make use_aws_bundled_ca to use bundled ca per plugin level (#33)

`use_aws_bundled_ca` in #32 has a global effect on all aws plugins 
to use aws bundled ca. This commit made the effect per plugin level.

Co-authored-by: Ry Biesemeyer <yaauie@users.noreply.github.com>

CHANGELOG.md

@@ -1,3 +1,6 @@
+## 7.1.4
+  - Fix `use_aws_bundled_ca` to use bundled ca certs per plugin level instead of global [#33](https://github.com/logstash-plugins/logstash-integration-aws/pull/33)
+
 ## 7.1.3
   - Added an option `use_aws_bundled_ca` to use bundled ca certs that ships with AWS SDK to verify SSL peer certificates [#32](https://github.com/logstash-plugins/logstash-integration-aws/pull/32)
 

VERSION

@@ -1 +1 @@
-7.1.3
+7.1.4

lib/logstash/inputs/cloudwatch.rb

@@ -130,8 +130,6 @@ def register
     raise 'Interval must be divisible by period' unless @interval % @period == 0
     raise "Filters must be defined for when using #{@namespace} namespace" if @filters.nil? && filters_required?(@namespace)
 
-    setup_aws_client_config
-
     @last_check = Time.now
   end # def register
 

lib/logstash/inputs/s3.rb

@@ -100,7 +100,6 @@ def register
 
     @logger.info("Registering", :bucket => @bucket, :region => @region)
 
-    setup_aws_client_config
     s3 = get_s3object
 
     @s3bucket = s3.bucket(@bucket)

lib/logstash/inputs/sqs.rb

@@ -99,7 +99,6 @@ def register
     require "aws-sdk-sqs"
     @logger.info("Registering SQS input", :queue => @queue, :queue_owner_aws_account_id => @queue_owner_aws_account_id)
 
-    setup_aws_client_config
     setup_queue
   end
 

lib/logstash/outputs/cloudwatch.rb

@@ -163,7 +163,6 @@ def register
     require "thread"
     require "aws-sdk-cloudwatch"
 
-    setup_aws_client_config
     @cw = Aws::CloudWatch::Client.new(aws_options_hash)
 
     @event_queue = SizedQueue.new(@queue_size)

lib/logstash/outputs/s3.rb

@@ -209,8 +209,6 @@ def register
       raise LogStash::ConfigurationError, "Logstash must have the permissions to write to the temporary directory: #{@temporary_directory}"
     end
 
-    setup_aws_client_config
-
     if @validate_credentials_on_root_bucket && !WriteBucketPermissionValidator.new(@logger).valid?(bucket_resource, upload_options)
       raise LogStash::ConfigurationError, "Logstash must have the privileges to write to root bucket `#{@bucket}`, check your credentials or your permissions."
     end

lib/logstash/outputs/sns.rb

@@ -58,7 +58,6 @@ class LogStash::Outputs::Sns < LogStash::Outputs::Base
   def register
     require "aws-sdk-sns"
 
-    setup_aws_client_config
     @sns = Aws::SNS::Client.new(aws_options_hash)
 
     publish_boot_message_arn()

lib/logstash/outputs/sqs.rb

@@ -86,7 +86,6 @@ class LogStash::Outputs::SQS < LogStash::Outputs::Base
 
   public
   def register
-    setup_aws_client_config
     @sqs = Aws::SQS::Client.new(aws_options_hash)
 
     if @batch_events > 10

lib/logstash/plugin_mixins/aws_config/v2.rb

@@ -35,11 +35,14 @@ def aws_options_hash
       opts = symbolize_keys_and_cast_true_false(additional_settings).merge(opts)
     end
 
-    return opts
-  end
+    if @use_aws_bundled_ca
+      aws_core_library = Gem.loaded_specs['aws-sdk-core']&.full_gem_path or fail("AWS Core library not available")
+      opts[:ssl_ca_bundle] = File.expand_path('ca-bundle.crt', aws_core_library).tap do |aws_core_ca_bundle|
+        fail("AWS Core CA bundle not found") unless File.exists?(aws_core_ca_bundle)
+      end
+    end
 
-  def setup_aws_client_config
-    Aws.use_bundled_cert! if @use_aws_bundled_ca
+    return opts
   end
 
   private

spec/plugin_mixin/aws_config_spec.rb

@@ -152,6 +152,25 @@ class DummyInputAwsConfigV2NoRegionMethod < LogStash::Inputs::Base
 
       end
     end
+
+  end
+
+  describe 'use aws bundled ca' do
+    context 'set to true' do
+      let(:settings) { { 'use_aws_bundled_ca' => true } }
+
+      it 'points ssl_ca_bundle to aws-sdk-core certs' do
+        expect(subject[:ssl_ca_bundle]).to match /aws-sdk-core.*ca-bundle\.crt\z/
+      end
+    end
+
+    context 'set to false' do
+      let(:settings) { { 'use_aws_bundled_ca' => false } }
+
+      it 'does not include the AWS bundled CA' do
+        expect(subject).to_not include :ssl_ca_bundle
+      end
+    end
   end
 
   describe 'config proxy' do