfiguration.build(context)
+          when :get_bucket_inventory_configuration
+            Aws::S3::Endpoints::GetBucketInventoryConfiguration.build(context)
+          when :get_bucket_lifecycle
+            Aws::S3::Endpoints::GetBucketLifecycle.build(context)
+          when :get_bucket_lifecycle_configuration
+            Aws::S3::Endpoints::GetBucketLifecycleConfiguration.build(context)
+          when :get_bucket_location
+            Aws::S3::Endpoints::GetBucketLocation.build(context)
+          when :get_bucket_logging
+            Aws::S3::Endpoints::GetBucketLogging.build(context)
+          when :get_bucket_metrics_configuration
+            Aws::S3::Endpoints::GetBucketMetricsConfiguration.build(context)
+          when :get_bucket_notification
+            Aws::S3::Endpoints::GetBucketNotification.build(context)
+          when :get_bucket_notification_configuration
+            Aws::S3::Endpoints::GetBucketNotificationConfiguration.build(context)
+          when :get_bucket_ownership_controls
+            Aws::S3::Endpoints::GetBucketOwnershipControls.build(context)
+          when :get_bucket_policy
+            Aws::S3::Endpoints::GetBucketPolicy.build(context)
+          when :get_bucket_policy_status
+            Aws::S3::Endpoints::GetBucketPolicyStatus.build(context)
+          when :get_bucket_replication
+            Aws::S3::Endpoints::GetBucketReplication.build(context)
+          when :get_bucket_request_payment
+            Aws::S3::Endpoints::GetBucketRequestPayment.build(context)
+          when :get_bucket_tagging
+            Aws::S3::Endpoints::GetBucketTagging.build(context)
+          when :get_bucket_versioning
+            Aws::S3::Endpoints::GetBucketVersioning.build(context)
+          when :get_bucket_website
+            Aws::S3::Endpoints::GetBucketWebsite.build(context)
+          when :get_object
+            Aws::S3::Endpoints::GetObject.build(context)
+          when :get_object_acl
+            Aws::S3::Endpoints::GetObjectAcl.build(context)
+          when :get_object_attributes
+            Aws::S3::Endpoints::GetObjectAttributes.build(context)
+          when :get_object_legal_hold
+            Aws::S3::Endpoints::GetObjectLegalHold.build(context)
+          when :get_object_lock_configuration
+            Aws::S3::Endpoints::GetObjectLockConfiguration.build(context)
+          when :get_object_retention
+            Aws::S3::Endpoints::GetObjectRetention.build(context)
+          when :get_object_tagging
+            Aws::S3::Endpoints::GetObjectTagging.build(context)
+          when :get_object_torrent
+            Aws::S3::Endpoints::GetObjectTorrent.build(context)
+          when :get_public_access_block
+            Aws::S3::Endpoints::GetPublicAccessBlock.build(context)
+          when :head_bucket
+            Aws::S3::Endpoints::HeadBucket.build(context)
+          when :head_object
+            Aws::S3::Endpoints::HeadObject.build(context)
+          when :list_bucket_analytics_configurations
+            Aws::S3::Endpoints::ListBucketAnalyticsConfigurations.build(context)
+          when :list_bucket_intelligent_tiering_configurations
+            Aws::S3::Endpoints::ListBucketIntelligentTieringConfigurations.build(context)
+          when :list_bucket_inventory_configurations
+            Aws::S3::Endpoints::ListBucketInventoryConfigurations.build(context)
+          when :list_bucket_metrics_configurations
+            Aws::S3::Endpoints::ListBucketMetricsConfigurations.build(context)
+          when :list_buckets
+            Aws::S3::Endpoints::ListBuckets.build(context)
+          when :list_multipart_uploads
+            Aws::S3::Endpoints::ListMultipartUploads.build(context)
+          when :list_object_versions
+            Aws::S3::Endpoints::ListObjectVersions.build(context)
+          when :list_objects
+            Aws::S3::Endpoints::ListObjects.build(context)
+          when :list_objects_v2
+            Aws::S3::Endpoints::ListObjectsV2.build(context)
+          when :list_parts
+            Aws::S3::Endpoints::ListParts.build(context)
+          when :put_bucket_accelerate_configuration
+            Aws::S3::Endpoints::PutBucketAccelerateConfiguration.build(context)
+          when :put_bucket_acl
+            Aws::S3::Endpoints::PutBucketAcl.build(context)
+          when :put_bucket_analytics_configuration
+            Aws::S3::Endpoints::PutBucketAnalyticsConfiguration.build(context)
+          when :put_bucket_cors
+            Aws::S3::Endpoints::PutBucketCors.build(context)
+          when :put_bucket_encryption
+            Aws::S3::Endpoints::PutBucketEncryption.build(context)
+          when :put_bucket_intelligent_tiering_configuration
+            Aws::S3::Endpoints::PutBucketIntelligentTieringConfiguration.build(context)
+          when :put_bucket_inventory_configuration
+            Aws::S3::Endpoints::PutBucketInventoryConfiguration.build(context)
+          when :put_bucket_lifecycle
+            Aws::S3::Endpoints::PutBucketLifecycle.build(context)
+          when :put_bucket_lifecycle_configuration
+            Aws::S3::Endpoints::PutBucketLifecycleConfiguration.build(context)
+          when :put_bucket_logging
+            Aws::S3::Endpoints::PutBucketLogging.build(context)
+          when :put_bucket_metrics_configuration
+            Aws::S3::Endpoints::PutBucketMetricsConfiguration.build(context)
+          when :put_bucket_notification
+            Aws::S3::Endpoints::PutBucketNotification.build(context)
+          when :put_bucket_notification_configuration
+            Aws::S3::Endpoints::PutBucketNotificationConfiguration.build(context)
+          when :put_bucket_ownership_controls
+            Aws::S3::Endpoints::PutBucketOwnershipControls.build(context)
+          when :put_bucket_policy
+            Aws::S3::Endpoints::PutBucketPolicy.build(context)
+          when :put_bucket_replication
+            Aws::S3::Endpoints::PutBucketReplication.build(context)
+          when :put_bucket_request_payment
+            Aws::S3::Endpoints::PutBucketRequestPayment.build(context)
+          when :put_bucket_tagging
+            Aws::S3::Endpoints::PutBucketTagging.build(context)
+          when :put_bucket_versioning
+            Aws::S3::Endpoints::PutBucketVersioning.build(context)
+          when :put_bucket_website
+            Aws::S3::Endpoints::PutBucketWebsite.build(context)
+          when :put_object
+            Aws::S3::Endpoints::PutObject.build(context)
+          when :put_object_acl
+            Aws::S3::Endpoints::PutObjectAcl.build(context)
+          when :put_object_legal_hold
+            Aws::S3::Endpoints::PutObjectLegalHold.build(context)
+          when :put_object_lock_configuration
+            Aws::S3::Endpoints::PutObjectLockConfiguration.build(context)
+          when :put_object_retention
+            Aws::S3::Endpoints::PutObjectRetention.build(context)
+          when :put_object_tagging
+            Aws::S3::Endpoints::PutObjectTagging.build(context)
+          when :put_public_access_block
+            Aws::S3::Endpoints::PutPublicAccessBlock.build(context)
+          when :restore_object
+            Aws::S3::Endpoints::RestoreObject.build(context)
+          when :select_object_content
+            Aws::S3::Endpoints::SelectObjectContent.build(context)
+          when :upload_part
+            Aws::S3::Endpoints::UploadPart.build(context)
+          when :upload_part_copy
+            Aws::S3::Endpoints::UploadPartCopy.build(context)
+          when :write_get_object_response
+            Aws::S3::Endpoints::WriteGetObjectResponse.build(context)
+          end
+        end
+      end
+
+      def add_handlers(handlers, _config)
+        handlers.add(Handler, step: :build, priority: 75)
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/plugins/expect_100_continue.rb

@@ -16,7 +16,8 @@ module Aws
 
           def call(context)
             body = context.http_request.body
-            if body.respond_to?(:size) && body.size > 0
+            if body.respond_to?(:size) && body.size > 0 &&
+               !context[:use_accelerate_endpoint]
               context.http_request.headers['expect'] = '100-continue'
             end
             @handler.call(context)

data/lib/aws-sdk-s3/plugins/iad_regional_endpoint.rb

@@ -16,40 +16,17 @@ Defaults to `legacy` mode which uses the global endpoint.
           resolve_iad_regional_endpoint(cfg)
         end
 
-        def add_handlers(handlers, config)
-          # only modify non-custom endpoints
-          if config.regional_endpoint && config.region == 'us-east-1'
-            handlers.add(Handler)
-          end
-        end
-
-        # @api private
-        class Handler < Seahorse::Client::Handler
-
-          def call(context)
-            # WriteGetObjectResponse does not have a global endpoint
-            # ARNs are regionalized, so don't touch those either.
-            if context.operation.name != 'WriteGetObjectResponse' &&
-               context.config.s3_us_east_1_regional_endpoint == 'legacy' &&
-               !context.metadata[:s3_arn]
-              host = context.http_request.endpoint.host
-              legacy_host = IADRegionalEndpoint.legacy_host(host)
-              context.http_request.endpoint.host = legacy_host
-            end
-            @handler.call(context)
-          end
-
-        end
-
-        def self.legacy_host(host)
-          host.sub(".us-east-1", '')
-        end
-
         private
 
         def self.resolve_iad_regional_endpoint(cfg)
+          default_mode_value =
+            if cfg.respond_to?(:defaults_mode_config_resolver)
+              cfg.defaults_mode_config_resolver.resolve(:s3_us_east_1_regional_endpoint)
+            end
+
           mode = ENV['AWS_S3_US_EAST_1_REGIONAL_ENDPOINT'] ||
             Aws.shared_config.s3_us_east_1_regional_endpoint(profile: cfg.profile) ||
+            default_mode_value ||
             'legacy'
           mode = mode.downcase
           unless %w(legacy regional).include?(mode)

data/lib/aws-sdk-s3/plugins/md5s.rb

@@ -22,9 +22,11 @@ module Aws
           CHUNK_SIZE = 1 * 1024 * 1024 # one MB
 
           def call(context)
-            body = context.http_request.body
-            if body.respond_to?(:size) && body.size > 0
-              context.http_request.headers['Content-Md5'] ||= md5(body)
+            if !context[:checksum_algorithms] # skip in favor of flexible checksum
+              body = context.http_request.body
+              if body.respond_to?(:size) && body.size > 0
+                context.http_request.headers['Content-Md5'] ||= md5(body)
+              end
             end
             @handler.call(context)
           end

data/lib/aws-sdk-s3/plugins/s3_signer.rb

@@ -5,26 +5,13 @@ require 'aws-sigv4'
 module Aws
   module S3
     module Plugins
-      # This plugin is an implementation detail and may be modified.
+      # This plugin used to have a V4 signer but it was removed in favor of
+      # generic Sign plugin that uses endpoint auth scheme.
+      #
       # @api private
       class S3Signer < Seahorse::Client::Plugin
         option(:signature_version, 'v4')
 
-        option(:sigv4_signer) do |cfg|
-          S3Signer.build_v4_signer(
-            service: 's3',
-            region: cfg.sigv4_region,
-            credentials: cfg.credentials
-          )
-        end
-
-        option(:sigv4_region) do |cfg|
-          # S3 removes core's signature_v4 plugin that checks for this
-          raise Aws::Errors::MissingRegionError if cfg.region.nil?
-
-          Aws::Partitions::EndpointProvider.signing_region(cfg.region, 's3')
-        end
-
         def add_handlers(handlers, cfg)
           case cfg.signature_version
           when 'v4' then add_v4_handlers(handlers)
@@ -37,11 +24,11 @@ module Aws
 
         def add_v4_handlers(handlers)
           handlers.add(CachedBucketRegionHandler, step: :sign, priority: 60)
-          handlers.add(V4Handler, step: :sign)
           handlers.add(BucketRegionErrorHandler, step: :sign, priority: 40)
         end
 
         def add_legacy_handler(handlers)
+          # generic Sign plugin will be skipped if it sees sigv2
           handlers.add(LegacyHandler, step: :sign)
         end
 
@@ -52,45 +39,6 @@ module Aws
           end
         end
 
-        class V4Handler < Seahorse::Client::Handler
-          def call(context)
-            Aws::Plugins::SignatureV4.apply_signature(
-              context: context,
-              signer: sigv4_signer(context)
-            )
-            @handler.call(context)
-          end
-
-          private
-
-          def sigv4_signer(context)
-            # If the client was configured with the wrong region,
-            # we have to build a new signer.
-            if context[:cached_sigv4_region] &&
-               context[:cached_sigv4_region] != context.config.sigv4_signer.region
-              S3Signer.build_v4_signer(
-                service: 's3',
-                region: context[:cached_sigv4_region],
-                credentials: context.config.credentials
-              )
-            elsif (arn = context.metadata[:s3_arn])
-              S3Signer.build_v4_signer(
-                service: arn[:arn].service,
-                region: arn[:resolved_region],
-                credentials: context.config.credentials
-              )
-            elsif context.operation.name == 'WriteGetObjectResponse'
-              S3Signer.build_v4_signer(
-                service: 's3-object-lambda',
-                region: context.config.sigv4_region,
-                credentials: context.config.credentials
-              )
-            else
-              context.config.sigv4_signer
-            end
-          end
-        end
-
         # This handler will update the http endpoint when the bucket region
         # is known/cached.
         class CachedBucketRegionHandler < Seahorse::Client::Handler
@@ -108,7 +56,7 @@ module Aws
               context.http_request.endpoint.host = S3Signer.new_hostname(
                 context, cached_region
               )
-              context[:cached_sigv4_region] = cached_region
+              context[:sigv4_region] = cached_region # Sign plugin will use this
             end
           end
         end
@@ -116,7 +64,8 @@ module Aws
         # This handler detects when a request fails because of a mismatched bucket
         # region. It follows up by making a request to determine the correct
         # region, then finally a version 4 signed request against the correct
-        # regional endpoint.
+        # regional endpoint. This is intended for s3's global endpoint which
+        # will return 400 if the bucket is not in region.
         class BucketRegionErrorHandler < Seahorse::Client::Handler
           def call(context)
             response = @handler.call(context)
@@ -128,7 +77,8 @@ module Aws
           def handle_region_errors(response)
             if wrong_sigv4_region?(response) &&
                !fips_region?(response) &&
-               !custom_endpoint?(response)
+               !custom_endpoint?(response) &&
+               !expired_credentials?(response)
               get_region_and_retry(response.context)
             else
               response
@@ -149,14 +99,20 @@ module Aws
           end
 
           def fips_region?(resp)
-            resp.context.http_request.endpoint.host.include?('fips')
+            resp.context.http_request.endpoint.host.include?('s3-fips.')
+          end
+
+          def expired_credentials?(resp)
+            resp.context.http_response.body_contents.match(/<Code>ExpiredToken<\/Code>/)
           end
 
           def custom_endpoint?(resp)
-            resolved_suffix = Aws::Partitions::EndpointProvider.dns_suffix_for(
-              resp.context.config.region
-            )
-            !resp.context.http_request.endpoint.hostname.include?(resolved_suffix)
+            region = resp.context.config.region
+            partition = Aws::Endpoints::Matchers.aws_partition(region)
+            endpoint = resp.context.http_request.endpoint
+
+            !endpoint.hostname.include?(partition['dnsSuffix']) &&
+              !endpoint.hostname.include?(partition['dualStackDnsSuffix'])
           end
 
           def wrong_sigv4_region?(resp)
@@ -171,18 +127,14 @@ module Aws
               context, actual_region
             )
             context.metadata[:redirect_region] = actual_region
-            # if it's an ARN, use the service in the ARN
-            if (arn = context.metadata[:s3_arn])
-              service = arn[:arn].service
-            end
-            Aws::Plugins::SignatureV4.apply_signature(
-              context: context,
-              signer: S3Signer.build_v4_signer(
-                service: service || 's3',
-                region: actual_region,
-                credentials: context.config.credentials
-              )
+
+            signer = Aws::Plugins::Sign.signer_for(
+              context[:auth_scheme],
+              context.config,
+              actual_region
             )
+
+            signer.sign(context)
           end
 
           def region_from_body(body)
@@ -208,32 +160,13 @@ module Aws
         end
 
         class << self
-          # @option options [required, String] :region
-          # @option options [required, #credentials] :credentials
-          # @api private
-          def build_v4_signer(options = {})
-            Aws::Sigv4::Signer.new(
-              service: options[:service],
-              region: options[:region],
-              credentials_provider: options[:credentials],
-              uri_escape_path: false,
-              unsigned_headers: ['content-length', 'x-amzn-trace-id']
-            )
-          end
-
-          # Check to see if the bucket is actually an ARN
-          # Otherwise it will retry with the ARN as the bucket name.
           def new_hostname(context, region)
-            uri = URI.parse(
-              Aws::Partitions::EndpointProvider.resolve(region, 's3')
-            )
-
-            if (arn = context.metadata[:s3_arn])
-              # Retry with the response region and not the ARN resolved one
-              ARN.resolve_url!(uri, arn[:arn], region).host
-            else
-              "#{context.params[:bucket]}.#{uri.host}"
-            end
+            endpoint_params = context[:endpoint_params].dup
+            endpoint_params.region = region
+            endpoint_params.endpoint = nil
+            endpoint =
+              context.config.endpoint_provider.resolve_endpoint(endpoint_params)
+            URI(endpoint.url).host
           end
         end
       end

data/lib/aws-sdk-s3/plugins/skip_whole_multipart_get_checksums.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module Plugins
+
+      # S3 GetObject results for whole Multipart Objects contain a checksum
+      # that cannot be validated.  These should be skipped by the
+      # ChecksumAlgorithm plugin.
+      class SkipWholeMultipartGetChecksums < Seahorse::Client::Plugin
+
+        class Handler < Seahorse::Client::Handler
+
+          def call(context)
+            context[:http_checksum] ||= {}
+            context[:http_checksum][:skip_on_suffix] = true
+
+            @handler.call(context)
+          end
+
+        end
+
+        handler(
+          Handler,
+          step: :initialize,
+          operations: [:get_object]
+        )
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/plugins/streaming_retry.rb

@@ -36,6 +36,17 @@ module Aws
         def rewind; end
       end
 
+      class NonRetryableStreamingError < StandardError
+
+        def initialize(error)
+          super('Unable to retry request - retry could result in processing duplicated chunks.')
+          set_backtrace(error.backtrace)
+          @original_error = error
+        end
+
+        attr_reader :original_error
+      end
+
       # This handler works with the ResponseTarget plugin to provide smart
       # retries of S3 streaming operations that support the range parameter
       # (currently only: get_object).  When a 200 OK with a TruncatedBodyError
@@ -84,8 +95,18 @@ module Aws
             end
 
             context.http_response.on_error do |error|
-              if retryable_body?(context) && truncated_body?(error)
-                context.http_request.headers[:range] = "bytes=#{context.http_response.body.size}-"
+              if retryable_body?(context)
+                if truncated_body?(error)
+                  context.http_request.headers[:range] = "bytes=#{context.http_response.body.size}-"
+                else
+                  case context.http_response.body
+                  when RetryableManagedFile
+                    # call rewind on the underlying file
+                    context.http_response.body.instance_variable_get(:@file).rewind
+                  else
+                    raise NonRetryableStreamingError, error
+                  end
+                end
               end
             end
           end