Skip to content

Commit 3f59f86

Browse files
skmcgrailskmcgrail
authored
Update S3 ARN Handling for AccessPoints and Outpost ARNs (#3928)
1 parent 0b5551c commit 3f59f86

File tree

9 files changed

+140
-68
lines changed

9 files changed

+140
-68
lines changed

‎internal/s3shared/arn/arn.go

+4
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ func ParseResource(s string, resParser ResourceParser) (resARN Resource, err err
4848
return nil, InvalidARNError{ARN: a, Reason: "service is not supported"}
4949
}
5050

51+
if strings.HasPrefix(a.Region, "fips-") || strings.HasSuffix(a.Region, "-fips") {
52+
return nil, InvalidARNError{ARN: a, Reason: "FIPS region not allowed in ARN"}
53+
}
54+
5155
if len(a.Resource) == 0 {
5256
return nil, InvalidARNError{ARN: a, Reason: "resource not set"}
5357
}

‎internal/s3shared/arn/arn_test.go

+8
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,14 @@ func TestParseResource(t *testing.T) {
9090
AccessPointName: "myendpoint",
9191
},
9292
},
93+
"invalid FIPS pseudo region in ARN (prefix)": {
94+
Input: "arn:aws:s3:fips-us-west-2:012345678901:accesspoint/myendpoint",
95+
ExpectErr: "FIPS region not allowed in ARN",
96+
},
97+
"invalid FIPS pseudo region in ARN (suffix)": {
98+
Input: "arn:aws:s3:us-west-2-fips:012345678901:accesspoint/myendpoint",
99+
ExpectErr: "FIPS region not allowed in ARN",
100+
},
93101
}
94102

95103
for name, c := range cases {

‎internal/s3shared/endpoint_errors.go

+13
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ func NewInvalidARNWithUnsupportedPartitionError(resource arn.Resource, err error
7171
}
7272

7373
// NewInvalidARNWithFIPSError ARN not supported for FIPS region
74+
//
75+
// Deprecated: FIPS will not appear in the ARN region component.
7476
func NewInvalidARNWithFIPSError(resource arn.Resource, err error) InvalidARNError {
7577
return InvalidARNError{
7678
message: "resource ARN not supported for FIPS region",
@@ -155,6 +157,17 @@ func NewClientConfiguredForFIPSError(resource arn.Resource, clientPartitionID, c
155157
}
156158
}
157159

160+
// NewFIPSConfigurationError denotes a configuration error when a client or request is configured for FIPS
161+
func NewFIPSConfigurationError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
162+
return ConfigurationError{
163+
message: "use of ARN is not supported when client or request is configured for FIPS",
164+
origErr: err,
165+
resource: resource,
166+
clientPartitionID: clientPartitionID,
167+
clientRegion: clientRegion,
168+
}
169+
}
170+
158171
// NewClientConfiguredForAccelerateError denotes client config error for unsupported S3 accelerate
159172
func NewClientConfiguredForAccelerateError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
160173
return ConfigurationError{

‎internal/s3shared/resource_request.go

+2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ func (r ResourceRequest) UseFIPS() bool {
3131
}
3232

3333
// ResourceConfiguredForFIPS returns true if resource ARNs region is FIPS
34+
//
35+
// Deprecated: FIPS pseudo-regions will not be in the ARN
3436
func (r ResourceRequest) ResourceConfiguredForFIPS() bool {
3537
return IsFIPS(r.ARN().Region)
3638
}

‎service/s3/endpoint.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -155,8 +155,9 @@ func endpointHandler(req *request.Request) {
155155
}
156156
case arn.OutpostAccessPointARN:
157157
// outposts does not support FIPS regions
158-
if resReq.ResourceConfiguredForFIPS() {
159-
req.Error = s3shared.NewInvalidARNWithFIPSError(resource, nil)
158+
if resReq.UseFIPS() {
159+
req.Error = s3shared.NewFIPSConfigurationError(resource, req.ClientInfo.PartitionID,
160+
aws.StringValue(req.Config.Region), nil)
160161
return
161162
}
162163

‎service/s3/endpoint_test.go

+58-15
Original file line numberDiff line numberDiff line change
@@ -265,36 +265,31 @@ func TestEndpoint(t *testing.T) {
265265
expectedSigningName: "s3-outposts",
266266
expectedSigningRegion: "us-gov-east-1",
267267
},
268-
"Outpost AccessPoint Fips region": {
268+
"Outpost AccessPoint FIPS client region": {
269269
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
270270
config: &aws.Config{
271271
EndpointResolver: endpoints.AwsUsGovPartition(),
272272
Region: aws.String("fips-us-gov-east-1"),
273273
},
274274
expectedErr: "ConfigurationError: client region does not match provided ARN region",
275275
},
276-
"Outpost AccessPoint Fips region in Arn": {
277-
bucket: "arn:aws-us-gov:s3-outposts:fips-us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
276+
"Outpost AccessPoint FIPS client region with matching ARN region": {
277+
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
278278
config: &aws.Config{
279-
EndpointResolver: endpoints.AwsUsGovPartition(),
280-
EnforceShouldRetryCheck: nil,
281-
Region: aws.String("fips-us-gov-east-1"),
282-
DisableSSL: nil,
283-
HTTPClient: nil,
284-
S3UseARNRegion: aws.Bool(true),
279+
EndpointResolver: endpoints.AwsUsGovPartition(),
280+
Region: aws.String("fips-us-gov-east-1"),
281+
S3UseARNRegion: aws.Bool(true),
285282
},
286-
expectedErr: "InvalidARNError: resource ARN not supported for FIPS region",
283+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
287284
},
288-
"Outpost AccessPoint Fips region with valid ARN region": {
289-
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
285+
"Outpost AccessPoint FIPS client region with cross-region ARN": {
286+
bucket: "arn:aws-us-gov:s3-outposts:us-gov-west-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
290287
config: &aws.Config{
291288
EndpointResolver: endpoints.AwsUsGovPartition(),
292289
Region: aws.String("fips-us-gov-east-1"),
293290
S3UseARNRegion: aws.Bool(true),
294291
},
295-
expectedEndpoint: "https://myaccesspoint-123456789012.op-01234567890123456.s3-outposts.us-gov-east-1.amazonaws.com",
296-
expectedSigningName: "s3-outposts",
297-
expectedSigningRegion: "us-gov-east-1",
292+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
298293
},
299294
"Outpost AccessPoint with DualStack": {
300295
bucket: "arn:aws:s3-outposts:us-west-2:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
@@ -571,6 +566,54 @@ func TestEndpoint(t *testing.T) {
571566
expectedSigningName: "s3",
572567
expectedSigningRegion: "us-west-2",
573568
},
569+
"Invalid AccessPoint ARN with FIPS pseudo-region (prefix)": {
570+
bucket: "arn:aws:s3:fips-us-east-1:123456789012:accesspoint:myendpoint",
571+
config: &aws.Config{
572+
Region: aws.String("us-west-2"),
573+
S3UseARNRegion: aws.Bool(true),
574+
},
575+
expectedErr: "FIPS region not allowed in ARN",
576+
},
577+
"Invalid AccessPoint ARN with FIPS pseudo-region (suffix)": {
578+
bucket: "arn:aws:s3:us-east-1-fips:123456789012:accesspoint:myendpoint",
579+
config: &aws.Config{
580+
Region: aws.String("us-west-2"),
581+
S3UseARNRegion: aws.Bool(true),
582+
},
583+
expectedErr: "FIPS region not allowed in ARN",
584+
},
585+
"Invalid Outpost AccessPoint ARN with FIPS pseudo-region (prefix)": {
586+
bucket: "arn:aws:s3-outposts:fips-us-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
587+
config: &aws.Config{
588+
Region: aws.String("us-west-2"),
589+
S3UseARNRegion: aws.Bool(true),
590+
},
591+
expectedErr: "FIPS region not allowed in ARN",
592+
},
593+
"Invalid Outpost AccessPoint ARN with FIPS pseudo-region (suffix)": {
594+
bucket: "arn:aws:s3-outposts:us-east-1-fips:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
595+
config: &aws.Config{
596+
Region: aws.String("us-west-2"),
597+
S3UseARNRegion: aws.Bool(true),
598+
},
599+
expectedErr: "FIPS region not allowed in ARN",
600+
},
601+
"Invalid Object Lambda ARN with FIPS pseudo-region (prefix)": {
602+
bucket: "arn:aws:s3-object-lambda:fips-us-east-1:123456789012:accesspoint/myap",
603+
config: &aws.Config{
604+
Region: aws.String("us-west-2"),
605+
S3UseARNRegion: aws.Bool(true),
606+
},
607+
expectedErr: "FIPS region not allowed in ARN",
608+
},
609+
"Invalid Object Lambda ARN with FIPS pseudo-region (suffix)": {
610+
bucket: "arn:aws:s3-object-lambda:us-east-1-fips:123456789012:accesspoint/myap",
611+
config: &aws.Config{
612+
Region: aws.String("us-west-2"),
613+
S3UseARNRegion: aws.Bool(true),
614+
},
615+
expectedErr: "FIPS region not allowed in ARN",
616+
},
574617
}
575618

576619
for name, c := range cases {

‎service/s3control/endpoint.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -202,8 +202,9 @@ func validateOutpostEndpoint(req *request.Request, resource arn.Resource) error
202202
}
203203

204204
// resource configured with FIPS as region is not supported by outposts
205-
if resReq.ResourceConfiguredForFIPS() {
206-
return s3shared.NewInvalidARNWithFIPSError(resource, nil)
205+
if resReq.UseFIPS() {
206+
return s3shared.NewFIPSConfigurationError(resource, req.ClientInfo.PartitionID,
207+
aws.StringValue(req.Config.Region), nil)
207208
}
208209

209210
// DualStack not supported

‎service/s3control/endpoint_builder.go

-5
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,6 @@ type outpostAccessPointEndpointBuilder arn.OutpostAccessPointARN
3939
func (o outpostAccessPointEndpointBuilder) build(req *request.Request) error {
4040
resolveRegion := o.Region
4141
resolveService := o.Service
42-
cfgRegion := aws.StringValue(req.Config.Region)
43-
44-
if s3shared.IsFIPS(cfgRegion) && !aws.BoolValue(req.Config.S3UseARNRegion) {
45-
return s3shared.NewInvalidARNWithFIPSError(o, nil)
46-
}
4742

4843
endpointsID := resolveService
4944
if resolveService == "s3-outposts" {

‎service/s3control/endpoint_test.go

+49-44
Original file line numberDiff line numberDiff line change
@@ -80,51 +80,31 @@ func TestEndpoint_OutpostAccessPointARN(t *testing.T) {
8080
expectedHeaderForAccountID: true,
8181
expectedHeaderForOutpostID: "op-01234567890123456",
8282
},
83-
"Outpost AccessPoint with client region as Fips": {
83+
"Outpost AccessPoint with client region as FIPS": {
8484
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
8585
config: &aws.Config{
8686
EndpointResolver: endpoints.AwsUsGovPartition(),
8787
Region: aws.String("us-gov-east-1-fips"),
8888
},
89-
expectedErr: "InvalidARNError: resource ARN not supported for FIPS region",
89+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
9090
},
91-
"Outpost AccessPoint with client Fips region and use arn region enabled": {
92-
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
91+
"Outpost AccessPoint with client FIPS region and cross-region ARN": {
92+
bucket: "arn:aws-us-gov:s3-outposts:us-gov-west-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
9393
config: &aws.Config{
9494
EndpointResolver: endpoints.AwsUsGovPartition(),
9595
Region: aws.String("us-gov-east-1-fips"),
9696
S3UseARNRegion: aws.Bool(true),
9797
},
98-
expectedSigningName: "s3-outposts",
99-
expectedSigningRegion: "us-gov-east-1",
100-
expectedEndpoint: "https://s3-outposts.us-gov-east-1.amazonaws.com",
101-
expectedHeaderForAccountID: true,
102-
expectedHeaderForOutpostID: "op-01234567890123456",
98+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
10399
},
104-
"Outpost AccessPoint Fips region in Arn": {
105-
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1-fips:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
106-
config: &aws.Config{
107-
EndpointResolver: endpoints.AwsUsGovPartition(),
108-
EnforceShouldRetryCheck: nil,
109-
Region: aws.String("us-gov-east-1-fips"),
110-
DisableSSL: nil,
111-
HTTPClient: nil,
112-
S3UseARNRegion: aws.Bool(true),
113-
},
114-
expectedErr: "InvalidARNError: resource ARN not supported for FIPS region",
115-
},
116-
"Outpost AccessPoint Fips region with valid ARN region": {
100+
"Outpost AccessPoint FIPS client region with matching ARN region": {
117101
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
118102
config: &aws.Config{
119103
EndpointResolver: endpoints.AwsUsGovPartition(),
120104
Region: aws.String("fips-us-gov-east-1"),
121105
S3UseARNRegion: aws.Bool(true),
122106
},
123-
expectedEndpoint: "https://s3-outposts.us-gov-east-1.amazonaws.com",
124-
expectedSigningName: "s3-outposts",
125-
expectedSigningRegion: "us-gov-east-1",
126-
expectedHeaderForAccountID: true,
127-
expectedHeaderForOutpostID: "op-01234567890123456",
107+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
128108
},
129109
"Outpost AccessPoint with DualStack": {
130110
bucket: "arn:aws:s3-outposts:us-west-2:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
@@ -180,6 +160,22 @@ func TestEndpoint_OutpostAccessPointARN(t *testing.T) {
180160
},
181161
expectedErr: "invalid Amazon s3-outposts ARN",
182162
},
163+
"Invalid Outpost AccessPoint ARN with FIPS pseudo-region (prefix)": {
164+
bucket: "arn:aws-us-gov:s3-outposts:fips-us-east-1:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
165+
config: &aws.Config{
166+
Region: aws.String("us-west-2"),
167+
S3UseARNRegion: aws.Bool(true),
168+
},
169+
expectedErr: "FIPS region not allowed in ARN",
170+
},
171+
"Invalid Outpost AccessPoint ARN with FIPS pseudo-region (suffix)": {
172+
bucket: "arn:aws-us-gov:s3-outposts:us-east-1-fips:123456789012:outpost:op-01234567890123456:accesspoint:myaccesspoint",
173+
config: &aws.Config{
174+
Region: aws.String("us-west-2"),
175+
S3UseARNRegion: aws.Bool(true),
176+
},
177+
expectedErr: "FIPS region not allowed in ARN",
178+
},
183179
}
184180

185181
runValidations(t, cases)
@@ -238,38 +234,31 @@ func TestEndpoint_OutpostBucketARN(t *testing.T) {
238234
expectedHeaderForOutpostID: "op-01234567890123456",
239235
expectedHeaderForAccountID: true,
240236
},
241-
"Outpost Bucket Fips region": {
237+
"Outpost Bucket FIPS client region": {
242238
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:bucket:mybucket",
243239
config: &aws.Config{
244240
EndpointResolver: endpoints.AwsUsGovPartition(),
245241
Region: aws.String("fips-us-gov-east-1"),
246242
},
247243
expectedErr: "ConfigurationError: client region does not match provided ARN region",
248244
},
249-
"Outpost Bucket Fips region in Arn": {
250-
bucket: "arn:aws-us-gov:s3-outposts:fips-us-gov-east-1:123456789012:outpost:op-01234567890123456:bucket:mybucket",
245+
"Outpost Bucket FIPS client region with match ARN region": {
246+
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:bucket:mybucket",
251247
config: &aws.Config{
252-
EndpointResolver: endpoints.AwsUsGovPartition(),
253-
EnforceShouldRetryCheck: nil,
254-
Region: aws.String("fips-us-gov-east-1"),
255-
DisableSSL: nil,
256-
HTTPClient: nil,
257-
S3UseARNRegion: aws.Bool(true),
248+
EndpointResolver: endpoints.AwsUsGovPartition(),
249+
Region: aws.String("fips-us-gov-east-1"),
250+
S3UseARNRegion: aws.Bool(true),
258251
},
259-
expectedErr: "InvalidARNError: resource ARN not supported for FIPS region",
252+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
260253
},
261-
"Outpost Bucket Fips region with valid ARN region": {
262-
bucket: "arn:aws-us-gov:s3-outposts:us-gov-east-1:123456789012:outpost:op-01234567890123456:bucket:mybucket",
254+
"Outpost Bucket FIPS client region with cross-region ARN": {
255+
bucket: "arn:aws-us-gov:s3-outposts:us-gov-west-1:123456789012:outpost:op-01234567890123456:bucket:mybucket",
263256
config: &aws.Config{
264257
EndpointResolver: endpoints.AwsUsGovPartition(),
265258
Region: aws.String("fips-us-gov-east-1"),
266259
S3UseARNRegion: aws.Bool(true),
267260
},
268-
expectedEndpoint: "https://s3-outposts.us-gov-east-1.amazonaws.com",
269-
expectedSigningName: "s3-outposts",
270-
expectedSigningRegion: "us-gov-east-1",
271-
expectedHeaderForOutpostID: "op-01234567890123456",
272-
expectedHeaderForAccountID: true,
261+
expectedErr: "use of ARN is not supported when client or request is configured for FIPS",
273262
},
274263
"Outpost Bucket with DualStack": {
275264
bucket: "arn:aws:s3-outposts:us-west-2:123456789012:outpost:op-01234567890123456:bucket:mybucket",
@@ -302,6 +291,22 @@ func TestEndpoint_OutpostBucketARN(t *testing.T) {
302291
},
303292
expectedErr: "invalid Amazon s3-outposts ARN, unknown resource type",
304293
},
294+
"Invalid Outpost Bucket ARN with FIPS pseudo-region (prefix)": {
295+
bucket: "arn:aws:s3-outposts:fips-us-east-1:123456789012:outpost:op-01234567890123456:bucket:mybucket",
296+
config: &aws.Config{
297+
Region: aws.String("us-west-2"),
298+
S3UseARNRegion: aws.Bool(true),
299+
},
300+
expectedErr: "FIPS region not allowed in ARN",
301+
},
302+
"Invalid Outpost Bucket ARN with FIPS pseudo-region (suffix)": {
303+
bucket: "arn:aws:s3-outposts:us-east-1-fips:123456789012:outpost:op-01234567890123456:bucket:mybucket",
304+
config: &aws.Config{
305+
Region: aws.String("us-west-2"),
306+
S3UseARNRegion: aws.Bool(true),
307+
},
308+
expectedErr: "FIPS region not allowed in ARN",
309+
},
305310
}
306311

307312
runValidations(t, cases)

0 commit comments

Comments
 (0)