opensearch-project / opensearch-py

Python Client for OpenSearch
https://opensearch.org/docs/latest/clients/python/
Apache License 2.0
328 stars 167 forks source link

[BUG] When using AWSV4SignerAuth with AsyncOpenSearch, providing "id" to `index` or `delete` breaks the signature #683

Open gwenwahl opened 6 months ago

gwenwahl commented 6 months ago

What is the bug?

When using the AsyncOpenSearch client, if you provide the "id" parameter to the index or delete methods, you get a 403 request signature error.

How can one reproduce the bug?

When connected to opensearch with AWSV4SignerAuth thusly:

host = '' # cluster endpoint, for example: my-test-domain.us-east-1.es.amazonaws.com
region = 'us-west-2'
service = 'es' # 'aoss' for OpenSearch Serverless
credentials = boto3.Session().get_credentials()
auth = AWSV4SignerAsyncAuth(credentials, region, service)

client = AsyncOpenSearch(
    hosts = [{'host': host, 'port': 443}],
    http_auth = auth,
    use_ssl = True,
    verify_certs = True,
    connection_class = AsyncHttpConnection
)
await client.index(
  index='index_name',
  body={...},
  id='foobar'
)

Will fail with something like:

AuthorizationException(403, '{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

This was primarily noticed by using the AsyncDocument "save" and "delete" functions.

What is the expected behavior?

A successful response

What is your host/environment?

opensearch-py==2.4.2

Do you have any screenshots?

If applicable, add screenshots to help explain your problem.

Do you have any additional context?

Add any other context about the problem.

dblock commented 6 months ago

Try turning it into a failing test? This is generally a symptom that the payload signed doesn't match the payload sent.