Using s3 with FIPS compliant endpoints

[rezen]

With boto, you can use FIPS compliant endpoints as shown below. What isn't clear is how to achieve this same effect with the ruby sdk.

s3 = boto3.client(
    's3',
    endpoint_url="https://s3-fips.us-west-1.amazonaws.com",
    config=Config(s3={'addressing_style': 'virtual'})
)

Is this the correct way with ruby to achieve the same effect?

s3 = Aws::S3::Client.new({
   :endpoint => "https://s3-fips.us-west-1.amazonaws.com",
   :force_path_style => true,
})

[alextwoods]

You can set the use_fips_endpoint option when creating the client (see documentation at: https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/S3/Client.html#initialize-instance_method), eg:

s3 = Aws::S3::Client.new(use_fips_endpoint: true)

[rezen]

Well I feel real smart ... I guess it helps if I actually read all the docs. Thank you much @alextwoods!

[akostadinov]

client = Aws::S3::Client.new( region: ENV["AWS_REGION"], credentials: Aws::Credentials.new(ENV["AWS_ACCESS_KEY_ID"], ENV["AWS_SECRET_ACCESS_KEY"]), use_fips_endpoint: true, s3_us_east_1_regional_endpoint: "regional")

resp = client.put_object(bucket: ENV["AWS_BUCKET"], key: "test/test.txt", body: IO.read("/tmp/test.txt"))

This returns

OpenSSL::Digest::DigestError (Digest initialization failed: disabled for fips)
/opt/rh/rh-ruby26/root/usr/share/ruby/openssl/digest.rb:40:in `block (3 levels) in <class:Digest>'
/opt/rh/rh-ruby26/root/usr/share/ruby/digest.rb:35:in `new'
/opt/rh/rh-ruby26/root/usr/share/ruby/digest.rb:35:in `file'
/opt/system/vendor/bundle/ruby/2.6.0/gems/aws-sdk-s3-1.114.0/lib/aws-sdk-s3/plugins/md5s.rb:40:in `md5'
/opt/system/vendor/bundle/ruby/2.6.0/gems/aws-sdk-s3-1.114.0/lib/aws-sdk-s3/plugins/md5s.rb:28:in `call'
/opt/system/vendor/bundle/ruby/2.6.0/gems/aws-sdk-core-3.131.2/lib/aws-sdk-core/plugins/http_checksum.rb:19:in `call'
...

[mullermp]

FIPS deems MD5 checksums as insecure. You need to use a different checksum for that. #2645 (comment)

[akostadinov]

The issue is that using use_fips_endpoint doesn't automatically switch to another checksum. It is obvious that MD5 will not work. Why should one have to change all method calls to use something else. sha256 would be a good default, provided sha1 is also on its way out.

[mullermp]

Yes. use_fips_endpoint will use a FIPS endpoint and do nothing else. Not every service has an alternative to MD5 right now, and not all services that support FIPS endpoints require any kind of checksum. S3 wanted users to explicitly provide what checksums they want to use.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.