EC2 Presigned URLs

[awslabs]

EC2 Presigned URLs

[kggilmer]

I happen to be looking at this for another estimation so thought I'd add some details.

• This is referenced in the Go SDK here: https://github.com/aws/aws-sdk-go-v2/blob/main/codegen/smithy-aws-go-codegen/src/main/java/software/amazon/smithy/aws/go/codegen/customization/PresignURLAutoFill.java#L81
• The logic for how this should be implemented is in this SEP (however it doesn't reference EC2 in particular, given the Go SDK's implementation it should be similar or identical.)

[kggilmer]

Relates to https://github.com/awslabs/smithy-kotlin/issues/153

[ianbotsf]

Another sample implementation from Java v2 SDK. Seems like intercept the HTTP request and use input shape fields to modify the DestinationRegion and PresignedUrl fields.

Estimate: 2 weeks (less if another presigning task has been completed and can be leveraged for reuse)

[kggilmer]

When you copy an encrypted source snapshot using the Amazon EC2 Query API, you must supply a pre-signed URL. This parameter is optional for unencrypted snapshots. Query requests. The PresignedUrl should use the snapshot source endpoint, the
CopySnapshot action, and include the SourceRegion, SourceSnapshotId, and DestinationRegion parameters. The PresignedUrl must be signed using AWS Signature Version 4. Because EBS snapshots are stored in Amazon S3, the signing algorithm for this parameter uses the same logic that is described in <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html\">Authenticating Requests: Using Query Parameters (AWS Signature Version 4) in the Amazon Simple Storage Service API Reference. An invalid or improperly signed PresignedUrl will cause the copy operation to fail asynchronously, and the snapshot will move to an error state.

[kggilmer]

For some unknown reason I'm able to call CopyDBSnapshot with an encrypted snapshot id and without a presigned URL and it still works. As such, it's unclear to me if this presigned url is actually needed here. Looking for clarification from the EC2 team.

[kggilmer]

Operations involving presigned URLs:

• CopySnapshot (populate a modeled presigned URL request param)

[kggilmer]

Because my experience does not track to the service documentation (able to perform an encrypted db snapshot copy without specifying a presgigned url) I cannot test that this client works as expected. Looking around for ec2 help to figure out what the presigned url is required for.

[kggilmer]

No luck in slack, filed an issue against EC2 EBS CTI SIM: P51373376

[kggilmer]

With Scott's help I got in contact w/ a doc team person on the EC2 team that has some knowedge of the operation. In parallel I brought up this issue with Matt Muller (he worked on the RDS SEP for presigners which is similiar in spirit to this customization in EC2) and at this point it's looking like the presignUrl parameter is no longer required. There is currently a modeled parameter sourceRegion which according to Matt did not exist at the time that their presigner customization was implemented. It seems that the operation has been updated such that the presigner url is no longer needed for cross-region encrypted snapshot copies. We're waiting on confirmation from the EC2 team.

[kggilmer]

The open question is bouncing around the EC2 org. Awaiting confirmation.

[kggilmer]

closing due to deprecated support in service. Will re-open if EC2 team comes back with specific scenarios in which this field is used.