Conversation
CloudFront URLSigner uses *rsa.PrivateKey to sign the URL. If we update the function to receive the crypto.Signer interface (already implemented by rsa.PrivateKey) then we can use other keys to sign. For example hardware keys.
lucix-aws
approved these changes
Apr 11, 2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a proposal to update CloudFront's URLSigner to use the
crypto.Signerinterface.URLSigner takes a
*rsa.PrivateKeyas an input to sign the pre-signed URL. If we update the function to receive thecrypto.Signerinterface (already implemented byrsa.PrivateKey) it allows us to use other keys to sign cloudfront URLs. For example hardware keys. This change is also more Go idiomatic.Here is a working example of generating a pre-signed URL with a PIV key stored in a Yubikey:
It shouldn't break compatibility with previous usage since
*rsa.PrivateKeyalready implementscrypto.SignerFor changes to files under the
/codegen/aws-modelsfolder, and manual edits to autogenerated code (e.g./service/s3/api.go) please create an Issue instead of a PR for those type of changes.If the PR addresses an existing bug or feature, please reference it here.
To help speed up the process and reduce the time to merge please ensure that
Allow edits by maintainersis checked before submitting your PR. This will allow the project maintainers to make minor adjustments or improvements to the submitted PR, allow us to reduce the roundtrip time for merging your request.