Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for AWSSigV4-based authentication for OpenSearch #488

Open
Szasza opened this issue Mar 14, 2024 · 0 comments
Open

Add support for AWSSigV4-based authentication for OpenSearch #488

Szasza opened this issue Mar 14, 2024 · 0 comments

Comments

@Szasza
Copy link
Contributor

Szasza commented Mar 14, 2024

AWS OpenSearch has two methods to authenticate with, details can be found at https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-master-user

parsedmarc can access AWS OpenSearch using master user credentials and the internal user database. This however comes with limitations which are outlined in the document linked above.

It would be great to have support for AWSSigV4 to enable a more robust authentication method. opensearch-py already supports it, in the following way:

import boto3
from opensearchpy import OpenSearch, RequestsHttpConnection
import os
from requests_aws4auth import AWS4Auth

region = os.environ['AWS_REGION']
service = 'es'
credentials = boto3.Session().get_credentials()
awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service, session_token=credentials.token)
host = 'some_host_here'

os_client = OpenSearch(
        hosts=[host],
        http_auth = awsauth,
        use_ssl = True,
        verify_certs = True,
        ssl_assert_hostname = False,
        ssl_show_warn = False,
        connection_class=RequestsHttpConnection,
)

parsedmarc currently doesn't support this authentication method. A way of implementation could be to add aws_region and authentication_type (basic or awssigv4) to the config ini file's [opensearch] section. Based on the authentication type the OpenSearch connector could create the OpenSearch connection accordingly.

Happy to work on the implementation if the approach is agreed upon, either as above, or in a better way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant