Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SigV4 support #9

Merged
merged 10 commits into from
Nov 18, 2024
Merged

Add SigV4 support #9

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
6dbc10d
Add option to enable SigV4
trevorbonas Nov 13, 2024
e6700ac
Update DEVELOPER_README with EnableSigV4Auth parameter
trevorbonas Nov 15, 2024
1a70828
Fix duplicate tls-key argument
trevorbonas Nov 15, 2024
18c3f50
Fix whitespace inconsistencies
trevorbonas Nov 15, 2024
2dfea56
Remove LanguageExtensions
trevorbonas Nov 15, 2024
ef8f9f5
Undo semantic version change
trevorbonas Nov 15, 2024
1f9cc9c
Update one-click deployment regions
trevorbonas Nov 15, 2024
8ab8fc7
Document new default value for EnableSigV4Auth
trevorbonas Nov 15, 2024
15278e9
Make enableSigV4Auth value true
trevorbonas Nov 15, 2024
d69a7ae
Make enableSigV4Auth true in unit tests
trevorbonas Nov 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions configuration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ var (
maxRetriesConfig = &configuration{flag: "max-retries", envFlag: "max_retries", defaultValue: strconv.Itoa(awsClient.DefaultRetryerMaxNumRetries)}
defaultDatabaseConfig = &configuration{flag: "default-database", envFlag: "default_database", defaultValue: ""}
defaultTableConfig = &configuration{flag: "default-table", envFlag: "default_table", defaultValue: ""}
enableSigV4AuthConfig = &configuration{flag: "enable-sigv4-auth", envFlag: "enable_sigv4_auth", defaultValue: "false"}
listenAddrConfig = &configuration{flag: "web.listen-address", envFlag: "", defaultValue: ":9201"}
telemetryPathConfig = &configuration{flag: "web.telemetry-path", envFlag: "", defaultValue: "/metrics"}
failOnLabelConfig = &configuration{flag: "fail-on-long-label", envFlag: "fail_on_long_label", defaultValue: "false"}
Expand Down
36 changes: 29 additions & 7 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ import (
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/awserr"
"github.com/aws/aws-sdk-go/aws/credentials"
"github.com/aws/aws-sdk-go/aws/session"
"github.com/go-kit/log"
"github.com/gogo/protobuf/proto"
"github.com/golang/snappy"
Expand Down Expand Up @@ -83,6 +84,7 @@ type connectionConfig struct {
defaultDatabase string
defaultTable string
enableLogging bool
enableSigV4Auth bool
failOnLongMetricLabelName bool
failOnInvalidSample bool
listenAddr string
Expand Down Expand Up @@ -145,10 +147,21 @@ func lambdaHandler(req events.APIGatewayProxyRequest) (events.APIGatewayProxyRes

logger := cfg.createLogger()

awsCredentials, ok := parseBasicAuth(req.Headers[basicAuthHeader])
if !ok {
return createErrorResponse(errors.NewParseBasicAuthHeaderError().(*errors.ParseBasicAuthHeaderError).Message())
}
var awsCredentials *credentials.Credentials
var ok bool

// If SigV4 authentication has been enabled, such as when write requests originate
// from the OpenTelemetry collector, credentials will be taken from the local environment.
// Otherwise, basic auth is used for AWS credentials
if cfg.enableSigV4Auth {
sess := session.Must(session.NewSession())
awsCredentials = sess.Config.Credentials
} else {
awsCredentials, ok = parseBasicAuth(req.Headers[basicAuthHeader])
if !ok {
return createErrorResponse(errors.NewParseBasicAuthHeaderError().(*errors.ParseBasicAuthHeaderError).Message())
}
}

awsConfigs := cfg.buildAWSConfig()
timestreamClient := timestream.NewBaseClient(cfg.defaultDatabase, cfg.defaultTable)
Expand Down Expand Up @@ -280,7 +293,7 @@ func (cfg *connectionConfig) createLogger() (logger log.Logger) {
}

// parseBoolFromStrings parses the boolean configuration options from the strings in connectionConfig.
func (cfg *connectionConfig) parseBoolFromStrings(enableLogging, failOnLongMetricLabelName, failOnInvalidSample string) error {
func (cfg *connectionConfig) parseBoolFromStrings(enableLogging, failOnLongMetricLabelName, failOnInvalidSample, enableSigV4Auth string) error {
var err error

cfg.enableLogging, err = strconv.ParseBool(enableLogging)
Expand All @@ -304,6 +317,13 @@ func (cfg *connectionConfig) parseBoolFromStrings(enableLogging, failOnLongMetri
return timestreamError
}

cfg.enableSigV4Auth, err = strconv.ParseBool(enableSigV4Auth)
if err != nil {
timestreamError := errors.NewParseSampleOptionError(failOnInvalidSample)
fmt.Println(timestreamError.Error())
return timestreamError
}

return nil
}

Expand All @@ -328,7 +348,7 @@ func parseEnvironmentVariables() (*connectionConfig, error) {
cfg.defaultTable = getOrDefault(defaultTableConfig)

var err error
err = cfg.parseBoolFromStrings(getOrDefault(enableLogConfig), getOrDefault(failOnLabelConfig), getOrDefault(failOnInvalidSampleConfig))
err = cfg.parseBoolFromStrings(getOrDefault(enableLogConfig), getOrDefault(failOnLabelConfig), getOrDefault(failOnInvalidSampleConfig), getOrDefault(enableSigV4AuthConfig))
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -357,6 +377,7 @@ func parseFlags() *connectionConfig {
}

var enableLogging string
var enableSigV4Auth string
var failOnLongMetricLabelName string
var failOnInvalidSample string

Expand All @@ -373,6 +394,7 @@ func parseFlags() *connectionConfig {
Default(failOnInvalidSampleConfig.defaultValue).StringVar(&failOnInvalidSample)
a.Flag(certificateConfig.flag, "TLS server certificate file.").Default(certificateConfig.defaultValue).StringVar(&cfg.certificate)
a.Flag(keyConfig.flag, "TLS server private key file.").Default(keyConfig.defaultValue).StringVar(&cfg.key)
a.Flag(enableSigV4AuthConfig.flag, "Whether to enable SigV4 authentication with the API Gateway. Default to 'false'.").Default(enableSigV4AuthConfig.defaultValue).StringVar(&enableSigV4Auth)

flag.AddFlags(a, &cfg.promlogConfig)

Expand All @@ -381,7 +403,7 @@ func parseFlags() *connectionConfig {
os.Exit(1)
}

if err := cfg.parseBoolFromStrings(enableLogging, failOnLongMetricLabelName, failOnInvalidSample); err != nil {
if err := cfg.parseBoolFromStrings(enableLogging, failOnLongMetricLabelName, failOnInvalidSample, enableSigV4Auth); err != nil {
os.Exit(1)
}

Expand Down
19 changes: 10 additions & 9 deletions serverless/DEVELOPER_README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,15 +61,15 @@ The `DefaultDatabase`, `DefaultTable` and `LogLevel` may be altered to fit your

To install the Timestream Prometheus Connector service launch the AWS CloudFormation stack on the AWS CloudFormation console by choosing one of the "Launch Stack" buttons in the following table:

| Region | View | View in Composer | Launch |
|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| US East (N. Virginia) us-east-1 | [View](https://timestreamassets-us-east-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=us-east-1&templateURL=https://timestreamassets-us-east-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-east-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) |
| US East (Ohio) us-east-2 | [View](https://timestreamassets-us-east-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=us-east-2&templateURL=https://timestreamassets-us-east-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=us-east-2#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-east-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) |
| US West (Oregon) us-west-2 | [View](https://timestreamassets-us-west-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=us-west-2&templateURL=https://timestreamassets-us-west-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=us-west-2#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-west-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) |
| Asia Pacific (Sydney) ap-southeast-2 | [View](https://timestreamassets-ap-southeast-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=ap-southeast-2&templateURL=https://timestreamassets-ap-southeast-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=ap-southeast-2#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-ap-southeast-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) |
| Asia Pacific (Tokyo) ap-northeast-1 | [View](https://timestreamassets-ap-northeast-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=ap-northeast-1&templateURL=https://timestreamassets-ap-northeast-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=ap-northeast-1#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-ap-northeast-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) |
| Europe (Frankfurt) eu-central-1 | [View](https://timestreamassets-eu-central-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=eu-central-1&templateURL=https://timestreamassets-eu-central-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=eu-central-1#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-eu-central-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) |
| Europe (Ireland) eu-west-1 | [View](https://timestreamassets-eu-west-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=eu-west-1&templateURL=https://timestreamassets-eu-west-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=eu-west-1#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-eu-west-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) |
| Region | View | View in Composer | Launch | Launch (SigV4) |
|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| US East (N. Virginia) us-east-1 | [View](https://timestreamassets-us-east-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=us-east-1&templateURL=https://timestreamassets-us-east-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-east-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch (SigV4)](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-east-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml&param_EnableSigV4Auth=true) |
| US East (Ohio) us-east-2 | [View](https://timestreamassets-us-east-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=us-east-2&templateURL=https://timestreamassets-us-east-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=us-east-2#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-east-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch (SigV4)](https://console.aws.amazon.com/cloudformation/home?region=us-east-2#/stacks/create/review?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-east-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml&param_EnableSigV4Auth=true) |
| US West (Oregon) us-west-2 | [View](https://timestreamassets-us-west-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=us-west-2&templateURL=https://timestreamassets-us-west-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=us-west-2#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-west-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch (SigV4)](https://console.aws.amazon.com/cloudformation/home?region=us-west-2#/stacks/create/review?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-us-west-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml&param_EnableSigV4Auth=true) |
| Asia Pacific (Sydney) ap-southeast-2 | [View](https://timestreamassets-ap-southeast-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=ap-southeast-2&templateURL=https://timestreamassets-ap-southeast-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=ap-southeast-2#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-ap-southeast-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch (SigV4)](https://console.aws.amazon.com/cloudformation/home?region=ap-southeast-2#/stacks/create/review?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-ap-southeast-2.s3.amazonaws.com/timestream-prometheus-connector/template.yml&param_EnableSigV4Auth=true) |
| Asia Pacific (Tokyo) ap-northeast-1 | [View](https://timestreamassets-ap-northeast-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=ap-northeast-1&templateURL=https://timestreamassets-ap-northeast-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=ap-northeast-1#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-ap-northeast-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch (SigV4)](https://console.aws.amazon.com/cloudformation/home?region=ap-northeast-1#/stacks/create/review?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-ap-northeast-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml&param_EnableSigV4Auth=true) |
| Europe (Frankfurt) eu-central-1 | [View](https://timestreamassets-eu-central-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=eu-central-1&templateURL=https://timestreamassets-eu-central-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=eu-central-1#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-eu-central-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch (SigV4)](https://console.aws.amazon.com/cloudformation/home?region=eu-central-1#/stacks/create/review?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-eu-central-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml&param_EnableSigV4Auth=true) |
| Europe (Ireland) eu-west-1 | [View](https://timestreamassets-eu-west-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [View in Composer](https://console.aws.amazon.com/composer/canvas?region=eu-west-1&templateURL=https://timestreamassets-eu-west-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch](https://console.aws.amazon.com/cloudformation/home?region=eu-west-1#/stacks/new?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-eu-west-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml) | [Launch (SigV4)](https://console.aws.amazon.com/cloudformation/home?region=eu-west-1#/stacks/create/review?stackName=PrometheusTimestreamConnector&templateURL=https://timestreamassets-eu-west-1.s3.amazonaws.com/timestream-prometheus-connector/template.yml&param_EnableSigV4Auth=true) |

> **Note**: Attempting to use one of the above "Launch" links to create an already existing stack will fail. To update an existing stack, such as the default `PrometheusTimestreamConnector` stack, via the AWS Console, go to the stacks page at `https://<region>.console.aws.amazon.com/cloudformation/home`, select the stack you want to update from the list, then click "Update" to proceed through the update process.

Expand Down Expand Up @@ -216,6 +216,7 @@ Follow the verification steps in [README.md#verification](../README.md#verificat
| LambdaTimeoutInSeconds | The amount of time in seconds to run the connector on AWS Lambda before timing out. | 30 |
| ReadThrottlingBurstLimit | The number of burst read requests per second that API Gateway permits. | 1200 |
| WriteThrottlingBurstLimit | The number of burst write requests per second that API Gateway permits. | 1200 |
| EnableSigV4Auth | Whether to enable SigV4 authentication for the API Gateway. | false |

### IAM Permissions Configuration Options

Expand Down
Loading