Skip to content

Fix issue loading SigV4 config #7726

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dylan-apollo merged 4 commits into from
Jun 20, 2025
Merged

Fix issue loading SigV4 config #7726

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a254f16
Fix issue loading SigV4 config
dylan-apollo Jun 18, 2025
1c2c38e
Add a CI-only integration test for SigV4 using Connectors
dylan-apollo Jun 18, 2025
5fdfef7
Merge branch 'dev' into dylan/aws-sigv4
dylan-apollo Jun 18, 2025
c834c56
Add changeset
dylan-apollo Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changesets/fix_mantel_headband_iced_move.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
### Fix issue loading SigV4 config ([PR #7726](https://github.com/apollographql/router/pull/7726))

Fixed an issue introduced in Router 2.3.0 where some SigV4 configurations would fail to start.

By [@dylan-apollo](https://github.com/dylan-apollo) in https://github.com/apollographql/router/pull/7726
14 changes: 14 additions & 0 deletions apollo-router/src/plugins/authentication/subgraph.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,9 @@ use aws_smithy_async::rt::sleep::TokioSleep;
use aws_smithy_async::time::SystemTimeSource;
use aws_smithy_http_client::tls::Provider;
use aws_smithy_http_client::tls::rustls_provider::CryptoMode;
use aws_smithy_runtime_api::client::behavior_version::BehaviorVersion;
use aws_smithy_runtime_api::client::identity::Identity;
use aws_types::SdkConfig;
use aws_types::region::Region;
use aws_types::sdk_config::SharedCredentialsProvider;
use http::HeaderMap;
Expand Down Expand Up @@ -111,6 +113,18 @@ impl AWSSigV4Config {
let role_provider_builder = self.assume_role().map(|assume_role_provider| {
let rp =
aws_config::sts::AssumeRoleProvider::builder(assume_role_provider.role_arn.clone())
.configure(
&SdkConfig::builder()
.http_client(
aws_smithy_http_client::Builder::new()
.tls_provider(Provider::Rustls(CryptoMode::Ring))
.build_https(),
)
.sleep_impl(TokioSleep::new())
.time_source(SystemTimeSource::new())
.behavior_version(BehaviorVersion::latest())
.build(),
)
.session_name(assume_role_provider.session_name.clone())
.region(region.clone());
if let Some(external_id) = &assume_role_provider.external_id {
Expand Down
115 changes: 77 additions & 38 deletions apollo-router/tests/integration/connectors.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,8 @@ mod apq {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `apq` indirectly targets a connector-enabled subgraph, which is not supported"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `apq` indirectly targets a connector-enabled subgraph, which is not supported"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -76,8 +76,8 @@ mod apq {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `apq` is explicitly configured for connector-enabled subgraph"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `apq` is explicitly configured for connector-enabled subgraph"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -126,9 +126,12 @@ mod apq {
mod authentication {
use std::path::PathBuf;

use serde_json::Value;
use serde_json::json;
use tower::BoxError;

use crate::integration::IntegrationTest;
use crate::integration::common::Query;

#[tokio::test(flavor = "multi_thread")]
async fn incompatible_warnings_on_all() -> Result<(), BoxError> {
Expand Down Expand Up @@ -212,8 +215,8 @@ mod authentication {

router.start().await;
router
.wait_for_log_message(r#""subgraphs":"connectors","message":"plugin `authentication` is enabled for connector-enabled subgraphs"#)
.await;
.wait_for_log_message(r#""subgraphs":"connectors","message":"plugin `authentication` is enabled for connector-enabled subgraphs"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -266,8 +269,8 @@ mod authentication {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","sources":"jsonPlaceholder","message":"plugin `authentication` is enabled for a connector-enabled subgraph"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","sources":"jsonPlaceholder","message":"plugin `authentication` is enabled for a connector-enabled subgraph"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -320,11 +323,47 @@ mod authentication {

router.start().await;
router
.assert_log_not_contains(r#""subgraph":"connectors","sources":"jsonPlaceholder","message":"plugin `authentication` is enabled for a connector-enabled subgraph"#)
.await;
.assert_log_not_contains(r#""subgraph":"connectors","sources":"jsonPlaceholder","message":"plugin `authentication` is enabled for a connector-enabled subgraph"#)
.await;

Ok(())
}

#[tokio::test(flavor = "multi_thread")]
#[cfg_attr(not(feature = "ci"), ignore)]
async fn test_aws_sig_v4_signing() {
let mut router = IntegrationTest::builder()
.config(include_str!("fixtures/connectors_sigv4.router.yaml"))
.supergraph(PathBuf::from(
"tests/integration/fixtures/connectors_sigv4.graphql",
))
.build()
.await;

router.start().await;
router.assert_started().await;

let (_, response) = router
.execute_query(
Query::builder()
.body(json! ({"query": "query { instances }"}))
.build(),
)
.await;
let body: Value = response.json().await.unwrap();
router.graceful_shutdown().await;
let body = body.as_object().expect("Response body should be object");
let errors = body.get("errors");
assert!(errors.is_none(), "query generated errors: {errors:?}");
let me = body
.get("data")
.expect("Response body should have data")
.as_object()
.expect("Data should be object")
.get("instances")
.expect("Data should have instances");
assert!(me.is_null());
}
}

mod batching {
Expand Down Expand Up @@ -367,8 +406,8 @@ mod batching {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `batching` indirectly targets a connector-enabled subgraph, which is not supported"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `batching` indirectly targets a connector-enabled subgraph, which is not supported"#)
.await;
Copy link
Contributor Author

@dylan-apollo dylan-apollo Jun 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure why all these reformatted for me but didn't trip CI previously 🤔


Ok(())
}
Expand Down Expand Up @@ -409,8 +448,8 @@ mod batching {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `batching` is explicitly configured for connector-enabled subgraph"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `batching` is explicitly configured for connector-enabled subgraph"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -497,8 +536,8 @@ mod coprocessor {

router.start().await;
router
.wait_for_log_message(r#""subgraphs":"connectors","message":"coprocessors which hook into `subgraph_request` or `subgraph_response`"#)
.await;
.wait_for_log_message(r#""subgraphs":"connectors","message":"coprocessors which hook into `subgraph_request` or `subgraph_response`"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -534,8 +573,8 @@ mod coprocessor {

router.start().await;
router
.assert_log_not_contains(r#""subgraphs":"connectors","message":"coprocessors which hook into `subgraph_request` or `subgraph_response`"#)
.await;
.assert_log_not_contains(r#""subgraphs":"connectors","message":"coprocessors which hook into `subgraph_request` or `subgraph_response`"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -580,8 +619,8 @@ mod entity_cache {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `preview_entity_cache` indirectly targets a connector-enabled subgraph, which is not supported"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `preview_entity_cache` indirectly targets a connector-enabled subgraph, which is not supported"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -621,8 +660,8 @@ mod entity_cache {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `preview_entity_cache` is explicitly configured for connector-enabled subgraph"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `preview_entity_cache` is explicitly configured for connector-enabled subgraph"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -712,8 +751,8 @@ mod headers {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `headers` indirectly targets a connector-enabled subgraph"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `headers` indirectly targets a connector-enabled subgraph"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -753,8 +792,8 @@ mod headers {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `headers` is explicitly configured for connector-enabled subgraph"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `headers` is explicitly configured for connector-enabled subgraph"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -796,8 +835,8 @@ mod rhai {

router.start().await;
router
.wait_for_log_message(r#""subgraphs":"connectors","message":"rhai scripts which hook into `subgraph_request` or `subgraph_response`"#)
.await;
.wait_for_log_message(r#""subgraphs":"connectors","message":"rhai scripts which hook into `subgraph_request` or `subgraph_response`"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -843,8 +882,8 @@ mod telemetry {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `telemetry` is indirectly configured to send errors to Apollo studio for a connector-enabled subgraph, which is only supported when `preview_extended_error_metrics` is enabled"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `telemetry` is indirectly configured to send errors to Apollo studio for a connector-enabled subgraph, which is only supported when `preview_extended_error_metrics` is enabled"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -885,8 +924,8 @@ mod telemetry {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `telemetry` is explicitly configured to send errors to Apollo studio for connector-enabled subgraph, which is only supported when `preview_extended_error_metrics` is enabled"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"plugin `telemetry` is explicitly configured to send errors to Apollo studio for connector-enabled subgraph, which is only supported when `preview_extended_error_metrics` is enabled"#)
.await;

Ok(())
}
Expand Down Expand Up @@ -1016,8 +1055,8 @@ mod tls {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"The `tls` plugin is explicitly configured for a subgraph containing connectors, which is not supported. Instead, configure the connector sources directly using `tls.connector.sources.<subgraph_name>.<source_name>`."#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"The `tls` plugin is explicitly configured for a subgraph containing connectors, which is not supported. Instead, configure the connector sources directly using `tls.connector.sources.<subgraph_name>.<source_name>`."#)
.await;

Ok(())
}
Expand Down Expand Up @@ -1061,8 +1100,8 @@ mod traffic_shaping {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"The `traffic_shaping` plugin is explicitly configured for a subgraph containing connectors, which is not supported. Instead, configure the connector sources directly using `traffic_shaping.connector.sources.<subgraph_name>.<source_name>`."#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"The `traffic_shaping` plugin is explicitly configured for a subgraph containing connectors, which is not supported. Instead, configure the connector sources directly using `traffic_shaping.connector.sources.<subgraph_name>.<source_name>`."#)
.await;

Ok(())
}
Expand Down Expand Up @@ -1104,8 +1143,8 @@ mod url_override {

router.start().await;
router
.wait_for_log_message(r#""subgraph":"connectors","message":"overriding a subgraph URL for a connectors-enabled subgraph is not supported"#)
.await;
.wait_for_log_message(r#""subgraph":"connectors","message":"overriding a subgraph URL for a connectors-enabled subgraph is not supported"#)
.await;

Ok(())
}
Expand Down
Loading