GO-2025-4090: lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs

awsiam

package

v1.65.2 Latest Latest Go to latest Published: Aug 12, 2025 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/treeverse/lakefs

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func NewPresignClientLoggerOption(logger logging.Logger, logMode aws.ClientLogMode) func(opts *sts.PresignOptions)
func PresignGetCallerIdentityFromAuthParams(ctx context.Context, params *IAMAuthParams, stsClient *sts.Client, ...) (string, error)
type AWSIdentityTokenInfo
- func GenerateIdentityTokenInfo(ctx context.Context, params *IAMAuthParams, stsClient *sts.Client, ...) (*AWSIdentityTokenInfo, error)
- func ParsePresignedURL(presignedURL string) (*AWSIdentityTokenInfo, error)
type IAMAuthParams
- func NewIAMAuthParams(lakeFSHost string, opts ...IAMAuthParamsOptions) *IAMAuthParams
type IAMAuthParamsOptions

Constants ¶

View Source

const (
	AuthVersion       = "2011-06-15"
	AuthMethod        = http.MethodPost
	AuthAction        = "GetCallerIdentity"
	AuthAlgorithm     = "AWS4-HMAC-SHA256"
	StsGlobalEndpoint = "sts.amazonaws.com"
	AuthActionKey     = "Action"
	AuthVersionKey    = "Version"
	AuthAlgorithmKey  = "X-Amz-Algorithm"
	//nolint:gosec
	AuthCredentialKey  = "X-Amz-Credential"
	AuthDateKey        = "X-Amz-Date"
	HostServerIDHeader = "X-LakeFS-Server-ID"
	AuthExpiresKey     = "X-Amz-Expires"
	//nolint:gosec
	AuthSecurityTokenKey = "X-Amz-Security-Token"
	AuthSignedHeadersKey = "X-Amz-SignedHeaders"
	AuthSignatureKey     = "X-Amz-Signature"
	DatetimeFormat       = "20060102T150405Z"
	CredentialTimeFormat = "20060102"
)

View Source

const (
	DefaultSTSLoginExpire  = 15 * time.Minute
	DefaultRefreshInterval = 5 * time.Minute
	DefaultURLPresignTTL   = 1 * time.Minute
	DefaultTokenTTL        = 3600 * time.Minute
)

Variables ¶

View Source

var ErrInvalidCredentialsFormat = errors.New("missing required parts in query param X-Amz-Credential")

Functions ¶

func NewPresignClientLoggerOption ¶ added in v1.57.0

func NewPresignClientLoggerOption(logger logging.Logger, logMode aws.ClientLogMode) func(opts *sts.PresignOptions)

func PresignGetCallerIdentityFromAuthParams ¶

func PresignGetCallerIdentityFromAuthParams(ctx context.Context, params *IAMAuthParams, stsClient *sts.Client, presignClientOpts ...func(*sts.PresignOptions)) (string, error)

Types ¶

type AWSIdentityTokenInfo ¶

type AWSIdentityTokenInfo struct {
	Method             string   `json:"method"`
	Host               string   `json:"host"`
	Region             string   `json:"region"`
	Action             string   `json:"action"`
	Date               string   `json:"date"`
	ExpirationDuration string   `json:"expiration_duration"`
	AccessKeyID        string   `json:"access_key_id"`
	Signature          string   `json:"signature"`
	SignedHeaders      []string `json:"signed_headers"`
	Version            string   `json:"version"`
	Algorithm          string   `json:"algorithm"`
	SecurityToken      string   `json:"security_token"`
}

func GenerateIdentityTokenInfo ¶

func GenerateIdentityTokenInfo(ctx context.Context, params *IAMAuthParams, stsClient *sts.Client, presignClientOpts ...func(*sts.PresignOptions)) (*AWSIdentityTokenInfo, error)

func ParsePresignedURL ¶

func ParsePresignedURL(presignedURL string) (*AWSIdentityTokenInfo, error)

type IAMAuthParams ¶

type IAMAuthParams struct {
	TokenRequestHeaders map[string]string
	URLPresignTTL       time.Duration
	TokenTTL            time.Duration
	RefreshInterval     time.Duration
}

func NewIAMAuthParams ¶

func NewIAMAuthParams(lakeFSHost string, opts ...IAMAuthParamsOptions) *IAMAuthParams

type IAMAuthParamsOptions ¶

type IAMAuthParamsOptions = func(params *IAMAuthParams)

func WithRefreshInterval ¶

func WithRefreshInterval(refreshInterval time.Duration) IAMAuthParamsOptions

func WithTokenRequestHeaders ¶

func WithTokenRequestHeaders(tokenRequestHeaders map[string]string) IAMAuthParamsOptions

func WithTokenTTL ¶

func WithTokenTTL(tokenTTL time.Duration) IAMAuthParamsOptions

func WithURLPresignTTL ¶

func WithURLPresignTTL(urlPresignTTL time.Duration) IAMAuthParamsOptions

Source Files ¶

View all Source files

aws_client.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL