awslabs/aws-sigv4-proxy

Add support for TLS

chadbean opened this issue · 10 comments

chadbean commented

I'm using this proxy in front of an API Gateway with IAM authorization which proxies to Nginx and finally to an EKS cluster. Kubectl only will send its bearer token (using the Authorization) header if the connection to the server is using TLS and I'd rather not add yet another proxy in front of this one to terminate TLS.

Would you be open to adding optional TLS support? I have it working locally and I was thinking about these flags:

+	enableTLS              = kingpin.Flag("enable-tls", "Enable TLS").Default("false").Bool()
+	tlsCertFile            = kingpin.Flag("tls-cert-file", "TLS certificate file path").String()
+	tlsKeyFile             = kingpin.Flag("tls-key-file", "TLS key file path").String()

If so, I'd be happy to create a PR to support this.

allamand commented

Sounds a nice feature to have you have it already working ?

chadbean commented

@allamand yeah, I can add a PR if there's interest.

allamand commented

That would be nice, I’ll love to see if that can fit my use case

chadbean commented

@allamand sorry for the delay. Please see #179.

allamand commented

@chadbean thanks. do you have sample configuring the tls ?

chadbean commented

@allamand it could be used like this, for example:

docker run --rm -ti \                                    
    -v ~/.aws:/root/.aws \
    -v /path/to/your/certs/server.crt:/etc/ssl/certs/server.crt \
    -v /path/to/your/certs/server.key:/etc/ssl/certs/server.key \
    -p 8080:8080 \
    -e 'AWS_SDK_LOAD_CONFIG=true' \
    -e 'AWS_PROFILE=<your profile name>' \
    public.ecr.aws/aws-observability/aws-sigv4-proxy:1.7 \
    --enable-tls \
    --tls-cert-file=/etc/ssl/certs/server.crt \
    --tls-key-file=/etc/ssl/certs/server.key \
    --name execute-api --region <aws region> \
    --host <redacted>.execute-api.<aws region>.amazonaws.com

Note the new --enable-tls, --tls-cert-file, and --tls-key-file args as well as mounting the volumes with the cert and key from your local host to the container. Of course the image (public.ecr.aws/aws-observability/aws-sigv4-proxy:1.7) above doesn't work as it needs a custom build from the branch in PR #179 as well.

The certs can be self-signed certs. I tested with a key/pair generated with openssl and signed with my own CA.

sebawo commented

@allamand any updates on this ?

allamand commented

Yes I didn’t managed to make it work in my use case, Ideally I would not want to terminate tos on the proxy so not sure why I need to pass some certificate here ?

chadbean commented

@allamand you can skip the TLS flags if you don't need TLS support. It was just added for my use-case because I was proxying EKS and kubectl won't send the Authorization header to the proxy if it's not a TLS connection.

allamand commented

ok thanks this is working