fog-aws 3.29.0 → 3.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7f23dd8cf46cc6931498a17606b5925c7baa068eb475304ca32dde49a4d09f43
-  data.tar.gz: a4fd978e97d03cdf1ba1b2cf69ed00e2889a62fd5eebf0942be12b31230cb1b8
+  metadata.gz: 58f44efcbc509f12c098d073f5017f022c54732dd9f88cf3c1bf4eb46b52d147
+  data.tar.gz: 395b5487e7be6a4aa25ddc7ee3fdd59bf413299f52305000ab50ee447c5d9cf0
 SHA512:
-  metadata.gz: 0f1f5cfe7d9c2d879e102fb4ca61f524b7e112d38d3d2ae9c0d5cd92cb2d6bdc6e5443067325de864c08d9308b47f79e9773c9a5fcc486a8bf77ec79b9825ffb
-  data.tar.gz: 4541a0ceb2e732d0679e03276c9dc074682d7288042e147f60495ea3dbc56d81f4db061a5b22a8d3ac5432acf62d9f775b2a1ec10f8ec16340d7b82375ba7f82
+  metadata.gz: c64513e607ac4d3f725e5f49096bbbdd44875d10290c81b5991c6821364e4bc8efd4f3b34f91ba0332837b7fb2fc26e987d1fd44b77617a7877b60b548718472
+  data.tar.gz: c2c96976eedb60cddba15f1193ac0167bbeaa3754b26b85aa4a7dd56a5031d704987cf96ef1648f45b1b59aa1b02e8404fcded2bbd6ea0c6b28abb6b2edc70d9

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [v3.30.0](https://github.com/fog/fog-aws/tree/v3.30.0) (2024-12-17)
+
+[Full Changelog](https://github.com/fog/fog-aws/compare/v3.29.0...v3.30.0)
+
+**Closed issues:**
+
+- Support S3 FIPS endpoints, disable S3 Transfer Acceleration in GovCloud or FIPS mode [\#729](https://github.com/fog/fog-aws/issues/729)
+
+**Merged pull requests:**
+
+- Bump fog/.github from 1.4.0 to 1.5.0 [\#732](https://github.com/fog/fog-aws/pull/732) ([dependabot[bot]](https://github.com/apps/dependabot))
+- kms additions [\#731](https://github.com/fog/fog-aws/pull/731) ([geemus](https://github.com/geemus))
+- Support FIPS endpoints, disable S3 Transfer Acceleration in GovCloud [\#730](https://github.com/fog/fog-aws/pull/730) ([matt-domsch-sp](https://github.com/matt-domsch-sp))
+
 ## [v3.29.0](https://github.com/fog/fog-aws/tree/v3.29.0) (2024-10-25)
 
 [Full Changelog](https://github.com/fog/fog-aws/compare/v3.28.0...v3.29.0)
@@ -20,14 +34,6 @@
 
 - Update SES to use AWS SigV4 [\#727](https://github.com/fog/fog-aws/pull/727) ([ohookins](https://github.com/ohookins))
 
-## [v3.27.0](https://github.com/fog/fog-aws/tree/v3.27.0) (2024-09-16)
-
-[Full Changelog](https://github.com/fog/fog-aws/compare/v3.26.0...v3.27.0)
-
-**Merged pull requests:**
-
-- avoid merging connection value from headers when saving files [\#725](https://github.com/fog/fog-aws/pull/725) ([geemus](https://github.com/geemus))
-
 
 
 \* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*

data/lib/fog/aws/kms.rb

@@ -20,6 +20,9 @@ module Fog
       request :list_keys
       request :create_key
       request :describe_key
+      request :get_public_key
+      request :schedule_key_deletion
+      request :sign
 
       model_path 'fog/aws/models/kms'
       model      :key
@@ -30,7 +33,8 @@ module Fog
           @data ||= Hash.new do |hash, region|
             hash[region] = Hash.new do |region_hash, access_key|
               region_hash[access_key] = {
-                :keys => {},
+                keys: {},
+                pkeys: {}
               }
             end
           end

data/lib/fog/aws/parsers/kms/describe_key.rb

@@ -17,9 +17,9 @@ module Fog
 
           def end_element(name)
             case name
-            when 'KeyUsage', 'AWSAccountId', 'Description', 'KeyId', 'Arn'
+            when 'Arn', 'AWSAccountId', 'Description', 'KeyId', 'KeySpec', 'KeyState', 'KeyUsage'
               @key[name] = value
-            when 'CreationDate'
+            when 'CreationDate', 'DeletionDate'
               @key[name] = Time.parse(value)
             when 'Enabled'
               @key[name] = (value == 'true')

data/lib/fog/aws/parsers/kms/get_public_key.rb

@@ -0,0 +1,30 @@
+module Fog
+  module Parsers
+    module AWS
+      module KMS
+        class GetPublicKey < Fog::Parsers::Base
+          def reset
+            @response = {}
+          end
+
+          def start_element(name, attrs = [])
+            super
+            case name
+            when 'EncryptionAlgorithms', 'KeyAgreementAlgorithms', 'SigningAlgorithms'
+              @response[name] = []
+            end
+          end
+
+          def end_element(name)
+            case name
+            when 'KeyId', 'KeySpec', 'KeyUsage', 'PublicKey'
+              @response[name] = value
+            when 'EncryptionAlgorithms', 'KeyAgreementAlgorithms', 'SigningAlgorithms'
+              @response[name] << value
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/fog/aws/parsers/kms/schedule_key_deletion.rb

@@ -0,0 +1,28 @@
+module Fog
+  module Parsers
+    module AWS
+      module KMS
+        class ScheduleKeyDeletion < Fog::Parsers::Base
+          def reset
+            @response = {}
+          end
+
+          def start_element(name, attrs = [])
+            super
+          end
+
+          def end_element(name)
+            case name
+            when 'DeletionDate'
+              @response[name] = Time.parse(value)
+            when 'KeyId', 'KeyState'
+              @response[name] = value
+            when 'PendingWindowInDays'
+              @response[name] = value.to_i
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/fog/aws/parsers/kms/sign.rb

@@ -0,0 +1,24 @@
+module Fog
+  module Parsers
+    module AWS
+      module KMS
+        class Sign < Fog::Parsers::Base
+          def reset
+            @response = {}
+          end
+
+          def start_element(name, attrs = [])
+            super
+          end
+
+          def end_element(name)
+            case name
+            when 'KeyId', 'Signature', 'SigningAlgorithm'
+              @response[name] = value
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/fog/aws/requests/kms/create_key.rb

@@ -2,61 +2,99 @@ module Fog
   module AWS
     class KMS
       class Real
-        DEFAULT_KEY_POLICY = <<-JSON
-{
-  "Version": "2012-10-17",
-  "Id": "key-default-1",
-  "Statement": [
-    {
-      "Sid": "Enable IAM User Permissions",
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "arn:aws:iam::915445820265:root"
-      },
-      "Action": "kms:*",
-      "Resource": "*"
-    }
-  ]
-}
-        JSON
-
         require 'fog/aws/parsers/kms/describe_key'
 
-        def create_key(policy = nil, description = nil, usage = "ENCRYPT_DECRYPT")
-          request(
-            'Action'      => 'CreateKey',
-            'Description' => description,
-            'KeyUsage'    => usage,
-            'Policy'      => policy,
-            :parser       => Fog::Parsers::AWS::KMS::DescribeKey.new
-          )
+        # Create Key
+        #
+        # ==== Parameters
+        # * options<~Hash>:
+        #   * 'Description'<~String>:
+        #   * 'KeyUsage'<~String>:
+        #   * 'Policy'<~String>:
+        #   * ... (see docs from see also)
+        #
+        # === Returns
+        #
+        # ==== See Also
+        # https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html
+        def create_key(*args)
+          options = Fog::AWS::KMS.parse_create_key_args(args)
+          request({
+            'Action' => 'CreateKey',
+            :parser => Fog::Parsers::AWS::KMS::DescribeKey.new
+          }.merge!(options))
         end
       end
 
       class Mock
-        def create_key(policy = nil, description = nil, usage = "ENCRYPT_DECRYPT")
+        def create_key(*args)
+          options = Fog::AWS::KMS.parse_create_key_args(args)
+
           response = Excon::Response.new
           key_id   = UUID.uuid
           key_arn  = Fog::AWS::Mock.arn("kms", self.account_id, "key/#{key_id}", @region)
 
           key = {
-            "KeyUsage"     => usage,
-            "AWSAccountId" => self.account_id,
-            "KeyId"        => key_id,
-            "Description"  => description,
-            "CreationDate" => Time.now,
-            "Arn"          => key_arn,
-            "Enabled"      => true,
-          }
+            'Arn' => key_arn,
+            'AWSAccountId' => self.account_id,
+            'CreationDate' => Time.now.utc,
+            'DeletionDate' => nil,
+            'Description' => nil,
+            'Enabled' => true,
+            'KeyId' => key_id,
+            'KeySpec' => 'SYMMETRIC_DEFAULT',
+            'KeyState' => 'Enabled',
+            'KeyUsage' => 'ENCRYPT_DECRYPT',
+            'Policy' => nil
+          }.merge!(options)
 
           # @todo use default policy
 
           self.data[:keys][key_id] = key
 
-          response.body = { "KeyMetadata" => key }
+          klass, arg = {
+            'ECC_NIST_P256' => [OpenSSL::PKey::EC, 'prime256v1'],
+            'ECC_NIST_P384' => [OpenSSL::PKey::EC, 'secp384r1'],
+            'ECC_NIST_P521' => [OpenSSL::PKey::EC, 'secp521r1'],
+            'ECC_SECG_P256K1' => [OpenSSL::PKey::EC, 'secp256k1'],
+            'RSA_2048' => [OpenSSL::PKey::RSA, 2048],
+            'RSA_3072' => [OpenSSL::PKey::RSA, 3072],
+            'RSA_4096' => [OpenSSL::PKey::RSA, 4096]
+          }[key['KeySpec']]
+          raise "Unknown or not-yet-implemented #{key['KeySpec']} KeySpec for kms create_key mocks" unless klass
+
+          self.data[:pkeys][key_id] = klass.generate(arg)
+
+          response.body = { 'KeyMetadata' => key }
           response
         end
       end
+
+      # previous args (policy, description, usage) was deprecated in favor of a hash of options
+      def self.parse_create_key_args(args)
+        case args.size
+        when 0
+          {}
+        when 1
+          if args[0].is_a?(Hash)
+            args[0]
+          else
+            Fog::Logger.deprecation("create_key with distinct arguments is deprecated, use options hash instead [light_black](#{caller.first})[/]")
+            {
+              'Policy' => args[0]
+            }
+          end
+        when 2, 3
+          Fog::Logger.deprecation("create_key with distinct arguments is deprecated, use options hash instead [light_black](#{caller.first})[/]")
+          {
+            'Policy' => args[0],
+            'Description' => args[1],
+            'KeyUsage' => args[2] || 'ENCRYPT_DECRYPT'
+          }
+        else
+          raise "Unknown argument style: #{args.inspect}, use options hash instead."
+        end
+      end
     end
   end
 end

data/lib/fog/aws/requests/kms/get_public_key.rb

@@ -0,0 +1,35 @@
+module Fog
+  module AWS
+    class KMS
+      class Real
+        require 'fog/aws/parsers/kms/get_public_key'
+
+        def get_public_key(identifier, grant_tokens = nil)
+          request(
+            'Action' => 'GetPublicKey',
+            'GrantTokens' => grant_tokens,
+            'KeyId' => identifier,
+            :parser => Fog::Parsers::AWS::KMS::GetPublicKey.new
+          )
+        end
+      end
+
+      class Mock
+        def get_public_key(identifier, _grant_tokens = [])
+          response = Excon::Response.new
+          key = self.data[:keys][identifier]
+          pkey = self.data[:pkeys][identifier]
+
+          response.body = {
+            'KeyId' => key['Arn'],
+            'KeyUsage' => key['KeyUsage'],
+            'KeySpec' => key['KeySpec'],
+            'PublicKey' => Base64.strict_encode64(pkey.public_to_der),
+            'SigningAlgorithms' => key['SigningAlgorithms']
+          }
+          response
+        end
+      end
+    end
+  end
+end

data/lib/fog/aws/requests/kms/list_keys.rb

@@ -2,7 +2,6 @@ module Fog
   module AWS
     class KMS
       class Real
-
         require 'fog/aws/parsers/kms/list_keys'
 
         def list_keys(options={})
@@ -43,9 +42,9 @@ module Fog
           key_set = if marker
                       self.data[:markers][marker] || []
                     else
-                      self.data[:keys].inject([]) { |r,(k,v)|
-                        r << { "KeyId" => k, "KeyArn" => v["Arn"] }
-                      }
+                      self.data[:keys].inject([]) do |r, (k, v)|
+                        r << { 'KeyArn' => v['Arn'], 'KeyId' => k }
+                      end
                     end
 
           keys = if limit

data/lib/fog/aws/requests/kms/schedule_key_deletion.rb

@@ -0,0 +1,37 @@
+module Fog
+  module AWS
+    class KMS
+      class Real
+        require 'fog/aws/parsers/kms/schedule_key_deletion'
+
+        def schedule_key_deletion(identifier, pending_window_in_days)
+          request(
+            'Action' => 'ScheduleKeyDeletion',
+            'KeyId' => identifier,
+            'PendingWindowInDays' => pending_window_in_days,
+            :parser => Fog::Parsers::AWS::KMS::ScheduleKeyDeletion.new
+          )
+        end
+      end
+
+      class Mock
+        def schedule_key_deletion(identifier, pending_window_in_days)
+          response = Excon::Response.new
+          key = self.data[:keys][identifier]
+
+          key['DeletionDate'] = Time.now + (60 * 60 * 24 * pending_window_in_days)
+          key['Enabled'] = false
+          key['KeyState'] = 'PendingDeletion'
+
+          response.body = {
+            'DeletionDate' => key['DeletionDate'],
+            'KeyId' => key['KeyId'],
+            'KeyState' => key['KeyState'],
+            'PendingWindowInDays' => pending_window_in_days
+          }
+          response
+        end
+      end
+    end
+  end
+end

data/lib/fog/aws/requests/kms/sign.rb

@@ -0,0 +1,62 @@
+module Fog
+  module AWS
+    class KMS
+      class Real
+        require 'fog/aws/parsers/kms/sign'
+
+        # Sign
+        #
+        # ==== Parameters
+        # * identifier<~String>: id, arn, alias name, or alias arn for key to sign with
+        # * message<~String>: base64 encoded message to sign
+        #
+        # === Returns
+        # * response<~Excon::Response>:
+        #
+        # ==== See Also
+        # https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html
+        #
+        def sign(identifier, message, algorithm, options = {})
+          request({
+            'Action' => 'Sign',
+            'KeyId' => identifier,
+            'Message' => message,
+            'SigningAlgorithm' => algorithm,
+            :parser => Fog::Parsers::AWS::KMS::Sign.new
+          }.merge!(options))
+        end
+      end
+
+      class Mock
+        def sign(identifier, message, algorithm, options = {})
+          response = Excon::Response.new
+          pkey = self.data[:pkeys][identifier]
+          unless pkey
+            response.status = 404
+            raise(Excon::Errors.status_error({ expects: 200 }, response))
+          end
+
+          data = Base64.decode64(message)
+
+          # FIXME: SM2 support?
+          sha = "SHA#{algorithm.split('_SHA_').last}"
+          signopts = {}
+          signopts[:rsa_padding_mode] = 'pss' if algorithm.start_with?('RSASSA_PSS')
+
+          signature = if options['MessageType'] == 'DIGEST'
+                        pkey.sign_raw(sha, data, signopts)
+                      else
+                        pkey.sign(sha, data, signopts)
+                      end
+
+          response.body = {
+            'KeyId' => identifier,
+            'Signature' => Base64.strict_encode64(signature),
+            'SigningAlgorithm' => algorithm
+          }
+          response
+        end
+      end
+    end
+  end
+end

data/lib/fog/aws/storage.rb

@@ -7,6 +7,8 @@ module Fog
 
       DEFAULT_REGION = 'us-east-1'
       ACCELERATION_HOST = 's3-accelerate.amazonaws.com'
+      AWS_FIPS_REGIONS = %w(us-east-1 us-east-2 us-west-1 us-west-2 us-gov-east-1 us-gov-west-1 ca-central-1 ca-west-1).freeze
+      AWS_GOVCLOUD_REGIONS = %w(us-gov-east-1 us-gov-west-1).freeze
 
       DEFAULT_SCHEME = 'https'
       DEFAULT_SCHEME_PORT = {
@@ -258,13 +260,17 @@ module Fog
         end
 
         def region_to_host(region=nil)
-          case region.to_s
-          when DEFAULT_REGION, ''
-            's3.amazonaws.com'
-          when %r{\Acn-.*}
-            "s3.#{region}.amazonaws.com.cn"
+          if ENV['AWS_USE_FIPS_ENDPOINT'] == 'true' && AWS_FIPS_REGIONS.include?(region)
+            "s3-fips.#{region}.amazonaws.com" # https://aws.amazon.com/compliance/fips/
           else
-            "s3.#{region}.amazonaws.com"
+            case region.to_s
+            when DEFAULT_REGION, ''
+              's3.amazonaws.com'
+            when %r{\Acn-.*}
+              "s3.#{region}.amazonaws.com.cn"
+            else
+              "s3.#{region}.amazonaws.com"
+            end
           end
         end
 
@@ -578,6 +584,13 @@ module Fog
             @port       = options[:port]        || DEFAULT_SCHEME_PORT[@scheme]
           end
 
+          # GovCloud doesn't support S3 Transfer Acceleration https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-s3.html
+          # S3 Transfer Acceleration doesn't support FIPS endpoints.  When both fog_aws_accelerate=true and AWS_USE_FIPS_ENDPOINT=true, don't use Accelerate.
+          if @acceleration && (AWS_GOVCLOUD_REGIONS.include?(@region) || ENV['AWS_USE_FIPS_ENDPOINT'] == 'true')
+            Fog::Logger.warning("fog: S3 Transfer Acceleration is not available in GovCloud regions or when AWS_USE_FIPS_ENDPOINT=true. Disabling acceleration.")
+            @acceleration = false
+          end
+
           @host = ACCELERATION_HOST if @acceleration
           setup_credentials(options)
         end

data/lib/fog/aws/version.rb

@@ -1,5 +1,5 @@
 module Fog
   module AWS
-    VERSION = '3.29.0'.freeze
+    VERSION = '3.30.0'.freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fog-aws
 version: !ruby/object:Gem::Version
-  version: 3.29.0
+  version: 3.30.0
 platform: ruby
 authors:
 - Josh Lane
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-25 00:00:00.000000000 Z
+date: 2024-12-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -614,7 +614,10 @@ files:
 - lib/fog/aws/parsers/iam/upload_server_certificate.rb
 - lib/fog/aws/parsers/iam/upload_signing_certificate.rb
 - lib/fog/aws/parsers/kms/describe_key.rb
+- lib/fog/aws/parsers/kms/get_public_key.rb
 - lib/fog/aws/parsers/kms/list_keys.rb
+- lib/fog/aws/parsers/kms/schedule_key_deletion.rb
+- lib/fog/aws/parsers/kms/sign.rb
 - lib/fog/aws/parsers/lambda/base.rb
 - lib/fog/aws/parsers/rds/authorize_db_security_group_ingress.rb
 - lib/fog/aws/parsers/rds/base.rb
@@ -1236,7 +1239,10 @@ files:
 - lib/fog/aws/requests/kinesis/split_shard.rb
 - lib/fog/aws/requests/kms/create_key.rb
 - lib/fog/aws/requests/kms/describe_key.rb
+- lib/fog/aws/requests/kms/get_public_key.rb
 - lib/fog/aws/requests/kms/list_keys.rb
+- lib/fog/aws/requests/kms/schedule_key_deletion.rb
+- lib/fog/aws/requests/kms/sign.rb
 - lib/fog/aws/requests/lambda/add_permission.rb
 - lib/fog/aws/requests/lambda/create_event_source_mapping.rb
 - lib/fog/aws/requests/lambda/create_function.rb