Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] When using AWSV4SignerAuth with AsyncOpenSearch, providing "id" to index or delete breaks the signature #683

Open
gwenwahl opened this issue Mar 1, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@gwenwahl
Copy link

gwenwahl commented Mar 1, 2024

What is the bug?

When using the AsyncOpenSearch client, if you provide the "id" parameter to the index or delete methods, you get a 403 request signature error.

How can one reproduce the bug?

When connected to opensearch with AWSV4SignerAuth thusly:

host = '' # cluster endpoint, for example: my-test-domain.us-east-1.es.amazonaws.com
region = 'us-west-2'
service = 'es' # 'aoss' for OpenSearch Serverless
credentials = boto3.Session().get_credentials()
auth = AWSV4SignerAsyncAuth(credentials, region, service)

client = AsyncOpenSearch(
    hosts = [{'host': host, 'port': 443}],
    http_auth = auth,
    use_ssl = True,
    verify_certs = True,
    connection_class = AsyncHttpConnection
)
await client.index(
  index='index_name',
  body={...},
  id='foobar'
)

Will fail with something like:

AuthorizationException(403, '{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

This was primarily noticed by using the AsyncDocument "save" and "delete" functions.

What is the expected behavior?

A successful response

What is your host/environment?

opensearch-py==2.4.2

Do you have any screenshots?

If applicable, add screenshots to help explain your problem.

Do you have any additional context?

Add any other context about the problem.

@gwenwahl gwenwahl added bug Something isn't working untriaged Need triage labels Mar 1, 2024
@dblock
Copy link
Member

dblock commented Mar 1, 2024

Try turning it into a failing test? This is generally a symptom that the payload signed doesn't match the payload sent.

@dblock dblock removed the untriaged Need triage label Mar 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants