fluent / fluent/fluent-bit

Opensearch output: Configuration setting `AWS_Auth true` fails silently

Open Beginner friendly
#10,947 4 comments 0 reactions 0 assignees View on GitHub
status: waiting-for-triage
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 20h
Merged PRs (30d)
71

Description

## Bug Report

Using `AWS_Auth` with the value `true` is silently ignored and treated as `false`.

Requests to Opensearch are not signed and fail with a 401 response code.

**To Reproduce**

- Set `AWS_Auth true` in the opensearch output configuration

**Expected behavior**

As the documentation states, `On` and `true` should behave identically i.e. as a boolean value.

This seems to be the case everywhere else; the expected behavior therefore is this setting working with `true` as well. Or, at the very least, it should log an error when the given value cannot be parsed.

**Additional context**

In addition to `true` failing silently, available debug output doesn't indicate that requests to Opensearch are unsigned, as far as I can tell.

It seems the config is parsed as a string using `strncasecmp(tmp, "On", 2)` here:
https://github.com/fluent/fluent-bit/blob/master/plugins/out_opensearch/os_conf.c#L247

This has already been reported, but apparently, it was auto-closed after a few weeks: #10228.

Contributor guide

Open the contributing guide

Research direction

Start in plugins/out_opensearch/os_conf.c at the parsing code around line 247 and compare how AWS_Auth values are handled. Reproduce with AWS_Auth true, then verify that it behaves like On and that an unparseable value is not silently accepted; requests should be signed instead of returning 401.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, c
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.