search

aws / aws-cli

Universal Command Line Interface for Amazon Web Services
Other
15.44k stars 4.1k forks source link

Provide the ability to set s3 signature version via an option for the s3 presign subcommand #4286

Open cebjyre opened 5 years ago

cebjyre commented 5 years ago

We are generating presigned s3 urls on EC2 instances using the auth details of the instance's IAM role, and providing the region as a parameter when calling aws s3 presign ..., so the only reason we even need aws config files for the user running the operation is to set the signature version. It would make things easier if we could simply provide an option to set the signature version rather than requiring this to be in the config file.

I realise that setting v4 as the default would be a breaking change, per https://github.com/aws/aws-cli/issues/2622#issuecomment-317130433, but hopefully providing the option wouldn't be too much of a problem (and possibly making v4 the default IF region was explicitly provided - just an idea, not a necessity)

$ aws --version
aws-cli/1.16.182 Python/2.7.5 Linux/3.10.0-957.21.3.el7.x86_64 botocore/1.12.172
justnance commented 5 years ago

@cebjyre - Thank you for raising this feature again. I understand there have been some changes to Sigv2 deprecation since we stated it would create a breaking change as per the https://github.com/aws/aws-cli/issues/2622#issuecomment-317130433. Recently the S3 Service team posted an update on their 's forums indicating "Any new buckets created after June 24, 2020 will not support SigV2 signed requests, although existing buckets will continue to support SigV2 while we work with customers to move off this older request signing method." As such, this feature would still create a break change.

acejam commented 5 years ago

@justnance The suggestion here appears to be simply adding an option (command line flag), not changing the default. Thus, it shouldn't lead to a breaking change. I agree with @cebjyre, having to create a config file so one can simply specify this one option is a bit of a pain at times - it would be much easier if it could be specified as a flag.

justnance commented 5 years ago

@cebjyre - Thank you for your feedback. I'm labeling this as a feature request pending further review and feedback.

GoodMirek commented 2 years ago

Almost three years later, I am again hitting this issue. Is there anything holding back this implementation?