aws / aws/aws-cli

Aws::SQS::Client in GovCloud fails for use of MD5 -> disabled for fips

Open
#9,032 6 comments 3 reactions 0 assignees View on GitHub
bug cross-sdk p2 sqs
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

When using a client from the aws-sqs-sdk on GovCloud environments there is an error generated when trying to produce outbox messages. When the SDK tries to validate the message body using md5s.rb plugin and that generates the following error

`OpenSSL::Digest::DigestError: Digest initialization failed: disabled for fips`

Posting it on this repo since the most similar [issue I could find for the Ruby SDK](https://github.com/aws/aws-sdk-ruby/issues/2397#issuecomment-738200794) repo pointed me here.

This is the stack trace:
```
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/plugins/md5s.rb:87:in `md5_of_message_body'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/plugins/md5s.rb:61:in `validate_body'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/plugins/md5s.rb:54:in `validate_single_message'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/plugins/md5s.rb:48:in `block in validate_send_message_batch'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/plugins/md5s.rb:42:in `each'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/plugins/md5s.rb:42:in `validate_send_message_batch'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/plugins/md5s.rb:18:in `block in call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/response.rb:46:in `block in on'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/http/response.rb:146:in `block in on_success'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/http/response.rb:173:in `block in listener'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/http/response.rb:137:in `on_done'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/http/response.rb:144:in `on_success'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/response.rb:45:in `on'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/response.rb:54:in `on_success'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/plugins/md5s.rb:13:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/aws-sdk-core/plugins/param_validator.rb:26:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/plugins/raise_response_errors.rb:16:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/aws-sdk-core/plugins/jsonvalue_converter.rb:22:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/aws-sdk-core/plugins/idempotency_token.rb:19:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/aws-sdk-core/plugins/param_converter.rb:26:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/plugins/request_callback.rb:71:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/aws-sdk-core/plugins/response_paging.rb:12:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/plugins/response_target.rb:24:in `call'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-core-3.114.0/lib/seahorse/client/request.rb:72:in `send_request'
2021-05-20 16:40:09/home/user/app/vendor/bundle/ruby/2.5.0/gems/aws-sdk-sqs-1.38.0/lib/aws-sdk-sqs/client.rb:2166:in `send_message_batch'
...{our code call to client.send_message_batch}...
...
```

Are there any configs specific to the client besides the region and queue URL that tell it not to use md5, or is this something missing in the sdk? I haven't been able to find any [other leads here](https://docs.aws.amazon.com/sdk-for-ruby/v2/api/Aws/SQS/Client.html) on this so any pointers are greatly appreciated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.