fix(aws-lambda-plugin)! Use AWS SigV4, require AWS region, allow custom lambda hosts

[segabond]

Summary

As per FTI-2928, customer uses Kong in front of AWS lambda in the isolated gov AWS region. Such regions use custom service endpoints, therefore customer uses host configuration to override it. Since config schema does not allow both host and region be supplied simultaneously, it is impossible to correctly sign the request using AWS SigV4 algorithm. The correct implementation of such plugin should allow both aws_region and host be supplied, as aws_region is a mandatory field for SigV4 signature algo.

Full changelog

• Allow both host and aws_region in config
• Require AWS region to always be configured
• Always apply SigV4 signature
• Fixed tests to test environment variable configuration correctly

Issues resolved

Fix FTI-2928

[CLAassistant]

All committers have signed the CLA.

[Tieske]

If the region now is required, then this is a breaking change. And even then I don't see how we can add that info with a migration.

pinging the migrations/breaking change master; @mikefero

[RobSerafini]

@Tieske @aboudreault @kikito - what is the status of this PR?

[aboudreault]

doesn't seem like we can merge this feature due to the breaking change mentioned. We cannot really guess the region if none is provided in the config. Options:

• target this feature for 3.0 with the breaking change
• revisit this feature implementation to preserve the current behavior until 3.0 (so keeping aws_region optional, and don't try to sign v4 if not specified?)

However, we are probably too short to include this in 2.8.

[kikito]

This did not make it into 2.8, I am clearing its milestone

[tyler-ball]

Rebased off master

[kikito]

Some context for reviewers: AWS SigV4 was released in 2012. It replaces SigV2, which was deprecated in 2020.

[fffonion]

@segabond As we now target this for 3.0 with the go-with-breaking-change approach, could you add this to the changelog? (and also rebase upon master to run CI again)

[mayocream]

Please also include an entry in the changelog for this PR.

[mayocream]

The change will break the fix for Kong/kong-plugin-aws-lambda#60. Probably you should leave it there.

[kikito]

For other people's reference: this is a breaking change. This conditional makes conf.aws_region mandatory, in effect.

The reason why we don't make it mandatory on the schema is that we also accept setting it via the AWS_REGION env var, and our schemas don't support doing that automatically.