Prefer signature version from service models over endpoints.json (aws#9492)

Author: ashovlin

awscli/botocore/client.py

@@ -62,18 +62,6 @@
     get_service_module_name,
 )
 
-_LEGACY_SIGNATURE_VERSIONS = frozenset(
-    (
-        'v2',
-        'v3',
-        'v3https',
-        'v4',
-        's3',
-        's3v4',
-    )
-)
-
-
 logger = logging.getLogger(__name__)
 history_recorder = get_global_history_recorder()
 
@@ -174,6 +162,7 @@ def create_client(
         self._register_s3_events(service_client, client_config, scoped_config)
         self._register_s3express_events(client=service_client)
         self._register_s3_control_events(service_client)
+        self._register_importexport_events(client=service_client)
         self._register_endpoint_discovery(
             service_client, endpoint_url, client_config
         )
@@ -332,6 +321,42 @@ def _register_s3_control_events(self, client):
             return
         S3ControlArnParamHandlerv2().register(client.meta.events)
 
+    def _register_importexport_events(
+        self,
+        client,
+        endpoint_bridge=None,
+        endpoint_url=None,
+        client_config=None,
+        scoped_config=None,
+    ):
+        if client.meta.service_model.service_name != 'importexport':
+            return
+        self._set_importexport_signature_version(
+            client.meta, client_config, scoped_config
+        )
+
+    def _set_importexport_signature_version(
+        self, client_meta, client_config, scoped_config
+    ):
+        # This will return the manually configured signature version, or None
+        # if none was manually set. If a customer manually sets the signature
+        # version, we always want to use what they set.
+        configured_signature_version = _get_configured_signature_version(
+            'importexport', client_config, scoped_config
+        )
+        if configured_signature_version is not None:
+            return
+
+        # importexport has a modeled signatureVersion of v2, but we
+        # previously switched to v4 via endpoint.json before endpoint rulesets.
+        # Override the model's signatureVersion for backwards compatability.
+        client_meta.events.register(
+            'choose-signer.importexport', self._default_signer_to_sigv4
+        )
+
+    def _default_signer_to_sigv4(self, signature_version, **kwargs):
+        return 'v4'
+
     def _get_client_args(
         self,
         service_model,
@@ -669,27 +694,28 @@ def _resolve_signature_version(self, service_name, resolved):
         if configured_version is not None:
             return configured_version
 
-        potential_versions = resolved.get('signatureVersions', [])
-        if (
-            self.service_signature_version is not None
-            and self.service_signature_version
-            not in _LEGACY_SIGNATURE_VERSIONS
-        ):
-            # Prefer the service model as most specific
-            # source of truth for new signature versions.
-            potential_versions = [self.service_signature_version]
+        # These have since added the "auth" key to the service model
+        # with "aws.auth#sigv4", but preserve existing behavior from
+        # when we preferred endpoints.json over the service models
+        if service_name in ('s3', 's3-control'):
+            return 's3v4'
 
-        # Pick a signature version from the endpoint metadata if present.
-        if 'signatureVersions' in resolved:
-            if service_name == 's3':
-                return 's3v4'
+        if self.service_signature_version is not None:
+            # Prefer the service model
+            potential_versions = [self.service_signature_version]
+        else:
+            # Fall back to endpoints.json to preserve existing behavior, which
+            # may be useful for users who have custom service models
+            potential_versions = resolved.get('signatureVersions', [])
+            # This was added for the V2 -> V4 transition,
+            # for services that added V4 after V2 in endpoints.json
             if 'v4' in potential_versions:
                 return 'v4'
-            # Now just iterate over the signature versions in order until we
-            # find the first one that is known to Botocore.
-            for known in potential_versions:
-                if known in AUTH_TYPE_MAPS:
-                    return known
+        # Now just iterate over the signature versions in order until we
+        # find the first one that is known to Botocore.
+        for known in potential_versions:
+            if known in AUTH_TYPE_MAPS:
+                return known
         raise UnknownSignatureVersionError(
             signature_version=potential_versions
         )

tests/functional/botocore/test_endpoint_rulesets.py

@@ -54,7 +54,7 @@ def get_endpoint_tests_for_service(service_name):
     if not file_path.is_file():
         raise FileNotFoundError(
             f'Cannot find endpoint tests file for "{service_name}" at '
-            'path {file_path}'
+            f'path {file_path}'
         )
     with file_path.open('r') as f:
         return json.load(f)

tests/functional/botocore/test_importexport.py

@@ -39,13 +39,13 @@ def test_importexport_signature_version(self):
             b"</CancelJobOutput>"
         )
 
-        # Confirm we've ignored the model signatureVersion and chosen v4
-        assert client.meta.config.signature_version == "v4"
+        # Note that client.meta.config.signature_version still returns "v2"
+        # since the "choose-signer" hook doesn't run until later
         with stubber:
             stubber.add_response(body=importexport_response)
             client.cancel_job(JobId="12345")
 
-        # Validate we actually signed with sigv4
+        # So validate we actually signed with sigv4
         auth_header = stubber.requests[0].headers.get('Authorization', '')
         assert auth_header.startswith(b"AWS4-HMAC-SHA256")
         assert b"aws4_request" in auth_header

tests/unit/botocore/test_client.py

@@ -2108,6 +2108,18 @@ def test_raises_when_signature_version_is_not_found(self):
         with self.assertRaises(UnknownSignatureVersionError):
             bridge.resolve('test', 'us-west-2')
 
+    def test_prefers_signature_version_from_service_model(self):
+        resolver = mock.Mock()
+        resolver.construct_endpoint.return_value = {
+            'partition': 'aws',
+            'hostname': 'test',
+            'endpointName': 'us-west-2',
+            'signatureVersions': ['v2'],
+        }
+        bridge = ClientEndpointBridge(resolver, service_signature_version='v4')
+        resolved = bridge.resolve('test', 'us-west-2')
+        self.assertEqual('v4', resolved['signature_version'])
+
     def test_uses_service_name_as_signing_name(self):
         resolver = mock.Mock()
         resolver.construct_endpoint.return_value = {