aws / aws/chalice

Chalice Does Not Work With FIPS Enabled

Open
#1,442 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
11.1k
Forks
1k
Avg merge
1d 22h
Merged PRs (30d)
2

Description

Hello!

First off, thank you for this excellent library. We have used it for several years on my project.

We are currently migrating from the public AWS cloud into a private AWS cloud. As a part of this migration, our build servers are moving from vanilla Ubuntu to RHEL 7 with [FIPS](https://en.wikipedia.org/wiki/Federal_Information_Processing_Standards) enabled.

As a result deployments break with this this error (full stack trace omitted for brevity):
```
/webportal/lambda/.venv/lib64/python3.6/site-packages/chalice/deploy/packager.py", line 179, in _hash_project_dir
h = hashlib.md5(contents)
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips
```
FIPS disallows the use of md5 in ALL contexts as md5 is an insecure cryptographic algorithm.

The way md5 is currently being used in chalice is perfectly fine as chalice is not actually using the md5 algorithm for encryption. There is a workaround in Python distros on RHEL 7 for use cases like this:
`hashlib.md5(usedforsecurity=False)`
Would it be possible to add support for this? Either by detecting whether or not FIPS is enabled or allowing an argument to be passed in?

Contributor guide

Open the contributing guide

Research direction

Start in chalice/deploy/packager.py at _hash_project_dir and inspect how hashlib.md5 is used while packaging deployments. Reproduce the failure on RHEL 7 with FIPS enabled, then verify that deployment packaging succeeds there while continuing to work in non-FIPS environments.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, devops
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.