Allow list-objects-v2 to run against an S3 Express bucket

aws/rust-runtime/aws-inlineable/src/s3_express.rs

@@ -5,6 +5,12 @@
 
 /// Supporting code for S3 Express auth
 pub(crate) mod auth {
+    use std::borrow::Cow;
+    use std::str::FromStr;
+
+    use aws_credential_types::Credentials;
+    use aws_runtime::auth::sigv4::SigV4Signer;
+    use aws_sigv4::http_request::{SignatureLocation, SigningSettings};
     use aws_smithy_runtime_api::box_error::BoxError;
     use aws_smithy_runtime_api::client::auth::{
         AuthScheme, AuthSchemeEndpointConfig, AuthSchemeId, Sign,
@@ -56,15 +62,109 @@ pub(crate) mod auth {
     impl Sign for S3ExpressSigner {
         fn sign_http_request(
             &self,
-            _request: &mut HttpRequest,
-            _identity: &Identity,
-            _auth_scheme_endpoint_config: AuthSchemeEndpointConfig<'_>,
-            _runtime_components: &RuntimeComponents,
-            _config_bag: &ConfigBag,
+            request: &mut HttpRequest,
+            identity: &Identity,
+            auth_scheme_endpoint_config: AuthSchemeEndpointConfig<'_>,
+            runtime_components: &RuntimeComponents,
+            config_bag: &ConfigBag,
         ) -> Result<(), BoxError> {
-            todo!()
+            let operation_config =
+                SigV4Signer::extract_operation_config(auth_scheme_endpoint_config, config_bag)?;
+            let mut settings = SigV4Signer::signing_settings(&operation_config);
+
+            let express_credentials = identity.data::<Credentials>().ok_or(
+                "wrong identity type for SigV4. Expected AWS credentials but got `{identity:?}",
+            )?;
+
+            add_token_to_request(express_credentials, request, &mut settings)?;
+
+            SigV4Signer.sign_http_request(
+                request,
+                identity,
+                settings,
+                &operation_config,
+                runtime_components,
+                config_bag,
+            )
         }
     }
+
+    fn add_token_to_request(
+        express_credentials: &Credentials,
+        request: &mut HttpRequest,
+        settings: &mut SigningSettings,
+    ) -> Result<(), BoxError> {
+        match settings.signature_location {
+            SignatureLocation::Headers => {
+                let security_token_header = Cow::Borrowed("x-amz-security-token");
+                match settings.excluded_headers.as_mut() {
+                    Some(excluded) => {
+                        excluded.push(security_token_header);
+                    }
+                    None => {
+                        settings
+                            .excluded_params
+                            .get_or_insert(vec![security_token_header]);
+                    }
+                }
+                let mut value = http::HeaderValue::from_str(
+                    express_credentials
+                        .session_token()
+                        .expect("S3 session token should be set"),
+                )
+                .unwrap();
+                value.set_sensitive(true);
+                request.headers_mut().insert(
+                    http::HeaderName::from_static("x-amz-s3session-token"),
+                    value,
+                );
+            }
+            SignatureLocation::QueryParams => {
+                let security_token_param = Cow::Borrowed("X-Amz-Security-Token");
+                match settings.excluded_params.as_mut() {
+                    Some(excluded) => {
+                        excluded.push(security_token_param);
+                    }
+                    None => {
+                        settings
+                            .excluded_params
+                            .get_or_insert(vec![security_token_param]);
+                    }
+                }
+                let uri = http::Uri::from_str(request.uri()).unwrap();
+                let mut query_params = match uri.query() {
+                    Some(query) => query.split('&').collect(),
+                    None => vec![],
+                };
+                let param = &format!(
+                    "X-Amz-S3session-Token={}",
+                    aws_smithy_http::query::fmt_string(
+                        express_credentials
+                            .session_token()
+                            .expect("S3 session token should be set")
+                    )
+                );
+                query_params.push(param);
+                let uri = http::Uri::builder()
+                    .authority(
+                        uri.authority()
+                            .ok_or("request URI should have authority set")?
+                            .clone(),
+                    )
+                    .scheme(
+                        uri.scheme()
+                            .ok_or("request URI should have scheme set")?
+                            .clone(),
+                    )
+                    .path_and_query(format!("{}?{}", uri.path(), query_params.join("&")))
+                    .build()?;
+                request.set_uri(uri)?
+            }
+            _ => { return Err(BoxError::from("`SignatureLocation` adds a new variant, which needs to be handled in a separate match arm")) },
+        };
+
+        Ok(())
+    }
 }
 
 /// Supporting code for S3 Express identity cache
@@ -80,11 +180,21 @@ pub(crate) mod identity_cache {
 
 /// Supporting code for S3 Express identity provider
 pub(crate) mod identity_provider {
+    use std::time::SystemTime;
+
     use crate::s3_express::identity_cache::S3ExpressIdentityCache;
+    use crate::types::SessionCredentials;
+    use aws_credential_types::provider::error::CredentialsError;
+    use aws_credential_types::Credentials;
+    use aws_smithy_runtime_api::box_error::BoxError;
+    use aws_smithy_runtime_api::client::endpoint::EndpointResolverParams;
     use aws_smithy_runtime_api::client::identity::{
-        IdentityCacheLocation, IdentityFuture, ResolveIdentity,
+        Identity, IdentityCacheLocation, IdentityFuture, ResolveCachedIdentity, ResolveIdentity,
+    };
+    use aws_smithy_runtime_api::client::interceptors::SharedInterceptor;
+    use aws_smithy_runtime_api::client::runtime_components::{
+        GetIdentityResolver, RuntimeComponents,
     };
-    use aws_smithy_runtime_api::client::runtime_components::RuntimeComponents;
     use aws_smithy_types::config_bag::ConfigBag;
 
     #[derive(Debug)]
@@ -95,10 +205,93 @@ pub(crate) mod identity_provider {
     #[derive(Default)]
     pub(crate) struct Builder;
 
+    impl TryFrom<SessionCredentials> for Credentials {
+        type Error = BoxError;
+
+        fn try_from(session_creds: SessionCredentials) -> Result<Self, Self::Error> {
+            Ok(Credentials::new(
+                session_creds.access_key_id,
+                session_creds.secret_access_key,
+                Some(session_creds.session_token),
+                Some(SystemTime::try_from(session_creds.expiration).map_err(|_| {
+                    CredentialsError::unhandled(
+                        "credential expiration time cannot be represented by a SystemTime",
+                    )
+                })?),
+                "s3express",
+            ))
+        }
+    }
+
     impl DefaultS3ExpressIdentityProvider {
         pub(crate) fn builder() -> Builder {
             Builder
         }
+
+        async fn identity<'a>(
+            &'a self,
+            runtime_components: &'a RuntimeComponents,
+            config_bag: &'a ConfigBag,
+        ) -> Result<Identity, BoxError> {
+            let bucket_name = self.bucket_name(config_bag)?;
+
+            let sigv4_identity_resolver = runtime_components
+                .identity_resolver(aws_runtime::auth::sigv4::SCHEME_ID)
+                .ok_or("identity resolver for sigv4 should be set for S3")?;
+            let _aws_identity = runtime_components
+                .identity_cache()
+                .resolve_cached_identity(sigv4_identity_resolver, runtime_components, config_bag)
+                .await?;
+
+            // TODO(S3Express): use both `bucket_name` and `aws_identity` as part of `S3ExpressIdentityCache` implementation
+
+            let express_session_credentials = self
+                .express_session_credentials(bucket_name, runtime_components, config_bag)
+                .await?;
+
+            let data = Credentials::try_from(express_session_credentials)?;
+
+            Ok(Identity::new(data.clone(), data.expiry()))
+        }
+
+        fn bucket_name<'a>(&'a self, config_bag: &'a ConfigBag) -> Result<&'a str, BoxError> {
+            let params = config_bag
+                .load::<EndpointResolverParams>()
+                .expect("endpoint resolver params must be set");
+            let params = params
+                .get::<crate::config::endpoint::Params>()
+                .expect("`Params` should be wrapped in `EndpointResolverParams`");
+            params
+                .bucket()
+                .ok_or("A bucket was not set in endpoint params".into())
+        }
+
+        async fn express_session_credentials<'a>(
+            &'a self,
+            bucket_name: &'a str,
+            runtime_components: &'a RuntimeComponents,
+            config_bag: &'a ConfigBag,
+        ) -> Result<SessionCredentials, BoxError> {
+            let mut config_builder = crate::config::Builder::from_config_bag(config_bag);
+
+            // inherits all runtime components from a current S3 operation but clears out
+            // out interceptors configured for that operation
+            let mut rc_builder = runtime_components.to_builder();
+            rc_builder.set_interceptors(std::iter::empty::<SharedInterceptor>());
+            config_builder.runtime_components = rc_builder;
+
+            let client = crate::Client::from_conf(config_builder.build());
+            let response = client
+                .create_session()
+                .bucket(bucket_name)
+                .session_mode(crate::types::SessionMode::ReadWrite)
+                .send()
+                .await?;
+
+            response
+                .credentials
+                .ok_or("no session credentials in response".into())
+        }
     }
 
     impl Builder {
@@ -112,10 +305,10 @@ pub(crate) mod identity_provider {
     impl ResolveIdentity for DefaultS3ExpressIdentityProvider {
         fn resolve_identity<'a>(
             &'a self,
-            _runtime_components: &'a RuntimeComponents,
-            _config_bag: &'a ConfigBag,
+            runtime_components: &'a RuntimeComponents,
+            config_bag: &'a ConfigBag,
         ) -> IdentityFuture<'a> {
-            todo!()
+            IdentityFuture::new(async move { self.identity(runtime_components, config_bag).await })
         }
 
         fn cache_location(&self) -> IdentityCacheLocation {

aws/rust-runtime/aws-runtime/src/auth/sigv4.rs

@@ -72,7 +72,8 @@ impl SigV4Signer {
         Self
     }
 
-    fn settings(operation_config: &SigV4OperationSigningConfig) -> SigningSettings {
+    /// Creates a [`SigningSettings`] from the given `operation_config`.
+    pub fn signing_settings(operation_config: &SigV4OperationSigningConfig) -> SigningSettings {
         super::settings(operation_config)
     }
 
@@ -117,10 +118,11 @@ impl SigV4Signer {
             .expect("all required fields set"))
     }
 
-    fn extract_operation_config<'a>(
+    /// Extracts a [`SigV4OperationSigningConfig`].
+    pub fn extract_operation_config<'a>(
         auth_scheme_endpoint_config: AuthSchemeEndpointConfig<'a>,
         config_bag: &'a ConfigBag,
-    ) -> Result<Cow<'a, SigV4OperationSigningConfig>, SigV4SigningError> {
+    ) -> Result<Cow<'a, SigV4OperationSigningConfig>, BoxError> {
         let operation_config = config_bag
             .load::<SigV4OperationSigningConfig>()
             .ok_or(SigV4SigningError::MissingOperationSigningConfig)?;
@@ -141,28 +143,27 @@ impl SigV4Signer {
             }
         }
     }
-}
 
-impl Sign for SigV4Signer {
-    fn sign_http_request(
+    /// Signs the given `request`.
+    ///
+    /// This is a helper used by [`Sign::sign_http_request`] and will be useful if calling code
+    /// needs to pass a configured `settings`.
+    ///
+    /// TODO(S3Express): Make this method more user friendly, possibly returning a builder
+    ///  instead of taking these input parameters. The builder will have a `sign` method that
+    ///  does what this method body currently does.
+    pub fn sign_http_request(
         &self,
         request: &mut HttpRequest,
         identity: &Identity,
-        auth_scheme_endpoint_config: AuthSchemeEndpointConfig<'_>,
+        settings: SigningSettings,
+        operation_config: &SigV4OperationSigningConfig,
         runtime_components: &RuntimeComponents,
-        config_bag: &ConfigBag,
+        #[allow(unused_variables)] config_bag: &ConfigBag,
     ) -> Result<(), BoxError> {
-        let operation_config =
-            Self::extract_operation_config(auth_scheme_endpoint_config, config_bag)?;
         let request_time = runtime_components.time_source().unwrap_or_default().now();
-
-        if identity.data::<Credentials>().is_none() {
-            return Err(SigV4SigningError::WrongIdentityType(identity.clone()).into());
-        };
-
-        let settings = Self::settings(&operation_config);
         let signing_params =
-            Self::signing_params(settings, identity, &operation_config, request_time)?;
+            Self::signing_params(settings, identity, operation_config, request_time)?;
 
         let (signing_instructions, _signature) = {
             // A body that is already in memory can be signed directly. A body that is not in memory
@@ -218,6 +219,35 @@ impl Sign for SigV4Signer {
     }
 }
 
+impl Sign for SigV4Signer {
+    fn sign_http_request(
+        &self,
+        request: &mut HttpRequest,
+        identity: &Identity,
+        auth_scheme_endpoint_config: AuthSchemeEndpointConfig<'_>,
+        runtime_components: &RuntimeComponents,
+        config_bag: &ConfigBag,
+    ) -> Result<(), BoxError> {
+        if identity.data::<Credentials>().is_none() {
+            return Err(SigV4SigningError::WrongIdentityType(identity.clone()).into());
+        };
+
+        let operation_config =
+            Self::extract_operation_config(auth_scheme_endpoint_config, config_bag)?;
+
+        let settings = Self::signing_settings(&operation_config);
+
+        self.sign_http_request(
+            request,
+            identity,
+            settings,
+            &operation_config,
+            runtime_components,
+            config_bag,
+        )
+    }
+}
+
 #[cfg(feature = "event-stream")]
 mod event_stream {
     use aws_sigv4::event_stream::{sign_empty_message, sign_message};