Browse Source
Fix STS AssumeRole with POST body param (#8320)
Fix STS AssumeRole with POST body param (#8320)
* Fix STS AssumeRole with POST body param and add integration test * Add STS integration test to CI workflow * Address code review feedback: fix HPP vulnerability and style issues * Refactor: address code review feedback - Fix HTTP Parameter Pollution vulnerability in UnifiedPostHandler - Refactor permission check logic for better readability - Extract test helpers to testutil/docker.go to reduce duplication - Clean up imports and simplify context setting * Add SigV4-style test variant for AssumeRole POST body routing - Added ActionInBodyWithSigV4Style test case to validate real-world scenario - Test confirms routing works correctly for AWS SigV4-signed requests - Addresses code review feedback about testing with SigV4 signatures * Fix: always set identity in context when non-nil - Ensure UnifiedPostHandler always calls SetIdentityInContext when identity is non-nil - Only call SetIdentityNameInContext when identity.Name is non-empty - This ensures downstream handlers (embeddedIam.DoActions) always have access to identity - Addresses potential issue where empty identity.Name would skip context settingpull/8324/head
Chris Lu
4 weeks ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 692 additions and 16 deletions
-
66.github/workflows/s3-tables-tests.yml
-
280test/s3tables/sts_integration/sts_integration_test.go
-
66test/s3tables/testutil/docker.go
-
90weed/s3api/s3api_server.go
-
6weed/s3api/s3err/s3api_errors.go
-
200weed/s3api/sts_params_test.go
@ -0,0 +1,280 @@ |
|||
package sts_integration |
|||
|
|||
import ( |
|||
"context" |
|||
"fmt" |
|||
"os" |
|||
"os/exec" |
|||
"path/filepath" |
|||
"testing" |
|||
"time" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/test/s3tables/testutil" |
|||
) |
|||
|
|||
// TestEnvironment mirrors the one in trino_catalog_test.go but simplified
|
|||
type TestEnvironment struct { |
|||
seaweedDir string |
|||
weedBinary string |
|||
dataDir string |
|||
bindIP string |
|||
s3Port int |
|||
s3GrpcPort int |
|||
masterPort int |
|||
masterGrpcPort int |
|||
filerPort int |
|||
filerGrpcPort int |
|||
volumePort int |
|||
volumeGrpcPort int |
|||
weedProcess *exec.Cmd |
|||
weedCancel context.CancelFunc |
|||
dockerAvailable bool |
|||
accessKey string |
|||
secretKey string |
|||
} |
|||
|
|||
func TestSTSIntegration(t *testing.T) { |
|||
if testing.Short() { |
|||
t.Skip("Skipping integration test in short mode") |
|||
} |
|||
|
|||
env := NewTestEnvironment(t) |
|||
defer env.Cleanup(t) |
|||
|
|||
if !env.dockerAvailable { |
|||
t.Skip("Docker not available, skipping STS integration test") |
|||
} |
|||
|
|||
fmt.Printf(">>> Starting SeaweedFS...\n") |
|||
env.StartSeaweedFS(t) |
|||
fmt.Printf(">>> SeaweedFS started.\n") |
|||
|
|||
// Run python script in docker to test STS
|
|||
runPythonSTSClient(t, env) |
|||
} |
|||
|
|||
func NewTestEnvironment(t *testing.T) *TestEnvironment { |
|||
t.Helper() |
|||
|
|||
wd, err := os.Getwd() |
|||
if err != nil { |
|||
t.Fatalf("Failed to get working directory: %v", err) |
|||
} |
|||
|
|||
seaweedDir := wd |
|||
for i := 0; i < 6; i++ { |
|||
if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil { |
|||
break |
|||
} |
|||
seaweedDir = filepath.Dir(seaweedDir) |
|||
} |
|||
|
|||
weedBinary := filepath.Join(seaweedDir, "weed", "weed") |
|||
info, err := os.Stat(weedBinary) |
|||
if err != nil || info.IsDir() { |
|||
weedBinary = "weed" |
|||
if _, err := exec.LookPath(weedBinary); err != nil { |
|||
t.Skip("weed binary not found, skipping integration test") |
|||
} |
|||
} |
|||
|
|||
if !testutil.HasDocker() { |
|||
t.Skip("Docker not available, skipping integration test") |
|||
} |
|||
|
|||
// Create a unique temporary directory for this test run
|
|||
dataDir, err := os.MkdirTemp("", "seaweed-sts-test-*") |
|||
if err != nil { |
|||
t.Fatalf("Failed to create temp dir: %v", err) |
|||
} |
|||
// The Cleanup method will remove this directory, so no need for defer here.
|
|||
|
|||
bindIP := testutil.FindBindIP() |
|||
|
|||
masterPort, masterGrpcPort := testutil.MustFreePortPair(t, "Master") |
|||
volumePort, volumeGrpcPort := testutil.MustFreePortPair(t, "Volume") |
|||
filerPort, filerGrpcPort := testutil.MustFreePortPair(t, "Filer") |
|||
s3Port, s3GrpcPort := testutil.MustFreePortPair(t, "S3") // Changed to use testutil.MustFreePortPair
|
|||
|
|||
return &TestEnvironment{ |
|||
seaweedDir: seaweedDir, |
|||
weedBinary: weedBinary, |
|||
dataDir: dataDir, |
|||
bindIP: bindIP, |
|||
s3Port: s3Port, |
|||
s3GrpcPort: s3GrpcPort, |
|||
masterPort: masterPort, |
|||
masterGrpcPort: masterGrpcPort, |
|||
filerPort: filerPort, |
|||
filerGrpcPort: filerGrpcPort, |
|||
volumePort: volumePort, |
|||
volumeGrpcPort: volumeGrpcPort, |
|||
dockerAvailable: testutil.HasDocker(), |
|||
accessKey: "admin", // Matching default in testutil.WriteIAMConfig
|
|||
secretKey: "admin", |
|||
} |
|||
} |
|||
|
|||
func (env *TestEnvironment) StartSeaweedFS(t *testing.T) { |
|||
t.Helper() |
|||
|
|||
// Create IAM config file
|
|||
iamConfigPath, err := testutil.WriteIAMConfig(env.dataDir, env.accessKey, env.secretKey) |
|||
if err != nil { |
|||
t.Fatalf("Failed to create IAM config: %v", err) |
|||
} |
|||
|
|||
// Create empty security.toml
|
|||
securityToml := filepath.Join(env.dataDir, "security.toml") |
|||
if err := os.WriteFile(securityToml, []byte("# Empty security config for testing\n"), 0644); err != nil { |
|||
t.Fatalf("Failed to create security.toml: %v", err) |
|||
} |
|||
|
|||
ctx, cancel := context.WithCancel(context.Background()) |
|||
env.weedCancel = cancel |
|||
|
|||
cmd := exec.CommandContext(ctx, env.weedBinary, "mini", |
|||
"-master.port", fmt.Sprintf("%d", env.masterPort), |
|||
"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort), |
|||
"-volume.port", fmt.Sprintf("%d", env.volumePort), |
|||
"-volume.port.grpc", fmt.Sprintf("%d", env.volumeGrpcPort), |
|||
"-filer.port", fmt.Sprintf("%d", env.filerPort), |
|||
"-filer.port.grpc", fmt.Sprintf("%d", env.filerGrpcPort), |
|||
"-s3.port", fmt.Sprintf("%d", env.s3Port), |
|||
"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort), |
|||
"-s3.config", iamConfigPath, |
|||
"-ip", env.bindIP, |
|||
"-ip.bind", "0.0.0.0", |
|||
"-dir", env.dataDir, |
|||
) |
|||
cmd.Dir = env.dataDir |
|||
cmd.Stdout = os.Stdout |
|||
cmd.Stderr = os.Stderr |
|||
|
|||
if err := cmd.Start(); err != nil { |
|||
t.Fatalf("Failed to start SeaweedFS: %v", err) |
|||
} |
|||
env.weedProcess = cmd |
|||
|
|||
// Wait for S3 API to be ready
|
|||
if !testutil.WaitForService(fmt.Sprintf("http://localhost:%d/status", env.s3Port), 30*time.Second) { |
|||
t.Fatalf("S3 API failed to become ready") |
|||
} |
|||
} |
|||
|
|||
func (env *TestEnvironment) Start(t *testing.T) { |
|||
if !testutil.HasDocker() { |
|||
t.Skip("Docker not available") |
|||
} |
|||
} |
|||
|
|||
func (env *TestEnvironment) Cleanup(t *testing.T) { |
|||
t.Helper() |
|||
if env.weedCancel != nil { |
|||
env.weedCancel() |
|||
} |
|||
if env.weedProcess != nil { |
|||
time.Sleep(1 * time.Second) |
|||
_ = env.weedProcess.Wait() |
|||
} |
|||
if env.dataDir != "" { |
|||
_ = os.RemoveAll(env.dataDir) |
|||
} |
|||
} |
|||
|
|||
func runPythonSTSClient(t *testing.T, env *TestEnvironment) { |
|||
t.Helper() |
|||
|
|||
// Write python script to temp dir
|
|||
scriptContent := fmt.Sprintf(` |
|||
import boto3 |
|||
import botocore.config |
|||
from botocore.exceptions import ClientError |
|||
import os |
|||
import sys |
|||
|
|||
print("Starting STS test...") |
|||
|
|||
endpoint_url = "http://host.docker.internal:%d" |
|||
access_key = "%s" |
|||
secret_key = "%s" |
|||
region = "us-east-1" |
|||
|
|||
print(f"Connecting to {endpoint_url} with key {access_key}") |
|||
|
|||
try: |
|||
config = botocore.config.Config( |
|||
retries={'max_attempts': 0} |
|||
) |
|||
sts = boto3.client( |
|||
'sts', |
|||
endpoint_url=endpoint_url, |
|||
aws_access_key_id=access_key, |
|||
aws_secret_access_key=secret_key, |
|||
region_name=region, |
|||
config=config |
|||
) |
|||
|
|||
role_arn = "arn:aws:iam::000000000000:role/test-role" |
|||
session_name = "test-session" |
|||
|
|||
print(f"Calling AssumeRole on {role_arn}") |
|||
|
|||
# This call typically sends parameters in POST body by default in boto3 |
|||
response = sts.assume_role( |
|||
RoleArn=role_arn, |
|||
RoleSessionName=session_name |
|||
) |
|||
|
|||
print("Success! Got credentials:") |
|||
print(response['Credentials']) |
|||
|
|||
except ClientError as e: |
|||
# Print available keys for debugging if needed |
|||
# print(e.response.keys()) |
|||
|
|||
response_meta = e.response.get('ResponseMetadata', {}) |
|||
http_code = response_meta.get('HTTPStatusCode') |
|||
|
|||
error_data = e.response.get('Error', {}) |
|||
error_code = error_data.get('Code', 'Unknown') |
|||
|
|||
print(f"Got error: {http_code} {error_code}") |
|||
|
|||
# We expect 503 ServiceUnavailable because stsHandlers is nil in weed mini |
|||
# This confirms the request was routed to STS handler logic (UnifiedPostHandler) |
|||
# instead of IAM handler (which would return 403 AccessDenied or 501 NotImplemented) |
|||
if http_code == 503: |
|||
print("SUCCESS: Got expected 503 Service Unavailable (STS not configured)") |
|||
sys.exit(0) |
|||
|
|||
print(f"FAILED: Unexpected error {e}") |
|||
sys.exit(1) |
|||
except Exception as e: |
|||
print(f"FAILED: {e}") |
|||
sys.exit(1) |
|||
`, env.s3Port, env.accessKey, env.secretKey) |
|||
|
|||
scriptPath := filepath.Join(env.dataDir, "sts_test.py") |
|||
if err := os.WriteFile(scriptPath, []byte(scriptContent), 0644); err != nil { |
|||
t.Fatalf("Failed to write python script: %v", err) |
|||
} |
|||
|
|||
containerName := "seaweed-sts-client-" + fmt.Sprintf("%d", time.Now().UnixNano()) |
|||
|
|||
cmd := exec.Command("docker", "run", "--rm", |
|||
"--name", containerName, |
|||
"--add-host", "host.docker.internal:host-gateway", |
|||
"-v", fmt.Sprintf("%s:/work", env.dataDir), |
|||
"python:3", |
|||
"/bin/bash", "-c", "pip install boto3 && python /work/sts_test.py", |
|||
) |
|||
|
|||
output, err := cmd.CombinedOutput() |
|||
if err != nil { |
|||
t.Fatalf("Python STS client failed: %v\nOutput:\n%s", err, string(output)) |
|||
} |
|||
t.Logf("Python STS client output:\n%s", string(output)) |
|||
} |
|||
|
|||
// Helpers copied from trino_catalog_test.go
|
|||
@ -0,0 +1,66 @@ |
|||
package testutil |
|||
|
|||
import ( |
|||
"context" |
|||
"net" |
|||
"net/http" |
|||
"os/exec" |
|||
"testing" |
|||
"time" |
|||
) |
|||
|
|||
func HasDocker() bool { |
|||
cmd := exec.Command("docker", "version") |
|||
return cmd.Run() == nil |
|||
} |
|||
|
|||
func MustFreePortPair(t *testing.T, name string) (int, int) { |
|||
httpPort, grpcPort, err := findAvailablePortPair() |
|||
if err != nil { |
|||
t.Fatalf("Failed to get free port pair for %s: %v", name, err) |
|||
} |
|||
return httpPort, grpcPort |
|||
} |
|||
|
|||
func findAvailablePortPair() (int, int, error) { |
|||
httpPort, err := GetFreePort() |
|||
if err != nil { |
|||
return 0, 0, err |
|||
} |
|||
grpcPort, err := GetFreePort() |
|||
if err != nil { |
|||
return 0, 0, err |
|||
} |
|||
return httpPort, grpcPort, nil |
|||
} |
|||
|
|||
func GetFreePort() (int, error) { |
|||
listener, err := net.Listen("tcp", "0.0.0.0:0") |
|||
if err != nil { |
|||
return 0, err |
|||
} |
|||
defer listener.Close() |
|||
return listener.Addr().(*net.TCPAddr).Port, nil |
|||
} |
|||
|
|||
func WaitForService(url string, timeout time.Duration) bool { |
|||
client := &http.Client{Timeout: 2 * time.Second} |
|||
ctx, cancel := context.WithTimeout(context.Background(), timeout) |
|||
defer cancel() |
|||
|
|||
ticker := time.NewTicker(500 * time.Millisecond) |
|||
defer ticker.Stop() |
|||
|
|||
for { |
|||
select { |
|||
case <-ctx.Done(): |
|||
return false |
|||
case <-ticker.C: |
|||
resp, err := client.Get(url) |
|||
if err == nil { |
|||
resp.Body.Close() |
|||
return true |
|||
} |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,200 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"context" |
|||
"net/http" |
|||
"net/http/httptest" |
|||
"net/url" |
|||
"strings" |
|||
"sync" |
|||
"testing" |
|||
|
|||
"github.com/gorilla/mux" |
|||
"github.com/seaweedfs/seaweedfs/weed/iam/sts" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err" |
|||
"github.com/stretchr/testify/assert" |
|||
) |
|||
|
|||
// Minimal mock implementation of AuthenticateJWT needed for testing
|
|||
type mockIAMIntegration struct{} |
|||
|
|||
func (m *mockIAMIntegration) AuthenticateJWT(ctx context.Context, r *http.Request) (*IAMIdentity, s3err.ErrorCode) { |
|||
return &IAMIdentity{ |
|||
Name: "test-user", |
|||
Account: &Account{ |
|||
Id: "test-account", |
|||
DisplayName: "test-account", |
|||
EmailAddress: "test@example.com", |
|||
}, |
|||
Principal: "arn:aws:iam::test-account:user/test-user", |
|||
SessionToken: "mock-session-token", |
|||
}, s3err.ErrNone |
|||
} |
|||
func (m *mockIAMIntegration) AuthorizeAction(ctx context.Context, identity *IAMIdentity, action Action, bucket, object string, r *http.Request) s3err.ErrorCode { |
|||
return s3err.ErrNone |
|||
} |
|||
func (m *mockIAMIntegration) ValidateTrustPolicyForPrincipal(ctx context.Context, roleArn, principalArn string) error { |
|||
return nil |
|||
} |
|||
func (m *mockIAMIntegration) ValidateSessionToken(ctx context.Context, token string) (*sts.SessionInfo, error) { |
|||
return nil, nil |
|||
} |
|||
|
|||
func TestSTSAssumeRolePostBody(t *testing.T) { |
|||
// Setup S3ApiServer with IAM enabled
|
|||
option := &S3ApiServerOption{ |
|||
DomainName: "localhost", |
|||
EnableIam: true, |
|||
Filers: []pb.ServerAddress{"localhost:8888"}, |
|||
} |
|||
|
|||
// Create IAM instance that we can control
|
|||
// We need to bypass the file/store loading logic in NewIdentityAccessManagement
|
|||
// So we construct it manually similarly to how it's done for tests
|
|||
iam := &IdentityAccessManagement{ |
|||
identities: []*Identity{{Name: "test-user"}}, |
|||
isAuthEnabled: true, |
|||
accessKeyIdent: make(map[string]*Identity), |
|||
nameToIdentity: make(map[string]*Identity), |
|||
iamIntegration: &mockIAMIntegration{}, |
|||
} |
|||
|
|||
// Pre-populate an identity for testing
|
|||
ident := &Identity{ |
|||
Name: "test-user", |
|||
Credentials: []*Credential{ |
|||
{AccessKey: "test", SecretKey: "test", Status: "Active"}, |
|||
}, |
|||
Actions: nil, // Admin
|
|||
IsStatic: true, |
|||
} |
|||
iam.identities[0] = ident |
|||
iam.accessKeyIdent["test"] = ident |
|||
iam.nameToIdentity["test-user"] = ident |
|||
|
|||
s3a := &S3ApiServer{ |
|||
option: option, |
|||
iam: iam, |
|||
embeddedIam: &EmbeddedIamApi{iam: iam, getS3ApiConfigurationFunc: func(cfg *iam_pb.S3ApiConfiguration) error { return nil }}, |
|||
stsHandlers: NewSTSHandlers(nil, iam), // STS service nil -> will return STSErrSTSNotReady (503)
|
|||
credentialManager: nil, // Not needed for this test as we pre-populated IAM
|
|||
cb: &CircuitBreaker{ |
|||
counters: make(map[string]*int64), |
|||
limitations: make(map[string]int64), |
|||
}, |
|||
} |
|||
s3a.cb.s3a = s3a |
|||
s3a.inFlightDataLimitCond = sync.NewCond(&sync.Mutex{}) |
|||
|
|||
// Create router and register routes
|
|||
router := mux.NewRouter() |
|||
s3a.registerRouter(router) |
|||
|
|||
// Test Case 1: STS Action in Query String (Should work - routed to STS)
|
|||
t.Run("ActionInQuery", func(t *testing.T) { |
|||
req := httptest.NewRequest("POST", "/?Action=AssumeRole", nil) |
|||
// We aren't signing requests, so we expect STSErrAccessDenied (403) from STS handler
|
|||
// due to invalid signature, OR STSErrSTSNotReady (503) if it gets past auth.
|
|||
// The key is it should NOT be 501 Not Implemented (which comes from IAM handler)
|
|||
|
|||
rr := httptest.NewRecorder() |
|||
router.ServeHTTP(rr, req) |
|||
|
|||
// If routed to STS, we expect 400 (Bad Request) - MissingParameter
|
|||
// because we didn't provide RoleArn/RoleSessionName etc.
|
|||
// Or 503 if it checks STS service readiness first.
|
|||
|
|||
// Let's see what we get. The STS handler checks parameters first.
|
|||
// "RoleArn is required" -> 400 Bad Request
|
|||
|
|||
assert.NotEqual(t, http.StatusNotImplemented, rr.Code, "Should not return 501 (IAM handler)") |
|||
assert.Equal(t, http.StatusBadRequest, rr.Code, "Should return 400 (STS handler) for missing params") |
|||
}) |
|||
|
|||
// Test Case 2: STS Action in Body (Should FAIL current implementation - routed to IAM)
|
|||
t.Run("ActionInBody", func(t *testing.T) { |
|||
form := url.Values{} |
|||
form.Add("Action", "AssumeRole") |
|||
form.Add("RoleArn", "arn:aws:iam::123:role/test") |
|||
form.Add("RoleSessionName", "session") |
|||
|
|||
req := httptest.NewRequest("POST", "/", strings.NewReader(form.Encode())) |
|||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
|||
// We need an Authorization header to trigger the IAM matcher
|
|||
// The matcher checks: getRequestAuthType(r) != authTypeAnonymous
|
|||
// So we provide a dummy auth header
|
|||
|
|||
req.Header.Set("Authorization", "Bearer test-token") |
|||
|
|||
rr := httptest.NewRecorder() |
|||
router.ServeHTTP(rr, req) |
|||
|
|||
// CURRENT BEHAVIOR:
|
|||
// The Router does not match "/" for STS because Action is not in query.
|
|||
// The Router matches "/" for IAM because it has Authorization header.
|
|||
// IAM handler (AuthIam) calls DoActions.
|
|||
// DoActions switches on "AssumeRole" -> default -> Not Implemented (501).
|
|||
|
|||
// DESIRED BEHAVIOR (after fix):
|
|||
// Should be routed to UnifiedPostHandler (or similar), detected as STS action,
|
|||
// and routed to STS handler.
|
|||
// STS handler should return 403 Forbidden (Access Denied) or 400 Bad Request
|
|||
// because of signature mismatch (since we provided dummy auth).
|
|||
// It should NOT be 501.
|
|||
|
|||
// For verification of fix, we assert it IS 503 (STS Service Not Initialized).
|
|||
// This confirms it was routed to STS handler.
|
|||
if rr.Code != http.StatusServiceUnavailable { |
|||
t.Logf("Unexpected status code: %d", rr.Code) |
|||
t.Logf("Response body: %s", rr.Body.String()) |
|||
} |
|||
// Confirm it routed to STS
|
|||
assert.Equal(t, http.StatusServiceUnavailable, rr.Code, "Fixed behavior: Should return 503 from STS handler (service not ready)") |
|||
}) |
|||
|
|||
// Test Case 3: STS Action in Body with SigV4-style Authorization (Real-world scenario)
|
|||
// This test validates that requests with AWS SigV4 Authorization headers and POST body
|
|||
// parameters are correctly routed to the STS handler.
|
|||
t.Run("ActionInBodyWithSigV4Style", func(t *testing.T) { |
|||
form := url.Values{} |
|||
form.Add("Action", "AssumeRole") |
|||
form.Add("RoleArn", "arn:aws:iam::123:role/test") |
|||
form.Add("RoleSessionName", "session") |
|||
|
|||
bodyContent := form.Encode() |
|||
req := httptest.NewRequest("POST", "/", strings.NewReader(bodyContent)) |
|||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
|||
|
|||
// Set AWS SigV4-style Authorization header
|
|||
// This simulates a real SigV4-signed request without needing perfect signature
|
|||
// The key is to validate that UnifiedPostHandler correctly routes based on Action
|
|||
req.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential=test/20260212/us-east-1/sts/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=dummy") |
|||
req.Header.Set("x-amz-date", "20260212T000000Z") |
|||
|
|||
rr := httptest.NewRecorder() |
|||
router.ServeHTTP(rr, req) |
|||
|
|||
// With SigV4-style Authorization header, the request should:
|
|||
// 1. Be recognized as authenticated (not anonymous)
|
|||
// 2. Be routed to UnifiedPostHandler
|
|||
// 3. UnifiedPostHandler should parse Action=AssumeRole from body
|
|||
// 4. Route to STS handler (which returns 503 because stsService is nil)
|
|||
// OR return 403 if signature validation fails (which is acceptable)
|
|||
|
|||
// The key validation is that it should NOT return 501 (IAM handler's "Not Implemented")
|
|||
// This confirms the routing fix works for SigV4-signed requests with POST body params
|
|||
|
|||
if rr.Code != http.StatusServiceUnavailable && rr.Code != http.StatusForbidden { |
|||
t.Logf("Unexpected status code: %d", rr.Code) |
|||
t.Logf("Response body: %s", rr.Body.String()) |
|||
} |
|||
|
|||
// Accept either 503 (routed to STS, service unavailable) or 403 (signature failed)
|
|||
// Both indicate correct routing to STS handler, not IAM handler
|
|||
assert.NotEqual(t, http.StatusNotImplemented, rr.Code, "Should not return 501 (IAM handler)") |
|||
assert.Contains(t, []int{http.StatusServiceUnavailable, http.StatusForbidden}, rr.Code, |
|||
"Should return 503 (STS unavailable) or 403 (auth failed), confirming STS routing") |
|||
}) |
|||
} |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue