releases

mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-12 19:32:48 -06:00

Files

T

Prasanth Jayachandran 7f5e3a9d1e aws: support for Unsigned Payload or provided content sha256 in AWS signing (#6581 )

To support uses cases where OPA is used for signing s3 requests whose payload is
not known upfront or payload is big enough (big file upload) to be sent over wire,
this PR adds support for unsigned payloads.

AWS signer has configurable option to use unsigned payload where the
x-amz-content-sha256 is set to "UNSIGNED-PAYLOAD" and is included as part
of signing process. This PR provides an option for unsigned payload if
aws_config.disable_payload_signing is set to true. If payload signing is
disabled, SignV4 method will not compute the content sha from the request body
but instead use "UNSIGNED-PAYLOAD" string literal for x-amz-content-sha256
header during signature computation.

References:
https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html
Signed-off-by: Prasanth Jayachandran <p_jayachandran@apple.com>

2024-03-08 10:57:51 -08:00

auth_test.go

Add AWS KMS support for OAuth2 Client Credentials JWT authentication

2023-07-03 11:01:15 -07:00

auth.go

plugins: Surface AWS authentication error details

2023-09-25 10:54:55 -07:00

aws_test.go

aws: support for Unsigned Payload or provided content sha256 in AWS signing (#6581 )

2024-03-08 10:57:51 -08:00

aws.go

Add AWS KMS support for OAuth2 Client Credentials JWT authentication