You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@libcloud.apache.org by GitBox <gi...@apache.org> on 2021/01/22 10:21:34 UTC
[GitHub] [libcloud] olegrtecno opened a new issue #1545: Can't access EC2 zones requiring signature version 4
olegrtecno opened a new issue #1545:
URL: https://github.com/apache/libcloud/issues/1545
## Summary
The latest version (3.3.0) always uses a default signature version 2 for API authentication. Accessing some EC2 regions (e.g. us-east-2) requires a signature version 4.
## Detailed Information
libcloud 3.3.0
python 3.6.8
centos 7.7
The list_nodes() operation fails for 'us-east-2' with an error message
libcloud.common.types.InvalidCredsError: 'AuthFailure: AWS was not able to validate the provided access credentials'
Probably introduced by https://github.com/apache/libcloud/commit/fe725bda928dc5ea4e51d30b8deb60dd9d3c6b73
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [libcloud] Kami commented on issue #1545: Can't access EC2 zones requiring signature version 4
Posted by GitBox <gi...@apache.org>.
Kami commented on issue #1545:
URL: https://github.com/apache/libcloud/issues/1545#issuecomment-765902462
Resolved via #1546. Thanks again for reporting this issue.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [libcloud] Kami commented on issue #1545: Can't access EC2 zones requiring signature version 4
Posted by GitBox <gi...@apache.org>.
Kami commented on issue #1545:
URL: https://github.com/apache/libcloud/issues/1545#issuecomment-767149651
v3.3.1 with bug fix for this issue is now out. Thanks again for reporting it.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [libcloud] Kami commented on issue #1545: Can't access EC2 zones requiring signature version 4
Posted by GitBox <gi...@apache.org>.
Kami commented on issue #1545:
URL: https://github.com/apache/libcloud/issues/1545#issuecomment-765315563
Thanks for reporting this.
Quickly glancing at this code, I don't see how it could affect it, but I need to dig in.
Looking at the code it seems like we default to signature version 2. Did we ever default to version 4?
* https://github.com/apache/libcloud/blob/trunk/libcloud/compute/drivers/ec2.py#L1618
* https://github.com/apache/libcloud/blob/trunk/libcloud/common/aws.py#L54
It seems like we only force version 4 if token auth is used - https://github.com/apache/libcloud/blob/trunk/libcloud/compute/drivers/ec2.py#L4696.
I wonder if this could actually be related to AWS finally deprecating signature v2 for some of those regions (https://aws.amazon.com/blogs/aws/amazon-s3-update-sigv2-deprecation-period-extended-modified/)?
If that's the case, it may make sense to default to v4 for everything, but we need to make sure it don't break anything.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [libcloud] Kami closed issue #1545: Can't access EC2 zones requiring signature version 4
Posted by GitBox <gi...@apache.org>.
Kami closed issue #1545:
URL: https://github.com/apache/libcloud/issues/1545
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [libcloud] olegrtecno commented on issue #1545: Can't access EC2 zones requiring signature version 4
Posted by GitBox <gi...@apache.org>.
olegrtecno commented on issue #1545:
URL: https://github.com/apache/libcloud/issues/1545#issuecomment-765346849
Thanks for looking at this.
The code defaults to version 2, which is OK. However, the override for regions, that require version 4, which was taken from the regions settings doesn't work anymore, after the settings are taken from the partial config, where the signature version is missing: https://github.com/apache/libcloud/blob/trunk/libcloud/compute/drivers/ec2.py#L5799
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [libcloud] Kami commented on issue #1545: Can't access EC2 zones requiring signature version 4
Posted by GitBox <gi...@apache.org>.
Kami commented on issue #1545:
URL: https://github.com/apache/libcloud/issues/1545#issuecomment-767149651
v3.3.1 with bug fix for this issue is now out. Thanks again for reporting it.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [libcloud] Kami commented on issue #1545: Can't access EC2 zones requiring signature version 4
Posted by GitBox <gi...@apache.org>.
Kami commented on issue #1545:
URL: https://github.com/apache/libcloud/issues/1545#issuecomment-765501507
@olegrtecno I was able to reproduce the issue - it's indeed a regression.
I will open a PR with a bug fix shortly. As part of that change, I will also make it possibly to specify ``signature_version`` via driver constructor argument and override default value from region constants file.
As a temporary workaround, you could do something like this:
```python
import libcloud.common.aws
libcloud.common.aws.DEFAULT_SIGNATURE_VERSION = "4"
```
This should work as long as you are only using drivers which support signature version 4.
Another option would be to subclass the NodeDriver and implement custom ``_ex_connection_class_kwargs`` method which returns dict with "signature_version": "4" item.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org