seporaitis / yum-s3-iam

Yum package manager plugin for private S3 repositories. Uses Amazon IAM & EC2 Roles.
Apache License 2.0
162 stars 99 forks source link

S3 will stop accepting requests signed using SigV2 in all regions on June 24, 2019 #80

Open Cinderhaze opened 5 years ago

Cinderhaze commented 5 years ago

We will need to make sure that all signing uses SigV4 prior to the June 24th, 2019 cutoff. There may still be a case add a SigV2 signing override/configuration (if people are using an s3 compatible service), but that may need to be a part of a larger rework of parse_url ( mentioned in https://github.com/seporaitis/yum-s3-iam/pull/75#issuecomment-489670035 )

https://forums.aws.amazon.com/ann.jspa?annID=5816

AWS Signature Version 4 (SigV4) is recommended for signing S3 API requests over AWS Signature Version 2 (SigV2) as it provides improved security by using a signing key rather than your secret access key. SigV4 is currently supported in all AWS regions while SigV2 is only supported in regions launched prior to Jan 2014. S3 will stop accepting requests signed using SigV2 in all regions on June 24, 2019, any requests signed using SigV2 made after this time will fail. The signature version is set in your software, please update your applications to use the latest versions of the tools and SDKs to take advantage of the improved security and avoid impact.