Skip to content

fix: filtering client suppliers MUST check the client region after creation as well as before #261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from

Conversation

mattsb42-aws
Copy link
Member

Issue #, if available:
resolves: #258

Description of changes:

Per #258, this introduces two changes to the filtering client suppliers:

  1. They now accept None to let users filter out requests when the region is unknown
  2. In addition to checking the requested region before calling down to the inner client supplier, they now also check the client returned by the client supplier before returning it. This is to accommodate the scenario where the desired region is unknown and is set in the client by the inner client supplier.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Check any applicable:

  • Were any files moved? Moving files changes their URL, which breaks all hyperlinks to the files.

acioc
acioc previously approved these changes Apr 23, 2020
Comment on lines +139 to +157
def test_deny_region_block_on_response():
region = "us-west-2"
test = DenyRegionsClientSupplier(
denied_regions=[region], client_supplier=AlwaysOneRegionClientSupplier(region_name=region)
)

# Catch the blocked region on response.
with pytest.raises(UnknownRegionError):
test(None)


def test_allow_region_block_on_response():
test = AllowRegionsClientSupplier(
allowed_regions=[None, "us-west-2"], client_supplier=AlwaysOneRegionClientSupplier(region_name="us-east-2")
)

# Catch the blocked region on response.
with pytest.raises(UnknownRegionError):
test(None)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we also test the positive cases? Passing None but having it be a valid region once it's checked?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call. Additional tests added.

@mattsb42-aws
Copy link
Member Author

Discarding this change due to upcoming major rework of AWS KMS keyrings.

https://github.com/awslabs/aws-encryption-sdk-specification/blob/master/proposals/2020-07-01_aws-kms-keyring-redesign/change.md

@mattsb42-aws mattsb42-aws deleted the dev-258 branch July 29, 2020 19:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[keyring] the filtering client suppliers need to check the client region after getting it as well as before
2 participants