sigv4 for Lattice unsigned-payload not supported for http requests
- Dominant language
- Java
- Stars
- 2.6k
- Forks
- 1k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 51
Description
### Describe the bug
When making http (not https) requests to lattice, the payload will always be signed because the signing logic will always sign the body when the protocol http and a streaming body is present. This isn't compatible with VPC Lattice which allows for GRPC over HTTP.
### Expected Behavior
requests to be signed with 'x-amz-content-sha256: UNSIGNED-PAYLOAD'
### Current Behavior
-H 'x-amz-content-sha256: STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD'
### Reproduction Steps
```
SdkHttpFullRequest request = SdkHttpFullRequest.builder()
.protocol("HTTP")
.host("test.com:80")
.method(SdkHttpMethod.POST)
.encodedPath("/_status")
.contentStreamProvider(() - > new ByteArrayInputStream("{\"status\":\"ok\"}".getBytes()))
.build();
ExecutionAttributes ea = new ExecutionAttributes();
ea.putAttribute(AwsSignerExecutionAttribute.AWS_CREDENTIALS, EnvironmentVariableCredentialsProvider.create().resolveCredentials());
ea.putAttribute(AwsSignerExecutionAttribute.SERVICE_SIGNING_NAME, "vpc-lattice-svcs");
ea.putAttribute(S3SignerExecutionAttribute.ENABLE_PAYLOAD_SIGNING, false);
AwsCrtS3V4aSigner signer = AwsCrtS3V4aSigner.builder()
.defaultRegionScope(RegionScope.GLOBAL)
.build();
var signedRequest = signer.sign(request, ea);
for (var header: signedRequest.headers().entrySet()) {
for (var value: header.getValue()) {
System.out.print(" -H '" + header.getKey() + ": " + value + "'\n");
}
}
```
will print out some headers, notably
```
-H 'x-amz-content-sha256: STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD'
```
### Possible Solution
In DefaultAwsCrtS3V4aSigner (and other signers) change logic to something like
```
private boolean shouldSignPayload(SdkHttpFullRequest request, ExecutionAttributes executionAttributes) {
Boolean payloadSigning =
executionAttributes.getAttribute(S3SignerExecutionAttribute.ENABLE_PAYLOAD_SIGNING);
if (payloadSigning != null && !booleanValue(payloadSigning)) {
return false;
}
if (!request.protocol().equals("https") && request.contentStreamProvider().isPresent()) {
return true;
}
```
to prioritize user choice
or look at `AwsSignerExecutionAttribute.SERVICE_SIGNING_NAME == vpc-lattice-svcs` to decide if the request body should be signed.
### Additional Information/Context
_No response_
### AWS Java SDK version used
2.21.20
### JDK version used
21.0.2
### Operating System and version
macOS 14.4.1
Contributor guide
Assessment
This issue has not been assessed yet.