Skip to content

Commit 2ec1faa

Browse files
millemsmillems
committed
Added support for enabling FIPS endpoints. (#2826)
This option can be used to make calls be invoked against FIPS-compliant AWS endpoints. This can also be enabled via the AWS_USE_FIPS_ENDPOINT environment variable, aws.useFipsEndpoint system property, or the use_fips_endpoint profile file property:
1 parent 12e7d8a commit 2ec1faa

File tree

52 files changed

+961
-130
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+961
-130
lines changed

‎.changes/next-release/deprecation-AmazonS3Control-df756f2.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"category": "Amazon S3 Control",
3+
"contributor": "",
4+
"type": "deprecation",
5+
"description": "Deprecated `S3ControlConfiguration.Builder`'s `fipsModeEnabled` in favor of the new service-standard `S3ControlClientBuilder.fipsEnabled`."
6+
}

‎.changes/next-release/feature-AWSSDKforJavav2-635c382.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"category": "AWS SDK for Java v2",
3+
"contributor": "",
4+
"type": "feature",
5+
"description": "Added a new `fipsEnabled` property to every client builder, which can be used to make calls be invoked against AWS endpoints which are FIPS compliant. This can also be enabled via the `AWS_USE_FIPS_ENDPOINT` environment variable, `aws.useFipsEndpoint` system property, or the `use_fips_endpoint` profile file property."
6+
}

‎codegen-lite/src/main/java/software/amazon/awssdk/codegen/lite/regions/RegionValidationUtil.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import java.util.Set;
2626
import software.amazon.awssdk.annotations.SdkInternalApi;
2727
import software.amazon.awssdk.codegen.lite.regions.model.Endpoint;
28+
import software.amazon.awssdk.utils.StringUtils;
2829
import software.amazon.awssdk.utils.Validate;
2930

3031
@SdkInternalApi
@@ -43,7 +44,7 @@ public final class RegionValidationUtil {
4344
try (BufferedReader br = new BufferedReader(new InputStreamReader(allowListStream, StandardCharsets.UTF_8))) {
4445
String line;
4546
while ((line = br.readLine()) != null) {
46-
DEPRECATED_REGIONS_ALLOWSLIST.add(line);
47+
DEPRECATED_REGIONS_ALLOWSLIST.add(StringUtils.trim(line));
4748
}
4849
}
4950
} catch (IOException e) {

‎codegen/src/main/java/software/amazon/awssdk/codegen/model/config/customization/CustomizationConfig.java

Lines changed: 10 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -37,16 +37,9 @@ public class CustomizationConfig {
3737
private final List<ConvenienceTypeOverload> convenienceTypeOverloads = new ArrayList<>();
3838

3939
/**
40-
* Specifies the name of the client configuration class to use if a service
41-
* has a specific advanced client configuration class. Null if the service
42-
* does not have advanced configuration.
40+
* Configuration object for service-specific configuration options.
4341
*/
44-
private String serviceSpecificClientConfigClass;
45-
46-
/**
47-
* Whether a service has a dualstack configuration in its {@link #serviceSpecificClientConfigClass}.
48-
*/
49-
private boolean serviceConfigHasDualstackConfig = false;
42+
private ServiceConfig serviceConfig = new ServiceConfig();
5043

5144
/**
5245
* Specify shapes to be renamed.
@@ -244,22 +237,6 @@ public void setShapeModifiers(Map<String, ShapeModifier> shapeModifiers) {
244237
this.shapeModifiers = shapeModifiers;
245238
}
246239

247-
public String getServiceSpecificClientConfigClass() {
248-
return serviceSpecificClientConfigClass;
249-
}
250-
251-
public void setServiceSpecificClientConfigClass(String serviceSpecificClientConfig) {
252-
this.serviceSpecificClientConfigClass = serviceSpecificClientConfig;
253-
}
254-
255-
public boolean getServiceConfigHasDualstackConfig() {
256-
return serviceConfigHasDualstackConfig;
257-
}
258-
259-
public void setServiceConfigHasDualstackConfig(boolean serviceConfigHasDualstackConfig) {
260-
this.serviceConfigHasDualstackConfig = serviceConfigHasDualstackConfig;
261-
}
262-
263240
public List<ConvenienceTypeOverload> getConvenienceTypeOverloads() {
264241
return this.convenienceTypeOverloads;
265242
}
@@ -517,4 +494,12 @@ public RetryMode getDefaultRetryMode() {
517494
public void setDefaultRetryMode(RetryMode defaultRetryMode) {
518495
this.defaultRetryMode = defaultRetryMode;
519496
}
497+
498+
public ServiceConfig getServiceConfig() {
499+
return serviceConfig;
500+
}
501+
502+
public void setServiceConfig(ServiceConfig serviceConfig) {
503+
this.serviceConfig = serviceConfig;
504+
}
520505
}

‎codegen/src/main/java/software/amazon/awssdk/codegen/model/config/customization/ServiceConfig.java

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
package software.amazon.awssdk.codegen.model.config.customization;
17+
18+
public class ServiceConfig {
19+
/**
20+
* Specifies the name of the client configuration class to use if a service
21+
* has a specific advanced client configuration class. Null if the service
22+
* does not have advanced configuration.
23+
*/
24+
private String className;
25+
26+
/**
27+
* Whether the service config has a property used to manage dualstack (should be deprecated in favor of
28+
* AwsClientBuilder#dualstackEnabled).
29+
*/
30+
private boolean hasDualstackProperty = false;
31+
32+
/**
33+
* Whether the service config has a property used to manage FIPS (should be deprecated in favor of
34+
* AwsClientBuilder#fipsEnabled).
35+
*/
36+
private boolean hasFipsProperty = false;
37+
38+
public String getClassName() {
39+
return className;
40+
}
41+
42+
public void setClassName(String className) {
43+
this.className = className;
44+
}
45+
46+
public boolean hasDualstackProperty() {
47+
return hasDualstackProperty;
48+
}
49+
50+
public void setHasDualstackProperty(boolean hasDualstackProperty) {
51+
this.hasDualstackProperty = hasDualstackProperty;
52+
}
53+
54+
public boolean hasFipsProperty() {
55+
return hasFipsProperty;
56+
}
57+
58+
public void setHasFipsProperty(boolean hasFipsProperty) {
59+
this.hasFipsProperty = hasFipsProperty;
60+
}
61+
}

‎codegen/src/main/java/software/amazon/awssdk/codegen/poet/builder/BaseClientBuilderClass.java

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ public TypeSpec poetSpec() {
102102
builder.addMethod(defaultSignerMethod());
103103
builder.addMethod(signingNameMethod());
104104

105-
if (model.getCustomizationConfig().getServiceSpecificClientConfigClass() != null) {
105+
if (model.getCustomizationConfig().getServiceConfig().getClassName() != null) {
106106
builder.addMethod(setServiceConfigurationMethod())
107107
.addMethod(beanStyleSetServiceConfigurationMethod());
108108
}
@@ -167,7 +167,7 @@ private MethodSpec mergeServiceDefaultsMethod() {
167167
+ ".CRC32_FROM_COMPRESSED_DATA_ENABLED, $L)",
168168
SdkClientOption.class, crc32FromCompressedDataEnabled);
169169

170-
String clientConfigClassName = model.getCustomizationConfig().getServiceSpecificClientConfigClass();
170+
String clientConfigClassName = model.getCustomizationConfig().getServiceConfig().getClassName();
171171
if (StringUtils.isNotBlank(clientConfigClassName)) {
172172
builder.addCode(".option($T.SERVICE_CONFIGURATION, $T.builder().build())",
173173
SdkClientOption.class, ClassName.bestGuess(clientConfigClassName));
@@ -239,15 +239,15 @@ private MethodSpec finalizeServiceConfigurationMethod() {
239239
.endControlFlow();
240240
}
241241

242-
String clientConfigClassName = model.getCustomizationConfig().getServiceSpecificClientConfigClass();
242+
String clientConfigClassName = model.getCustomizationConfig().getServiceConfig().getClassName();
243243
if (StringUtils.isNotBlank(clientConfigClassName)) {
244244
ClassName clientConfigClass = ClassName.bestGuess(clientConfigClassName);
245245
builder.addCode("$1T.Builder c = (($1T) config.option($2T.SERVICE_CONFIGURATION)).toBuilder();" +
246246
"c.profileFile(c.profileFile() != null ? c.profileFile() : config.option($2T.PROFILE_FILE));" +
247247
"c.profileName(c.profileName() != null ? c.profileName() : config.option($2T.PROFILE_NAME));",
248248
clientConfigClass, SdkClientOption.class);
249249

250-
if (model.getCustomizationConfig().getServiceConfigHasDualstackConfig()) {
250+
if (model.getCustomizationConfig().getServiceConfig().hasDualstackProperty()) {
251251
builder.addCode("if (c.dualstackEnabled() != null) {")
252252
.addCode(" $T.validState(config.option($T.DUALSTACK_ENDPOINT_ENABLED) == null, \"Dualstack has been "
253253
+ "configured on both $L and the client/global level. Please limit dualstack configuration to "
@@ -257,12 +257,31 @@ private MethodSpec finalizeServiceConfigurationMethod() {
257257
.addCode(" c.dualstackEnabled(config.option($T.DUALSTACK_ENDPOINT_ENABLED));", AwsClientOption.class)
258258
.addCode("}");
259259
}
260+
261+
if (model.getCustomizationConfig().getServiceConfig().hasFipsProperty()) {
262+
builder.addCode("if (c.fipsModeEnabled() != null) {")
263+
.addCode(" $T.validState(config.option($T.FIPS_ENDPOINT_ENABLED) == null, \"Fips has been "
264+
+ "configured on both $L and the client/global level. Please limit fips configuration to "
265+
+ "one location.\");",
266+
Validate.class, AwsClientOption.class, clientConfigClassName)
267+
.addCode("} else {")
268+
.addCode(" c.fipsModeEnabled(config.option($T.FIPS_ENDPOINT_ENABLED));", AwsClientOption.class)
269+
.addCode("}");
270+
}
260271
}
261272

262273
// Update configuration
263274

264275
builder.addCode("return config.toBuilder()\n");
265276

277+
if (model.getCustomizationConfig().getServiceConfig().hasDualstackProperty()) {
278+
builder.addCode(".option($T.DUALSTACK_ENDPOINT_ENABLED, c.dualstackEnabled())", AwsClientOption.class);
279+
}
280+
281+
if (model.getCustomizationConfig().getServiceConfig().hasFipsProperty()) {
282+
builder.addCode(".option($T.FIPS_ENDPOINT_ENABLED, c.fipsModeEnabled())", AwsClientOption.class);
283+
}
284+
266285
if (model.getEndpointOperation().isPresent()) {
267286
builder.addCode(".option($T.ENDPOINT_DISCOVERY_ENABLED, endpointDiscoveryEnabled)\n",
268287
SdkClientOption.class);
@@ -287,7 +306,7 @@ private MethodSpec finalizeServiceConfigurationMethod() {
287306

288307
private MethodSpec setServiceConfigurationMethod() {
289308
ClassName serviceConfiguration = ClassName.get(basePackage,
290-
model.getCustomizationConfig().getServiceSpecificClientConfigClass());
309+
model.getCustomizationConfig().getServiceConfig().getClassName());
291310
return MethodSpec.methodBuilder("serviceConfiguration")
292311
.addModifiers(Modifier.PUBLIC)
293312
.returns(TypeVariableName.get("B"))
@@ -300,7 +319,7 @@ private MethodSpec setServiceConfigurationMethod() {
300319

301320
private MethodSpec beanStyleSetServiceConfigurationMethod() {
302321
ClassName serviceConfiguration = ClassName.get(basePackage,
303-
model.getCustomizationConfig().getServiceSpecificClientConfigClass());
322+
model.getCustomizationConfig().getServiceConfig().getClassName());
304323
return MethodSpec.methodBuilder("setServiceConfiguration")
305324
.addModifiers(Modifier.PUBLIC)
306325
.addParameter(serviceConfiguration, "serviceConfiguration")

‎codegen/src/main/java/software/amazon/awssdk/codegen/poet/builder/BaseClientBuilderInterface.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ public TypeSpec poetSpec() {
5757
builder.addMethod(endpointDiscovery());
5858
}
5959

60-
if (model.getCustomizationConfig().getServiceSpecificClientConfigClass() != null) {
60+
if (model.getCustomizationConfig().getServiceConfig().getClassName() != null) {
6161
builder.addMethod(serviceConfigurationMethod());
6262
builder.addMethod(serviceConfigurationConsumerBuilderMethod());
6363
}
@@ -91,7 +91,7 @@ private MethodSpec endpointDiscovery() {
9191

9292
private MethodSpec serviceConfigurationMethod() {
9393
ClassName serviceConfiguration = ClassName.get(basePackage,
94-
model.getCustomizationConfig().getServiceSpecificClientConfigClass());
94+
model.getCustomizationConfig().getServiceConfig().getClassName());
9595
return MethodSpec.methodBuilder("serviceConfiguration")
9696
.addModifiers(Modifier.ABSTRACT, Modifier.PUBLIC)
9797
.returns(TypeVariableName.get("B"))
@@ -101,7 +101,7 @@ private MethodSpec serviceConfigurationMethod() {
101101

102102
private MethodSpec serviceConfigurationConsumerBuilderMethod() {
103103
ClassName serviceConfiguration = ClassName.get(basePackage,
104-
model.getCustomizationConfig().getServiceSpecificClientConfigClass());
104+
model.getCustomizationConfig().getServiceConfig().getClassName());
105105
TypeName consumerBuilder = ParameterizedTypeName.get(ClassName.get(Consumer.class),
106106
serviceConfiguration.nestedClass("Builder"));
107107
return MethodSpec.methodBuilder("serviceConfiguration")

‎codegen/src/test/resources/software/amazon/awssdk/codegen/poet/builder/test-client-builder-class.java

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,16 @@ protected final SdkClientConfiguration finalizeServiceConfiguration(SdkClientCon
5858
} else {
5959
c.dualstackEnabled(config.option(AwsClientOption.DUALSTACK_ENDPOINT_ENABLED));
6060
}
61-
return config.toBuilder().option(SdkClientOption.EXECUTION_INTERCEPTORS, interceptors)
61+
if (c.fipsModeEnabled() != null) {
62+
Validate.validState(
63+
config.option(AwsClientOption.FIPS_ENDPOINT_ENABLED) == null,
64+
"Fips has been configured on both ServiceConfiguration and the client/global level. Please limit fips configuration to one location.");
65+
} else {
66+
c.fipsModeEnabled(config.option(AwsClientOption.FIPS_ENDPOINT_ENABLED));
67+
}
68+
return config.toBuilder().option(AwsClientOption.DUALSTACK_ENDPOINT_ENABLED, c.dualstackEnabled())
69+
.option(AwsClientOption.FIPS_ENDPOINT_ENABLED, c.fipsModeEnabled())
70+
.option(SdkClientOption.EXECUTION_INTERCEPTORS, interceptors)
6271
.option(SdkClientOption.RETRY_POLICY, MyServiceRetryPolicy.resolveRetryPolicy(config))
6372
.option(SdkClientOption.SERVICE_CONFIGURATION, c.build()).build();
6473
}

‎codegen/src/test/resources/software/amazon/awssdk/codegen/poet/client/c2j/json/customization.config

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,11 @@
44
},
55
"presignersFqcn": "software.amazon.awssdk.services.acm.presign.AcmClientPresigners",
66
"serviceSpecificHttpConfig": "software.amazon.MyServiceHttpConfig",
7-
"serviceSpecificClientConfigClass": "ServiceConfiguration",
8-
"serviceConfigHasDualstackConfig": true,
7+
"serviceConfig": {
8+
"className": "ServiceConfiguration",
9+
"hasDualstackProperty": true,
10+
"hasFipsProperty": true
11+
},
912
"customRetryPolicy": "software.amazon.MyServiceRetryPolicy",
1013
"verifiedSimpleMethods" : ["paginatedOperationWithResultKey"],
1114
"blacklistedSimpleMethods" : [

‎codegen/src/test/resources/software/amazon/awssdk/codegen/poet/client/c2j/rest-json/customization.config

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,11 @@
44
},
55
"presignersFqcn": "software.amazon.awssdk.services.acm.presign.AcmClientPresigners",
66
"serviceSpecificHttpConfig": "software.amazon.MyServiceHttpConfig",
7-
"serviceSpecificClientConfigClass": "ServiceConfiguration",
8-
"serviceConfigHasDualstackConfig": true,
7+
"serviceConfig": {
8+
"className": "ServiceConfiguration",
9+
"hasDualstackProperty": true,
10+
"hasFipsProperty": true
11+
},
912
"customRetryPolicy": "software.amazon.MyServiceRetryPolicy",
1013
"verifiedSimpleMethods" : ["paginatedOperationWithResultKey"],
1114
"blacklistedSimpleMethods" : [

‎core/auth/src/main/java/software/amazon/awssdk/auth/credentials/AwsCredentialsProviderChain.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,9 @@ public final class AwsCredentialsProviderChain implements AwsCredentialsProvider
5757
* @see #builder()
5858
*/
5959
private AwsCredentialsProviderChain(BuilderImpl builder) {
60+
Validate.notEmpty(builder.credentialsProviders, "No credential providers were specified.");
6061
this.reuseLastProviderEnabled = builder.reuseLastProviderEnabled;
61-
this.credentialsProviders = Collections.unmodifiableList(
62-
Validate.notEmpty(builder.credentialsProviders, "No credential providers were specified."));
62+
this.credentialsProviders = Collections.unmodifiableList(builder.credentialsProviders);
6363
}
6464

6565
/**

‎core/aws-core/src/main/java/software/amazon/awssdk/awscore/AwsExecutionAttribute.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,18 @@ public final class AwsExecutionAttribute extends SdkExecutionAttribute {
3939
*/
4040
public static final ExecutionAttribute<String> ENDPOINT_PREFIX = new ExecutionAttribute<>("AwsEndpointPrefix");
4141

42+
/**
43+
* Whether dualstack endpoints were enabled for this request.
44+
*/
4245
public static final ExecutionAttribute<Boolean> DUALSTACK_ENDPOINT_ENABLED =
4346
new ExecutionAttribute<>("DualstackEndpointsEnabled");
4447

48+
/**
49+
* Whether fips endpoints were enabled for this request.
50+
*/
51+
public static final ExecutionAttribute<Boolean> FIPS_ENDPOINT_ENABLED =
52+
new ExecutionAttribute<>("DualstackEndpointsEnabled");
53+
4554
private AwsExecutionAttribute() {
4655
}
4756
}

‎core/aws-core/src/main/java/software/amazon/awssdk/awscore/client/builder/AwsClientBuilder.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,4 +81,20 @@ public interface AwsClientBuilder<BuilderT extends AwsClientBuilder<BuilderT, Cl
8181
* <p>If the setting is not found in any of the locations above, 'false' will be used.
8282
*/
8383
BuilderT dualstackEnabled(Boolean dualstackEndpointEnabled);
84+
85+
/**
86+
* Configure whether the SDK should use the AWS fips endpoints.
87+
*
88+
* <p>If this is not specified, the SDK will attempt to determine whether the fips endpoint should be used
89+
* automatically using the following logic:
90+
* <ol>
91+
* <li>Check the 'aws.useFipsEndpoint' system property for 'true' or 'false'.</li>
92+
* <li>Check the 'AWS_USE_FIPS_ENDPOINT' environment variable for 'true' or 'false'.</li>
93+
* <li>Check the {user.home}/.aws/credentials and {user.home}/.aws/config files for the 'use_fips_endpoint'
94+
* property set to 'true' or 'false'.</li>
95+
* </ol>
96+
*
97+
* <p>If the setting is not found in any of the locations above, 'false' will be used.
98+
*/
99+
BuilderT fipsEnabled(Boolean fipsEndpointEnabled);
84100
}

0 commit comments

Comments
 (0)