Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

STS does not respect ca cert setting #2920

Open
phoebusm opened this issue Apr 11, 2024 · 0 comments
Open

STS does not respect ca cert setting #2920

phoebusm opened this issue Apr 11, 2024 · 0 comments
Labels
bug This issue is a bug. needs-triage This issue or PR still needs to be triaged.

Comments

@phoebusm
Copy link

phoebusm commented Apr 11, 2024

Describe the bug

m_client = Aws::MakeUnique<Aws::Internal::STSCredentialsClient>(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, config);

The SDK Client Configuration allows user to set caPath and caFIle but STS authentication doesn't use/respect the setting

Expected Behavior

All authentication respects caPath and caFile setting.

Current Behavior

The SDK Client Configuration allows user to set caPath and caFIle but STS authentication doesn't use/respect the setting

Reproduction Steps

In the below code, caFile is pointed to wrong ca file. Yet STS auth should still be able to return a valid token yet the connection to the storage should fail.

Aws::Client::ClientConfiguration config;
config.caFile = "WRONG_CA_FILE";
Aws::S3::S3Client s3_client(config, Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy::Never, false);
Aws::S3::Model::ListObjectsV2Request objects_request;
objects_request.WithBucket("abc");
auto list_objects_outcome = s3_client.ListObjectsV2(objects_request);

Possible Solution

No response

Additional Information/Context

No response

AWS CPP SDK version used

1.11.201

Compiler and Version used

gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0

Operating System and version

Ubuntu 22.04

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue is a bug. needs-triage This issue or PR still needs to be triaged.
Projects
None yet
Development

No branches or pull requests

1 participant