From 3b9c856bb92075d920addae5241078a791de10f6 Mon Sep 17 00:00:00 2001 From: Dmitrii Creed Date: Mon, 18 May 2026 18:43:19 +0400 Subject: [PATCH] fix(deps): migrate aws-sdk-go v1 -> v2 to close GO-2022-0635/0646 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Migrates SC api's first-party AWS SDK usage from aws-sdk-go v1 to v2, eliminating direct dependency on the v1 module that triggers OpenSSF Scorecard Vulnerabilities advisories GO-2022-0635 and GO-2022-0646 (both target the v1 s3crypto subpackage we never import — they're flagged at module level on go.mod presence). Closes GO-2022-0635 + GO-2022-0646 (Scorecard Vulnerabilities 8 -> 10). Source migrations (3 files): - pkg/clouds/pulumi/aws/cloudtrail_validation.go session.NewSession + cloudtrail.New -> config.LoadDefaultConfig + cloudtrail.NewFromConfig; DescribeTrailsWithContext -> DescribeTrails; TrailNameList []*string -> []string; trails slice arg switched from []*cloudtrail.Trail to []cloudtrailtypes.Trail (v2 returns value slices). - pkg/clouds/pulumi/aws/cloudtrail_validation_test.go fixtures updated to []cloudtrailtypes.Trail; aws.String/aws.Bool helpers now imported from aws-sdk-go-v2/aws. - pkg/clouds/aws/helpers/ct_enrichment.go sessionForRegion replaced with configForRegion caching aws.Config by region; cloudwatchlogs.New -> NewFromConfig; FilterLogEventsWithContext -> FilterLogEvents; Limit narrowed from *int64 to *int32 (v2 schema); loop drops nil-element check because v2 returns []types.FilteredLogEvent value slice. Dependency bump: - aws-secretsmanager-caching-go bumped to /v2 (v1.1.3 -> v2.2.0). The v1 module of this lib still depended on aws-sdk-go v1; /v2 uses aws-sdk-go-v2/service/secretsmanager. Same secretcache.New() and GetSecretString(id) API surface, so the single call site in ch_cloudwatch_alert.go only needed an import path change. go.mod state: aws-sdk-go v1.50.36 moves from direct require to indirect (kept by pulumi/pkg/v3/operations -> aws-sdk-go/aws; unavoidable transitive until upstream Pulumi migrates). 'go mod why' confirms the main module no longer needs it. v2 directs added: cloudtrail v1.55.11, cloudwatchlogs v1.74.0, secretsmanager-caching-go/v2 v2.2.0. Tests: - pkg/clouds/pulumi/aws/... : PASS (cloudtrail_validation table tests cover trail-missing / validation-enabled / disabled+require=true / disabled+require=false / LogFileValidationEnabled==nil branches). - pkg/clouds/aws/helpers/... : PASS. - go build ./... : clean. - go vet ./... : clean. Signed-off-by: Dmitrii Creed --- go.mod | 31 +++++---- go.sum | 64 ++++++++--------- pkg/clouds/aws/helpers/ch_cloudwatch_alert.go | 2 +- pkg/clouds/aws/helpers/ct_enrichment.go | 69 +++++++++++-------- .../pulumi/aws/cloudtrail_validation.go | 46 ++++++++----- .../pulumi/aws/cloudtrail_validation_test.go | 12 ++-- 6 files changed, 126 insertions(+), 98 deletions(-) diff --git a/go.mod b/go.mod index aaaac3df..59a8d24a 100644 --- a/go.mod +++ b/go.mod @@ -9,8 +9,12 @@ require ( github.com/antonmedv/expr v1.12.6 github.com/atombender/go-jsonschema v0.23.0 github.com/aws/aws-lambda-go v1.47.0 - github.com/aws/aws-sdk-go v1.50.36 - github.com/aws/aws-secretsmanager-caching-go v1.1.3 + github.com/aws/aws-sdk-go-v2 v1.41.7 + github.com/aws/aws-sdk-go-v2/config v1.29.7 + github.com/aws/aws-sdk-go-v2/credentials v1.17.60 + github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.11 + github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.74.0 + github.com/aws/aws-secretsmanager-caching-go/v2 v2.2.0 github.com/cloudflare/cloudflare-go v0.104.0 github.com/compose-spec/compose-go v1.20.2 github.com/containerd/platforms v0.2.1 @@ -115,15 +119,13 @@ require ( github.com/ashanbrown/forbidigo v1.6.0 // indirect github.com/ashanbrown/makezero v1.2.0 // indirect github.com/atotto/clipboard v0.1.4 // indirect - github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect - github.com/aws/aws-sdk-go-v2/config v1.27.12 // indirect - github.com/aws/aws-sdk-go-v2/credentials v1.17.12 // indirect - github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect + github.com/aws/aws-sdk-go v1.50.36 // indirect + github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect + github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.29 // indirect github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15 // indirect - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect - github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect + github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect @@ -131,10 +133,11 @@ require ( github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect github.com/aws/aws-sdk-go-v2/service/kms v1.30.1 // indirect github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect - github.com/aws/aws-sdk-go-v2/service/sso v1.20.6 // indirect - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.5 // indirect - github.com/aws/aws-sdk-go-v2/service/sts v1.28.7 // indirect - github.com/aws/smithy-go v1.24.2 // indirect + github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.19 // indirect + github.com/aws/aws-sdk-go-v2/service/sso v1.24.16 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.15 // indirect + github.com/aws/aws-sdk-go-v2/service/sts v1.33.15 // indirect + github.com/aws/smithy-go v1.25.1 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/bkielbasa/cyclop v1.2.3 // indirect diff --git a/go.sum b/go.sum index 30961a69..e409f5f0 100644 --- a/go.sum +++ b/go.sum @@ -175,29 +175,32 @@ github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI= github.com/aws/aws-lambda-go v1.47.0 h1:0H8s0vumYx/YKs4sE7YM0ktwL2eWse+kfopsRI1sXVI= github.com/aws/aws-lambda-go v1.47.0/go.mod h1:dpMpZgvWx5vuQJfBt0zqBha60q7Dd7RfgJv23DymV8A= -github.com/aws/aws-sdk-go v1.47.10/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk= github.com/aws/aws-sdk-go v1.50.36 h1:PjWXHwZPuTLMR1NIb8nEjLucZBMzmf84TLoLbD8BZqk= github.com/aws/aws-sdk-go v1.50.36/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk= -github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY= -github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o= -github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o= -github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI= -github.com/aws/aws-sdk-go-v2/config v1.27.12 h1:vq88mBaZI4NGLXk8ierArwSILmYHDJZGJOeAc/pzEVQ= -github.com/aws/aws-sdk-go-v2/config v1.27.12/go.mod h1:IOrsf4IiN68+CgzyuyGUYTpCrtUQTbbMEAtR/MR/4ZU= -github.com/aws/aws-sdk-go-v2/credentials v1.17.12 h1:PVbKQ0KjDosI5+nEdRMU8ygEQDmkJTSHBqPjEX30lqc= -github.com/aws/aws-sdk-go-v2/credentials v1.17.12/go.mod h1:jlWtGFRtKsqc5zqerHZYmKmRkUXo3KPM14YJ13ZEjwE= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 h1:FVJ0r5XTHSmIHJV6KuDmdYhEpvlHpiSd38RQWhut5J4= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1/go.mod h1:zusuAeqezXzAB24LGuzuekqMAEgWkVYukBec3kr3jUg= +github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8= +github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc= +github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho= +github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10/go.mod h1:qqY157uZoqm5OXq/amuaBJyC9hgBCBQnsaWnPe905GY= +github.com/aws/aws-sdk-go-v2/config v1.29.7 h1:71nqi6gUbAUiEQkypHQcNVSFJVUFANpSeUNShiwWX2M= +github.com/aws/aws-sdk-go-v2/config v1.29.7/go.mod h1:yqJQ3nh2HWw/uxd56bicyvmDW4KSc+4wN6lL8pYjynU= +github.com/aws/aws-sdk-go-v2/credentials v1.17.60 h1:1dq+ELaT5ogfmqtV1eocq8SpOK1NRsuUfmhQtD/XAh4= +github.com/aws/aws-sdk-go-v2/credentials v1.17.60/go.mod h1:HDes+fn/xo9VeszXqjBVkxOo/aUy8Mc6QqKvZk32GlE= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.29 h1:JO8pydejFKmGcUNiiwt75dzLHRWthkwApIvPoyUtXEg= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.29/go.mod h1:adxZ9i9DRmB8zAT0pO0yGnsmu0geomp5a3uq5XpgOJ8= github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15 h1:7Zwtt/lP3KNRkeZre7soMELMGNoBrutx8nobg1jKWmo= github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15/go.mod h1:436h2adoHb57yd+8W+gYPrrA9U/R/SuAuOO42Ushzhw= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps= -github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU= -github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk= +github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo= +github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo= github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ= github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y= +github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.11 h1:3IDx7ybn7pyrLgVShEfGmEXec1xsqgoD1ADI1SxqKT0= +github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.11/go.mod h1:iSArc5uhvz1S3EICNNvRzPksb6HPAUhltzMvoCrGyfM= +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.74.0 h1:6TqDeYdvJJEIJGg5ICy7nzC7/UuHk2Eg3wrpb5bWKPM= +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.74.0/go.mod h1:MLJu3PUd8fp5Qvj4CiLvyY5H8y7kxHKlTp060Wsd+Vc= github.com/aws/aws-sdk-go-v2/service/iam v1.31.4 h1:eVm30ZIDv//r6Aogat9I88b5YX1xASSLcEDqHYRPVl0= github.com/aws/aws-sdk-go-v2/service/iam v1.31.4/go.mod h1:aXWImQV0uTW35LM0A/T4wEg6R1/ReXUu4SM6/lUHYK0= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY= @@ -212,16 +215,18 @@ github.com/aws/aws-sdk-go-v2/service/kms v1.30.1 h1:SBn4I0fJXF9FYOVRSVMWuhvEKoAH github.com/aws/aws-sdk-go-v2/service/kms v1.30.1/go.mod h1:2snWQJQUKsbN66vAawJuOGX7dr37pfOq9hb0tZDGIqQ= github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo= github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM= -github.com/aws/aws-sdk-go-v2/service/sso v1.20.6 h1:o5cTaeunSpfXiLTIBx5xo2enQmiChtu1IBbzXnfU9Hs= -github.com/aws/aws-sdk-go-v2/service/sso v1.20.6/go.mod h1:qGzynb/msuZIE8I75DVRCUXw3o3ZyBmUvMwQ2t/BrGM= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.5 h1:Ciiz/plN+Z+pPO1G0W2zJoYIIl0KtKzY0LJ78NXYTws= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.5/go.mod h1:mUYPBhaF2lGiukDEjJX2BLRRKTmoUSitGDUgM4tRxak= -github.com/aws/aws-sdk-go-v2/service/sts v1.28.7 h1:et3Ta53gotFR4ERLXXHIHl/Uuk1qYpP5uU7cvNql8ns= -github.com/aws/aws-sdk-go-v2/service/sts v1.28.7/go.mod h1:FZf1/nKNEkHdGGJP/cI2MoIMquumuRK6ol3QQJNDxmw= -github.com/aws/aws-secretsmanager-caching-go v1.1.3 h1:t+rmdeZdmejBnnzcOphm/RGbcgLIdIf0s1GTbUHmQ3w= -github.com/aws/aws-secretsmanager-caching-go v1.1.3/go.mod h1:QMdbETAWsghCajFg3e4QXhDjCn3F38BhK3N481xtKl4= -github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng= -github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= +github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.19 h1:O2xbipq7k1kTct69V7mFidwTagld9c/6iyK+3yo+QNg= +github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.19/go.mod h1:CxTOwBy2Qs8/+yV7fkz4eZB1RB5qeWaW9SvznvFLgRA= +github.com/aws/aws-sdk-go-v2/service/sso v1.24.16 h1:YV6xIKDJp6U7YB2bxfud9IENO1LRpGhe2Tv/OKtPrOQ= +github.com/aws/aws-sdk-go-v2/service/sso v1.24.16/go.mod h1:DvbmMKgtpA6OihFJK13gHMZOZrCHttz8wPHGKXqU+3o= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.15 h1:kMyK3aKotq1aTBsj1eS8ERJLjqYRRRcsmP33ozlCvlk= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.15/go.mod h1:5uPZU7vSNzb8Y0dm75xTikinegPYK3uJmIHQZFq5Aqo= +github.com/aws/aws-sdk-go-v2/service/sts v1.33.15 h1:ht1jVmeeo2anR7zDiYJLSnRYnO/9NILXXu42FP3rJg0= +github.com/aws/aws-sdk-go-v2/service/sts v1.33.15/go.mod h1:xWZ5cOiFe3czngChE4LhCBqUxNwgfwndEF7XlYP/yD8= +github.com/aws/aws-secretsmanager-caching-go/v2 v2.2.0 h1:wXXmTH/XdnVL9iUkUTsFAyja92ARoAgK13Jt5lsamVw= +github.com/aws/aws-secretsmanager-caching-go/v2 v2.2.0/go.mod h1:2xQdyjb9+YCw465Kd83aAwslS++VfvB/G+yaaa9y6JE= +github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI= +github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k= github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= @@ -1219,7 +1224,6 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= -golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g= golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= @@ -1317,8 +1321,6 @@ golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= -golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= -golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ= golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY= golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= @@ -1410,7 +1412,6 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= @@ -1425,7 +1426,6 @@ golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= -golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww= golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= diff --git a/pkg/clouds/aws/helpers/ch_cloudwatch_alert.go b/pkg/clouds/aws/helpers/ch_cloudwatch_alert.go index 5c9406ed..9a3b9891 100644 --- a/pkg/clouds/aws/helpers/ch_cloudwatch_alert.go +++ b/pkg/clouds/aws/helpers/ch_cloudwatch_alert.go @@ -10,7 +10,7 @@ import ( "github.com/samber/lo" "github.com/aws/aws-lambda-go/lambda" - "github.com/aws/aws-secretsmanager-caching-go/secretcache" + "github.com/aws/aws-secretsmanager-caching-go/v2/secretcache" "github.com/simple-container-com/api/pkg/api" "github.com/simple-container-com/api/pkg/api/logger" diff --git a/pkg/clouds/aws/helpers/ct_enrichment.go b/pkg/clouds/aws/helpers/ct_enrichment.go index d7f178fd..93c12e14 100644 --- a/pkg/clouds/aws/helpers/ct_enrichment.go +++ b/pkg/clouds/aws/helpers/ct_enrichment.go @@ -9,47 +9,50 @@ import ( "sync" "time" - "github.com/aws/aws-sdk-go/aws" - "github.com/aws/aws-sdk-go/aws/session" - "github.com/aws/aws-sdk-go/service/cloudwatchlogs" + "github.com/aws/aws-sdk-go-v2/aws" + "github.com/aws/aws-sdk-go-v2/config" + "github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs" "github.com/pkg/errors" "github.com/simple-container-com/api/pkg/api/logger" ) -// Per-region session cache. Lambda containers may handle many sequential -// invocations across their ~5-15 minute lifetime; reusing the session and its -// underlying HTTP client avoids redoing TLS handshake + credential resolution -// on every alarm. Keyed by region because different CloudTrail log groups may -// live in different regions. +// Per-region config cache. Lambda containers may handle many sequential +// invocations across their ~5-15 minute lifetime; reusing the resolved +// aws.Config (credentials provider, HTTP client) avoids redoing credential +// resolution on every alarm. Keyed by region because different CloudTrail log +// groups may live in different regions. +// +// aws-sdk-go-v2 replaces v1's *session.Session with aws.Config, which is a +// value type — we cache it by value rather than by pointer. var ( - sessionCacheMu sync.Mutex - sessionCache = map[string]*session.Session{} + configCacheMu sync.Mutex + configCache = map[string]aws.Config{} ) -func sessionForRegion(region string) (*session.Session, error) { +func configForRegion(ctx context.Context, region string) (aws.Config, error) { // Empty region → AWS SDK resolves from AWS_REGION / AWS_DEFAULT_REGION // (set automatically in Lambda). We still cache under a sentinel key - // so repeat empty-region callers share one session. + // so repeat empty-region callers share one config. key := region if key == "" { key = "__default__" } - sessionCacheMu.Lock() - defer sessionCacheMu.Unlock() - if s, ok := sessionCache[key]; ok { - return s, nil + configCacheMu.Lock() + defer configCacheMu.Unlock() + if c, ok := configCache[key]; ok { + return c, nil } - cfg := &aws.Config{} + opts := []func(*config.LoadOptions) error{} if region != "" { - cfg.Region = aws.String(region) + opts = append(opts, config.WithRegion(region)) } - s, err := session.NewSession(cfg) + c, err := config.LoadDefaultConfig(ctx, opts...) if err != nil { - return nil, err + return aws.Config{}, err } - sessionCache[key] = s - return s, nil + configCache[key] = c + return c, nil } // Subset of CloudTrail event schema — only the fields we surface in Slack/Discord/Telegram @@ -117,7 +120,9 @@ const ( maxPages = 5 // perPageLimit is the Limit parameter sent to FilterLogEvents. Combined // with maxPages, the hard ceiling per invocation is 250 events fetched. - perPageLimit = 50 + // Typed int32 because aws-sdk-go-v2 narrowed the field from *int64 (v1) + // to *int32 (v2) — the over-the-wire ceiling is 10_000, so int32 is safe. + perPageLimit int32 = 50 ) // lookupTriggeringEvents calls CloudWatch Logs FilterLogEvents over the given @@ -153,11 +158,11 @@ func lookupTriggeringEvents( limit = 5 } - sess, err := sessionForRegion(cfg.LogGroupRegion) + awsCfg, err := configForRegion(ctx, cfg.LogGroupRegion) if err != nil { - return nil, 0, errors.Wrapf(err, "failed to create AWS session for %q", cfg.LogGroupRegion) + return nil, 0, errors.Wrapf(err, "failed to load AWS config for %q", cfg.LogGroupRegion) } - client := cloudwatchlogs.New(sess) + client := cloudwatchlogs.NewFromConfig(awsCfg) const lookback = 10 * time.Minute const buffer = 1 * time.Minute @@ -169,24 +174,30 @@ func lookupTriggeringEvents( lookupCtx, cancel := context.WithTimeout(ctx, enrichmentTimeout) defer cancel() + pageLimit := perPageLimit input := &cloudwatchlogs.FilterLogEventsInput{ LogGroupName: aws.String(cfg.LogGroupName), FilterPattern: aws.String(cfg.FilterPattern), StartTime: aws.Int64(start), EndTime: aws.Int64(end), - Limit: aws.Int64(perPageLimit), + Limit: &pageLimit, } events := make([]ctEvent, 0, perPageLimit) pages := 0 truncated := false for { - out, err := client.FilterLogEventsWithContext(lookupCtx, input) + // aws-sdk-go-v2 folds the WithContext suffix into the canonical + // method signature; ctx is the first argument. + out, err := client.FilterLogEvents(lookupCtx, input) if err != nil { return nil, 0, errors.Wrapf(err, "FilterLogEvents on %q (page %d)", cfg.LogGroupName, pages+1) } + // v2 returns []types.FilteredLogEvent (value slice) where v1 returned + // []*FilteredLogEvent; the element itself can no longer be nil, so we + // only need to guard against an absent Message pointer. for _, e := range out.Events { - if e == nil || e.Message == nil { + if e.Message == nil { continue } var ce ctEvent diff --git a/pkg/clouds/pulumi/aws/cloudtrail_validation.go b/pkg/clouds/pulumi/aws/cloudtrail_validation.go index dee185c4..183def66 100644 --- a/pkg/clouds/pulumi/aws/cloudtrail_validation.go +++ b/pkg/clouds/pulumi/aws/cloudtrail_validation.go @@ -4,10 +4,11 @@ import ( "context" "fmt" - "github.com/aws/aws-sdk-go/aws" - "github.com/aws/aws-sdk-go/aws/credentials" - "github.com/aws/aws-sdk-go/aws/session" - "github.com/aws/aws-sdk-go/service/cloudtrail" + "github.com/aws/aws-sdk-go-v2/aws" + "github.com/aws/aws-sdk-go-v2/config" + "github.com/aws/aws-sdk-go-v2/credentials" + "github.com/aws/aws-sdk-go-v2/service/cloudtrail" + cloudtrailtypes "github.com/aws/aws-sdk-go-v2/service/cloudtrail/types" "github.com/pkg/errors" awsApi "github.com/simple-container-com/api/pkg/clouds/aws" @@ -34,7 +35,11 @@ type trailValidationOutcome struct { // (require-on), produce either a pass outcome or an error. Isolating this // from the AWS call makes the tricky bits — trail absent, flag absent, flag // explicitly false — directly unit-testable. -func evaluateTrailValidation(trailName string, require bool, trails []*cloudtrail.Trail) (trailValidationOutcome, error) { +// +// The trails slice is a value slice (aws-sdk-go-v2 returns []types.Trail, not +// []*Trail as v1 did); the helper preserves that shape so unit tests can build +// fixtures without unnecessary indirection. +func evaluateTrailValidation(trailName string, require bool, trails []cloudtrailtypes.Trail) (trailValidationOutcome, error) { if trailName == "" { return trailValidationOutcome{TrailFound: true, Enabled: true, Message: "trail check skipped (no trailName set)"}, nil } @@ -79,23 +84,32 @@ func ensureTrailLogFileValidation(ctx context.Context, cfg *awsApi.CloudTrailSec return trailValidationOutcome{TrailFound: true, Enabled: true, Message: "trail check skipped (no trailName set)"}, nil } - awsCfg := &aws.Config{} - if cfg.LogGroupRegion != "" { - awsCfg.Region = aws.String(cfg.LogGroupRegion) - } else if cfg.AccountConfig.Region != "" { - awsCfg.Region = aws.String(cfg.AccountConfig.Region) + // aws-sdk-go-v2 replaces v1's session.NewSession with + // config.LoadDefaultConfig + functional option helpers. Region resolves to + // the explicit LogGroupRegion → AccountConfig.Region → ambient env, in + // that order. Static credentials are wired in via a CredentialsProvider + // rather than an embedded credentials.Value. + loadOpts := []func(*config.LoadOptions) error{} + region := cfg.LogGroupRegion + if region == "" { + region = cfg.AccountConfig.Region + } + if region != "" { + loadOpts = append(loadOpts, config.WithRegion(region)) } if cfg.AccessKey != "" && cfg.SecretAccessKey != "" { - awsCfg.Credentials = credentials.NewStaticCredentials(cfg.AccessKey, cfg.SecretAccessKey, "") + loadOpts = append(loadOpts, config.WithCredentialsProvider( + credentials.NewStaticCredentialsProvider(cfg.AccessKey, cfg.SecretAccessKey, ""), + )) } - sess, err := session.NewSession(awsCfg) + awsCfg, err := config.LoadDefaultConfig(ctx, loadOpts...) if err != nil { - return trailValidationOutcome{}, errors.Wrap(err, "failed to create AWS session for CloudTrail pre-flight") + return trailValidationOutcome{}, errors.Wrap(err, "failed to load AWS config for CloudTrail pre-flight") } - client := cloudtrail.New(sess) - out, err := client.DescribeTrailsWithContext(ctx, &cloudtrail.DescribeTrailsInput{ - TrailNameList: []*string{aws.String(cfg.TrailName)}, + client := cloudtrail.NewFromConfig(awsCfg) + out, err := client.DescribeTrails(ctx, &cloudtrail.DescribeTrailsInput{ + TrailNameList: []string{cfg.TrailName}, IncludeShadowTrails: aws.Bool(false), }) if err != nil { diff --git a/pkg/clouds/pulumi/aws/cloudtrail_validation_test.go b/pkg/clouds/pulumi/aws/cloudtrail_validation_test.go index 46f19d0b..90d05193 100644 --- a/pkg/clouds/pulumi/aws/cloudtrail_validation_test.go +++ b/pkg/clouds/pulumi/aws/cloudtrail_validation_test.go @@ -3,8 +3,8 @@ package aws import ( "testing" - "github.com/aws/aws-sdk-go/aws" - "github.com/aws/aws-sdk-go/service/cloudtrail" + "github.com/aws/aws-sdk-go-v2/aws" + cloudtrailtypes "github.com/aws/aws-sdk-go-v2/service/cloudtrail/types" . "github.com/onsi/gomega" awsApi "github.com/simple-container-com/api/pkg/clouds/aws" @@ -34,7 +34,7 @@ func TestEvaluateTrailValidation(t *testing.T) { t.Run("trail found with validation enabled — pass", func(t *testing.T) { RegisterTestingT(t) - trails := []*cloudtrail.Trail{{ + trails := []cloudtrailtypes.Trail{{ Name: aws.String("cloudtrail_events"), LogFileValidationEnabled: aws.Bool(true), }} @@ -46,7 +46,7 @@ func TestEvaluateTrailValidation(t *testing.T) { t.Run("trail found with validation disabled + require=true — hard error with remedy", func(t *testing.T) { RegisterTestingT(t) - trails := []*cloudtrail.Trail{{ + trails := []cloudtrailtypes.Trail{{ Name: aws.String("cloudtrail_events"), LogFileValidationEnabled: aws.Bool(false), }} @@ -61,7 +61,7 @@ func TestEvaluateTrailValidation(t *testing.T) { t.Run("trail found with validation disabled + require=false — warning only", func(t *testing.T) { RegisterTestingT(t) - trails := []*cloudtrail.Trail{{ + trails := []cloudtrailtypes.Trail{{ Name: aws.String("cloudtrail_events"), LogFileValidationEnabled: aws.Bool(false), }} @@ -78,7 +78,7 @@ func TestEvaluateTrailValidation(t *testing.T) { // so we surface it rather than silently passing an indeterminate // trail as validated. RegisterTestingT(t) - trails := []*cloudtrail.Trail{{ + trails := []cloudtrailtypes.Trail{{ Name: aws.String("cloudtrail_events"), // LogFileValidationEnabled intentionally omitted → nil pointer }}