Error when issuing a KMS sign request.

[mickeyr]

I am trying to issue a KMS sign request but I am unable get it to work. The request looks like so

  local sign_response, sign_error = kms:sign({
    KeyId = conf.signing_kms_key_id,
    Message = table.concat(jwt_contents, "."),
    SigningAlgorithm = signing_algorithm,
    MessageType = "RAW",
  })

The error returned is as follows

[kong] init.lua:359 [capabilities] /usr/local/share/lua/5.1/resty/aws/request/build.lua:213: raw body set while parameters need to be encoded in body, client: 172.21.0.1, server: kong, request: "GET /debug HTTP/1.1", host: "localhost:8000"

As far as I can tell, the problem is because Message parameter has the shape of PlainTextType which has a type of blob.

The build_request function checks the type and sets the body to the value of message, because of the type of "blob" here. The other parameters are added to the body_tbl here to be encoded as json.

The assert found here then fails because there's a value in the body & parameters to still be serialized as json.

Is there some other way to encode these parameters so it works? or am I off base on what seems to be the issue?

[Tieske]

looking into this:

This is the service: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/KMS.html
9:18

Specific method: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/KMS.html#sign-property

Service metadata: https://github.com/aws/aws-sdk-js/blob/master/apis/kms-2014-11-01.normal.json

Method description: https://github.com/aws/aws-sdk-js/blob/master/apis/kms-2014-11-01.normal.json#L1592 , for which the input has shape "SignRequest".

"SignRequest" shape: https://github.com/aws/aws-sdk-js/blob/master/apis/kms-2014-11-01.normal.json#L4165 , which contains "Message" as shape "PlaintextType"

"PlaintextType" shape: https://github.com/aws/aws-sdk-js/blob/master/apis/kms-2014-11-01.normal.json#L4165 , which is a "blob"

[Tieske]

the above looks indeed like we encode the blob type in a wrong way. It should be added into the body, instead of replacing the body.

[Tieske]

if you remove these 2 lines:

lua-resty-aws/src/resty/aws/request/build.lua

Lines 190 to 191 in aa34df3

	elseif member_config.type == "blob" then
	request.body = param_value

then the code should fall through to the else clause which will add the blob text to the body as a regular parameter.

I think that might fix it. Can you maybe test this @mickeyr or @battlebyte ?

[battlebyte]

A customer confirmd that the proposed solution works @Tieske .