s3

Documentation

Overview

Package s3 implements platform/storage Store for S3-compatible backends.

Security rules (security-baseline.md section 9 and 10):

• TLS is always required; endpoints must use HTTPS (AllowHTTP only for tests)
• Credentials are set via S3Config; never appear in logs or error messages
• Content validation hook applied before bytes reach the backend
• Server-generated keys enforced; clients never control storage paths
• Requests are signed with AWS Signature Version 4 when credentials are provided

Package s3 implements platform/storage Store for S3-compatible backends. This file implements AWS Signature Version 4 request signing. Reference: https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html

Streaming body signing:

• Body bytes are NOT buffered for hash computation.
• x-amz-content-sha256 is set to the constant "UNSIGNED-PAYLOAD".
• TLS (MinVersion: TLS 1.2, enforced in s3.go) provides transport-layer integrity, making unsigned payload safe per AWS documentation.
• Reference: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html

Security rules:

• Secret access key is used only in HMAC derivation and never appears in output
• Credentials are never logged; only the key ID appears in the Authorization header

Index

• Constants
• func WithClock(ctx context.Context, clock func() time.Time) context.Context
• type Adapter
  • func New(cfg S3Config) (*Adapter, error)
  • func (a *Adapter) Delete(ctx context.Context, key string) error
  • func (a *Adapter) Get(ctx context.Context, key string) (storage.Object, io.ReadCloser, error)
  • func (a *Adapter) Put(ctx context.Context, obj storage.Object, body io.Reader) error
  • func (a *Adapter) Timeout() time.Duration
• type S3Config
  • func (c S3Config) Validate() error

Constants

const DefaultTimeout = 30 * time.Second

DefaultTimeout is the per-operation timeout when S3Config.Timeout is zero.

Functions

func WithClock

func WithClock(ctx context.Context, clock func() time.Time) context.Context

WithClock returns a context that carries a clock override for testing. This is only used in tests to produce deterministic timestamps.

Types

type Adapter

type Adapter struct {
	// contains filtered or unexported fields
}

Adapter is an S3-compatible implementation of storage.Store. Safe for concurrent use.

func New

func New(cfg S3Config) (*Adapter, error)

New constructs an Adapter from the provided config.

func (*Adapter) Delete

func (a *Adapter) Delete(ctx context.Context, key string) error

Delete removes an object from S3 via a DELETE request.

func (*Adapter) Get

func (a *Adapter) Get(ctx context.Context, key string) (storage.Object, io.ReadCloser, error)

Get retrieves an object from S3 via a GET request. The caller must close the returned ReadCloser.

func (*Adapter) Put

func (a *Adapter) Put(ctx context.Context, obj storage.Object, body io.Reader) error

Put uploads an object to S3 via a PUT request. Content validation is applied before any bytes are sent.

func (*Adapter) Timeout

func (a *Adapter) Timeout() time.Duration

Timeout returns the effective operation timeout.

type S3Config

type S3Config struct {
	Endpoint        string
	Bucket          string
	Region          string
	AccessKeyID     string
	SecretAccessKey string
	ValidationHook  storage.ValidationHook
	MaxBytes        int64
	Timeout         time.Duration
	AllowHTTP       bool
}

S3Config holds configuration for the S3-compatible adapter. Credentials must come from environment variables or a secret provider.

func (S3Config) Validate

func (c S3Config) Validate() error

Validate checks S3Config before use.