Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Functionality to Send Unsigned Requests to AWS for Auditing #352

Closed
dillonrg opened this issue Jan 19, 2023 · 1 comment
Closed

Add Functionality to Send Unsigned Requests to AWS for Auditing #352

dillonrg opened this issue Jan 19, 2023 · 1 comment

Comments

@dillonrg
Copy link
Contributor

dillonrg commented Jan 19, 2023

Bug

When running the local auditor against a publicly visible S3 bucket, we can run into failures due to credentials not existing despite the fact that they are not needed:

dillon@dillon-mbp ~/o/akd> cargo run -p akd_local_auditor -- s3 --bucket kt-audit-proofs-integration --region us-east-2                                                                                                                               main
warning: profiles for the non root package will be ignored, specify profiles at the workspace root:
package:   /Users/dillon/oss/akd/akd_core/Cargo.toml
workspace: /Users/dillon/oss/akd/Cargo.toml
warning: profiles for the non root package will be ignored, specify profiles at the workspace root:
package:   /Users/dillon/oss/akd/akd_client/Cargo.toml
workspace: /Users/dillon/oss/akd/Cargo.toml
    Finished dev [unoptimized + debuginfo] target(s) in 5.61s
     Running `target/debug/akd_local_auditor s3 --bucket kt-audit-proofs-integration --region us-east-2`
$ audit --epoch 1
[00:00:03.982] INFO   load_region; provider=Region("us-east-2") (region:43)
[00:00:04.169] INFO   send_operation; (parse_response:95)
[00:00:04.169] INFO   send_operation; operation="ListObjectsV2" (parse_response:95)
[00:00:04.169] INFO   send_operation; service="s3" (parse_response:95)
[00:00:04.169] INFO   provide_credentials; provider=default_chain (credentials:73)
[00:00:04.170] INFO   send_operation; (parse_response:95)
[00:00:04.170] INFO   send_operation; operation="get" (parse_response:95)
[00:00:04.170] INFO   send_operation; service="imds" (parse_response:95)
[00:00:04.170] INFO   send_operation; (parse_response:95)
[00:00:04.170] INFO   send_operation; operation="get-token" (parse_response:95)
[00:00:04.170] INFO   send_operation; service="imds" (parse_response:95)
[00:00:05.174] INFO   send_operation; status="dispatch_failure" (parse_response:95)
[00:00:05.174] INFO   send_operation; message=timeout: error trying to connect: HTTP connect timeout occurred after 1s (parse_response:95)
[00:00:05.174] INFO   send_operation; status="construction_failure" (parse_response:95)
[00:00:05.174] INFO   send_operation; message=Failed to load session token: timeout: error trying to connect: HTTP connect timeout occurred after 1s (parse_response:95)
[00:00:05.174] INFO   provider returned CredentialsNotLoaded, ignoring (auth:53)
[00:00:05.175] INFO   send_operation; status="construction_failure" (parse_response:95)
[00:00:05.175] INFO   send_operation; message=No credentials in the property bag (parse_response:95)
Error: Error executing list_objects_v2 in S3: failed to construct request: No credentials in the property bag

Goal

Without any AWS credentials, a request to audit information stored in S3 may fail. In order to make anonymous requests to AWS, we should evaluate a means of sending an "anonymous" request to S3 to read its data.

For reference, please see awslabs/aws-sdk-rust#425.

@kevinlewi
Copy link
Contributor

Addressed in #380

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants