aws / aws/aws-sdk-java-v2

Consider expiration of security credentials for expiration of a PresignedRequest

Aperta
#2,379 2 commenti 1 reazione 0 assegnatari Vedi su GitHub
feature-request p1
Lingua principale
Java
Stelle
2.6k
Fork
1k
Merge medio
2g 9h
PR unite (30g)
51

Descrizione

## Describe the Feature

Update `software.amazon.awssdk.awscore.presigner.PresignedRequest#expiration` so that it returns the minimum out of the expiration time of the security credentials and the requested signed duration.

## Is your Feature Request related to a problem?

It is impossible to tell when a `PresignedRequest` will actually expire. It makes it difficult to generate a presigned URL using an instance profile as it could expire at any time up to a maximum of 6 hours. The provided `signatureDuration` is practically useless except to restrict that to something less than 6 hours.

## Proposed Solution

The `AwsSessionCredentials` would need to be modified to have an additional `expiration` field that is set in `software.amazon.awssdk.auth.credentials.HttpCredentialsProvider#refreshCredentials`. This would make a lot of sense since the [STS API](https://docs.aws.amazon.com/STS/latest/APIReference/API_Credentials.html) already returns it.

`software.amazon.awssdk.services.s3.internal.presigner.DefaultS3Presigner#initializePresignedRequest` can then be modified to get the `AWS_CREDENTIALS` attribute from the `ExecutionContext` and get the expiration if they are an instance of `AwsSessionCredentials`. Then it can use the minimum of that and the one from the `PRESIGNER_EXPIRATION` attribute as the expiration of the `presignedRequest`.

## Describe alternatives you've considered

I have to maintain my own cached credentials with a known expiration time and provide them to the presigner which is just duplicating all the same logic that the default implementations already do.

## Additional Context

I want to generate presigned URLs and know when they will expire.

- [x] I may be able to implement this feature request

## Your Environment

* AWS Java SDK version used: 2.15.25
* JDK version used: 1.8
* Operating System and version: Amazon Linux 2

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Inizia leggendo AwsSessionCredentials e software.amazon.awssdk.auth.credentials.HttpCredentialsProvider#refreshCredentials, quindi esamina DefaultS3Presigner#initializePresignedRequest e PresignedRequest#expiration. Traccia come vengono valorizzati AWS_CREDENTIALS e PRESIGNER_EXPIRATION; il lavoro è completato quando la scadenza della richiesta riflette il valore più breve tra la scadenza delle credenziali di sicurezza e la durata firmata richiesta.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
aws, java
Ambito
cloud, security
Tipo di issue
Funzionalità
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Specificata chiaramente
Idoneità per principianti
35/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.