[jira] [Resolved] (CAMEL-24157) camel-aws2 - Umbrella: medium-severity findings from July 2026 review (S3, SQS, SNS, Kinesis, DDB)

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24157?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen resolved CAMEL-24157.
---------------------------------
    Resolution: Fixed

Fixed via https://github.com/apache/camel/pull/24864

> camel-aws2 - Umbrella: medium-severity findings from July 2026 review (S3, SQS, SNS, Kinesis, DDB)
> --------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24157
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24157
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-aws
>            Reporter: Federico Mariani
>            Assignee: Claus Ibsen
>            Priority: Minor
>              Labels: review-2026-07
>             Fix For: 4.22.0
>
>         Attachments: camel-aws-review-2026-07.md
>
>
> Umbrella for the medium-severity findings of the July 2026 review of the camel-aws2 flagship components on main (4.22.0-SNAPSHOT). Full findings document attached to this issue and to the high-severity umbrella; low-severity findings are listed in the document only.
> *camel-aws2-s3*
> # {{AWS2S3Consumer:148-166}} — truncated-list pagination fallback feeds an object key into the ListObjectsV2 {{continuationToken}} (V1 leftover from CAMEL-22291 after the CAMEL-23132 migration); breaks against S3-compatible stores that omit nextContinuationToken. Should use {{startAfter}}.
> # {{AWS2S3Producer:632-680}} / {{AWS2S3Consumer:128}} — SSE-C customer key not applied on producer getObject/getObjectRange nor the consumer fileName path; SSE-C objects unreadable (400).
> # {{AWS2S3Consumer:366-390}} — {{removePrefixOnMove}} treats the prefix as a regex (PatternSyntaxException/NPE) and the failure also skips deleteAfterRead -> endless reprocessing.
> # {{AWS2S3Producer:1086-1109}} — presigner (createDownloadLink/createUploadLink) ignores session/profile credentials and NPEs when region is unset.
> # {{AWS2S3Endpoint:66}} — {{maxConnections}} option documented but never applied to the S3 client.
> # {{AWS2S3StreamUploadProducer:133-184}} — uploadAggregate read/mutated outside the lock (NPE race with the timeout task); an exception in the scheduled task permanently cancels timeout flushes.
> *camel-aws2-sqs*
> # {{Sqs2Consumer:597,655-671}} — QueueDoesNotExistException silently swallowed when {{maxMessagesPerPoll > 10}} (error only propagated when every parallel request failed, but the missing-queue path flags at most one).
> # {{Sqs2Consumer:302-363,578-587}} — consumer stop/start cycle leaks the PollingTask thread pool and keeps the visibility-extender period task scheduled (cleanup only in doShutdown).
> # {{Sqs2Producer:119-174}} — sendBatchMessage does not chunk to the SQS 10-entry batch limit (11+ entries fail wholesale); empty iterables and non-String elements also unhandled.
> # {{Sqs2Producer:64-70}} — FIFO producer requires messageGroupIdStrategy even for purgeQueue/deleteQueue/listQueues operations (cf. CAMEL-18123).
> *camel-aws2-sns*
> # {{Sns2Endpoint:176}} — {{subscribeSNStoSQS}} queueArn validation is dead code: {{isNotEmpty(isNotEmpty(queueArn))}} is always true (present since CAMEL-14552); stale error message too.
> # {{Sns2Endpoint:140-145}} — {{serverSideEncryptionEnabled=true}} without kmsMasterKeyId silently creates the topic unencrypted.
> # {{Sns2ProducerHealthCheck:40-46}} — health check permanently DOWN when region is unset ({{Region.of(null)}} throws) and requires sns:ListSubscriptions that publish-only roles lack.
> *camel-aws2-kinesis*
> # {{Kinesis2Consumer:108-141}} — fixed-shardId consumer calls DescribeStream on every poll (10 TPS account limit; >100-shard streams fail to find the shard).
> # {{Kinesis2Producer:77-122}} — batch producer applies a single partition key to all records; whole batch pinned to one shard.
> *camel-aws2-ddb*
> # {{Ddb2JsonDataTypeTransformer:220-222}} — empty JSON arrays map to an empty StringSet, which DynamoDB rejects.
> # {{ScanCommand:37-42}} — Scan ignores the {{consistentRead}} option (Get/Query apply it).
> # {{Ddb2Endpoint:173-178}} — table-creation wait loop's RNFE retry guard can never match (SDK v2 messages never contain the exception class name); documented DescribeTable eventual-consistency tolerance is dead code.
> _This issue was researched and filed by Claude Code (AI) on behalf of Federico Mariani (fmariani). Full findings document from the review is attached to the umbrella issues._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)