Skip to content

Commit e4fb225

Browse files
zoewanggzoewangg
authored
Update v4 request signer to log AWS4 canonical request if DEBUG level is enabled (#5153)
1 parent 29cc1aa commit e4fb225

File tree

5 files changed

+89
-13
lines changed

5 files changed

+89
-13
lines changed

‎.changes/next-release/bugfix-AWSSDKforJavav2-66877e6.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "bugfix",
3+
"category": "AWS SDK for Java v2",
4+
"contributor": "",
5+
"description": "Log `AWS4 Canonical Request` in signer if DEBUG level is enabled."
6+
}

‎core/http-auth-aws/pom.xml

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,26 @@
125125
<artifactId>reactive-streams-tck</artifactId>
126126
<scope>test</scope>
127127
</dependency>
128-
128+
<dependency>
129+
<groupId>software.amazon.awssdk</groupId>
130+
<artifactId>test-utils</artifactId>
131+
<scope>test</scope>
132+
</dependency>
133+
<dependency>
134+
<groupId>org.apache.logging.log4j</groupId>
135+
<artifactId>log4j-api</artifactId>
136+
<scope>test</scope>
137+
</dependency>
138+
<dependency>
139+
<groupId>org.apache.logging.log4j</groupId>
140+
<artifactId>log4j-core</artifactId>
141+
<scope>test</scope>
142+
</dependency>
143+
<dependency>
144+
<groupId>org.apache.logging.log4j</groupId>
145+
<artifactId>log4j-slf4j-impl</artifactId>
146+
<scope>test</scope>
147+
</dependency>
129148
</dependencies>
130149

131150
<build>

‎core/http-auth-aws/src/main/java/software/amazon/awssdk/http/auth/aws/internal/signer/DefaultV4RequestSigner.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,11 @@ public V4RequestSigningResult sign(SdkHttpRequest.Builder requestBuilder) {
5252
// Step 1: Create a canonical request
5353
V4CanonicalRequest canonicalRequest = createCanonicalRequest(requestBuilder.build(), contentHash);
5454

55+
String canonicalRequestString = canonicalRequest.getCanonicalRequestString();
56+
LOG.debug(() -> "AWS4 Canonical Request: " + canonicalRequestString);
57+
5558
// Step 2: Create a hash of the canonical request
56-
String canonicalRequestHash = hashCanonicalRequest(canonicalRequest.getCanonicalRequestString());
59+
String canonicalRequestHash = hashCanonicalRequest(canonicalRequestString);
5760

5861
// Step 2: Create a hash of the canonical request
5962
String stringToSign = createSignString(canonicalRequestHash);

‎core/http-auth-aws/src/test/java/software/amazon/awssdk/http/auth/aws/internal/signer/DefaultRequestSignerTest.java

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@
2020
import static org.junit.jupiter.api.Assertions.assertEquals;
2121
import static software.amazon.awssdk.utils.BinaryUtils.toHex;
2222

23+
import java.util.List;
24+
import org.apache.logging.log4j.Level;
25+
import org.apache.logging.log4j.core.LogEvent;
26+
import software.amazon.awssdk.testutils.LogCaptor;
27+
2328
import java.net.URI;
2429
import java.time.Clock;
2530
import java.time.Instant;
@@ -30,16 +35,14 @@
3035

3136
public class DefaultRequestSignerTest {
3237

33-
V4Properties v4Properties = V4Properties.builder()
38+
private V4Properties v4Properties = V4Properties.builder()
3439
.credentials(AwsCredentialsIdentity.create("foo", "bar"))
3540
.credentialScope(new CredentialScope("baz", "qux", Instant.EPOCH))
3641
.signingClock(Clock.fixed(Instant.EPOCH, UTC))
3742
.doubleUrlEncode(true)
3843
.normalizePath(true)
3944
.build();
4045

41-
DefaultV4RequestSigner requestSigner = new DefaultV4RequestSigner(v4Properties, "quux");
42-
4346
@Test
4447
public void requestSigner_sign_shouldReturnSignedResult_butNotAddAnyAuthInfoToRequest() {
4548
SdkHttpRequest.Builder request = SdkHttpRequest
@@ -55,13 +58,20 @@ public void requestSigner_sign_shouldReturnSignedResult_butNotAddAnyAuthInfoToRe
5558
+ "host\nquux";
5659
String expectedHost = "localhost";
5760

58-
V4RequestSigningResult requestSigningResult = requestSigner.sign(request);
59-
60-
assertEquals(expectedContentHash, requestSigningResult.getContentHash());
61-
assertEquals(expectedSigningKeyHex, toHex(requestSigningResult.getSigningKey()));
62-
assertEquals(expectedSignature, requestSigningResult.getSignature());
63-
assertEquals(expectedCanonicalRequestString, requestSigningResult.getCanonicalRequest().getCanonicalRequestString());
64-
assertEquals(expectedHost, requestSigningResult.getSignedRequest().firstMatchingHeader("Host").orElse(""));
65-
assertThat(requestSigningResult.getSignedRequest().build()).usingRecursiveComparison().isEqualTo(request.build());
61+
try (LogCaptor logCaptor = LogCaptor.create(Level.DEBUG)) {
62+
DefaultV4RequestSigner requestSigner = new DefaultV4RequestSigner(v4Properties, "quux");
63+
V4RequestSigningResult requestSigningResult = requestSigner.sign(request);
64+
assertEquals(expectedContentHash, requestSigningResult.getContentHash());
65+
assertEquals(expectedSigningKeyHex, toHex(requestSigningResult.getSigningKey()));
66+
assertEquals(expectedSignature, requestSigningResult.getSignature());
67+
assertEquals(expectedCanonicalRequestString, requestSigningResult.getCanonicalRequest().getCanonicalRequestString());
68+
assertEquals(expectedHost, requestSigningResult.getSignedRequest().firstMatchingHeader("Host").orElse(""));
69+
assertThat(requestSigningResult.getSignedRequest().build()).usingRecursiveComparison().isEqualTo(request.build());
70+
List<LogEvent> logEvents = logCaptor.loggedEvents();
71+
assertThat(logEvents).hasSize(3);
72+
assertThat(logEvents.get(0).getMessage().getFormattedMessage()).contains("AWS4 Canonical Request");
73+
assertThat(logEvents.get(1).getMessage().getFormattedMessage()).contains("AWS4 Canonical Request Hash");
74+
assertThat(logEvents.get(2).getMessage().getFormattedMessage()).contains("AWS4 String to sign");
75+
}
6676
}
6777
}

‎core/http-auth-aws/src/test/resources/log4j2.properties

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#
2+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License").
5+
# You may not use this file except in compliance with the License.
6+
# A copy of the License is located at
7+
#
8+
# http://aws.amazon.com/apache2.0
9+
#
10+
# or in the "license" file accompanying this file. This file is distributed
11+
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
# express or implied. See the License for the specific language governing
13+
# permissions and limitations under the License.
14+
#
15+
16+
status = warn
17+
18+
appender.console.type = Console
19+
appender.console.name = ConsoleAppender
20+
appender.console.layout.type = PatternLayout
21+
appender.console.layout.pattern = %d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n%throwable
22+
23+
rootLogger.level = error
24+
rootLogger.appenderRef.stdout.ref = ConsoleAppender
25+
26+
# Uncomment below to enable more specific logging
27+
#
28+
#logger.sdk.name = software.amazon.awssdk
29+
#logger.sdk.level = debug
30+
#
31+
#logger.request.name = software.amazon.awssdk.request
32+
#logger.request.level = debug
33+
#
34+
#logger.apache.name = org.apache.http.wire
35+
#logger.apache.level = debug
36+
#
37+
#logger.netty.name = io.netty.handler.logging
38+
#logger.netty.level = debug

0 commit comments

Comments
 (0)