Skip to content

fix(cli): asset uploads fail if Object Lock is enabled on access bucket#31937

Merged
mergify[bot] merged 13 commits intomainfrom
huijbers/disable-md5-only-in-fips
Nov 1, 2024
Merged

fix(cli): asset uploads fail if Object Lock is enabled on access bucket#31937
mergify[bot] merged 13 commits intomainfrom
huijbers/disable-md5-only-in-fips

Conversation

@rix0rrr
Copy link
Copy Markdown
Contributor

@rix0rrr rix0rrr commented Oct 29, 2024

Object Lock requires passing an object checksum. By default, SDKv2 only calculates MD5 checksums.

We used to turn off checksums altogether and rely on SigV4 checksums to produce a workable setup for both FIPS and non-FIPS users, but in case of Object Lock this doesn't work: we must definitely have an S3 content checksum, and the the SigV4 checksum alone is not good enough.

Since SDKv2 only supports MD5 checksums, we now only disable checksums for FIPS environments.

The unfortunate result is that Object Lock will not work in a FIPS environment, but there's no way around that for now.

When we migrate to SDKv3, which can be configured to checksum using SHA256, Object Lock + FIPS will work again.

Relates to #31926

(This PR also adds tests for the PluginHost because otherwise the build fails due to coverage requirements)


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Object Lock requires passing an object checksum. By default, SDKv2
only calculates MD5 checksums.

We used to turn off checksums altogether and rely on SigV4 checksums to
produce a workable setup for both FIPS and non-FIPS users, but in case
of Object Lock this doesn't work: we must definitely have an S3 content
checksum, and the the SigV4 checksum alone is not good enough.

Since SDKv2 only supports MD5 checksums, we now only disable checksums
for FIPS environments.

The unfortunate result is that Object Lock will not work in a FIPS
environment, but there's no way around that for now.

When we migrate to SDKv3, which can be configured to checksum using
SHA256, Object Lock + FIPS will work again.
@rix0rrr rix0rrr requested a review from a team October 29, 2024 17:30
@aws-cdk-automation aws-cdk-automation requested a review from a team October 29, 2024 17:30
@github-actions github-actions bot added the p2 label Oct 29, 2024
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Oct 29, 2024
Copy link
Copy Markdown
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@aws-cdk-automation aws-cdk-automation added the pr/needs-cli-test-run This PR needs CLI tests run against it. label Oct 29, 2024
Copy link
Copy Markdown
Contributor

@mrgrain mrgrain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't we need to fix this in cdklabs/cdk-assets?

@rix0rrr rix0rrr added the pr-linter/exempt-test The PR linter will not require test changes label Oct 30, 2024
@rix0rrr rix0rrr requested a review from a team October 30, 2024 09:16
@rix0rrr rix0rrr added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Oct 30, 2024

// THEN - should not fail
} finally {
// Clean up stack and bootstrap stack
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No cleanup?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Happens automatically. I should remove the finally.

Comment on lines +192 to +197
if (crypto.getFips() && apiRequiresMd5Checksum) {
// This should disappear for SDKv3; in SDKv3, we can always force the client to use SHA256 checksums
throw new Error('This operation requires MD5 for integrity purposes; unfortunately, it therefore not available in a FIPS environment.');
}

if (crypto.getFips()) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💅🏻 This might be slightly easier to undertand.

Suggested change
if (crypto.getFips() && apiRequiresMd5Checksum) {
// This should disappear for SDKv3; in SDKv3, we can always force the client to use SHA256 checksums
throw new Error('This operation requires MD5 for integrity purposes; unfortunately, it therefore not available in a FIPS environment.');
}
if (crypto.getFips()) {
if (crypto.getFips()) {
if (apiRequiresMd5Checksum) {
// This should disappear for SDKv3; in SDKv3, we can always force the client to use SHA256 checksums
throw new Error('This operation requires MD5 for integrity purposes; unfortunately, it therefore not available in a FIPS environment.');
}

@mrgrain mrgrain added the pr/do-not-merge This PR should not be merged at this time. label Oct 30, 2024
Copy link
Copy Markdown
Contributor

@mrgrain mrgrain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Conditionally approved. The error message needs a grammar fix and I would suggest we upgrade cdk-assets in this PR as well, just to be on the safe side.

rix0rrr and others added 2 commits October 30, 2024 11:19
Co-authored-by: Momo Kornher <kornherm@amazon.co.uk>
@rix0rrr rix0rrr removed the pr/do-not-merge This PR should not be merged at this time. label Oct 30, 2024
@rix0rrr
Copy link
Copy Markdown
Contributor Author

rix0rrr commented Oct 30, 2024

Test pipeline is blocked on #31946

@aws-cdk-automation
Copy link
Copy Markdown
Collaborator

➡️ PR build request submitted to test-main-pipeline ⬅️

A maintainer must now check the pipeline and add the pr-linter/cli-integ-tested label once the pipeline succeeds.

@rix0rrr rix0rrr added the pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested label Nov 1, 2024
@aws-cdk-automation aws-cdk-automation dismissed their stale review November 1, 2024 13:37

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@aws-cdk-automation aws-cdk-automation removed the pr/needs-cli-test-run This PR needs CLI tests run against it. label Nov 1, 2024
@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Nov 1, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Copy Markdown
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 617ffd0
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit ab1e91d into main Nov 1, 2024
@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Nov 1, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot deleted the huijbers/disable-md5-only-in-fips branch November 1, 2024 14:10
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Nov 1, 2024

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 1, 2024
@rix0rrr rix0rrr self-assigned this Nov 6, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

contribution/core This is a PR that came from AWS. p2 pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested pr-linter/exempt-integ-test The PR linter will not require integ test changes pr-linter/exempt-test The PR linter will not require test changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants