fix: enable node-fips compatible body checksums for S3 #31883
Conversation
mrgrain
had a problem deploying
to
test-pipeline
GitHub Actions
Failure
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
aws-cdk-automation
added
the
pr/needs-cli-test-run
mrgrain
added
pr-linter/exempt-test
aws-cdk-automation
added
the
pr/needs-cli-test-run
mrgrain
force-pushed
the
mrgrain/fix/fips-config
branch
from
d822edb to
340879e
Compare
mrgrain
had a problem deploying
to
test-pipeline
GitHub Actions
Failure
|
➡️ PR build request submitted to A maintainer must now check the pipeline and add the |
mrgrain
added
the
pr-linter/cli-integ-tested
aws-cdk-automation
dismissed
their stale review
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
aws-cdk-automation
removed
the
pr/needs-cli-test-run
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Comments on closed issues and PRs are hard for our team to see. |
Issue # (if applicable)
Internal reference: D166315367
Reason for this change
In FIPS enabled environments, the MD5 algorithm is not available for use in crypto module.
However by default the S3 client is using an MD5 checksum for content integrity checking.
This causes any S3 upload operation to fail with a cryptography error.
Description of changes
We are disabling the S3 content checksums, and are re-enabling the regular SigV4 body signing.
SigV4 uses SHA256 for their content checksum. This configuration matches the default behavior
of the AWS SDKv3 and is a safe choice for all users.
Description of how you validated changes
For non-FIPS users, we have verified functionality via cli-integ-tests.
For FIPS users, we have manually verified
cdk deployis now working in a FIPS enabled environment.We have also verified the configuration with the affected customer.
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license