EndpointRegionHelperTrait.php 3.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116
  1. <?php
  2. namespace Aws\S3;
  3. use Aws\Api\Service;
  4. use Aws\Arn\ArnInterface;
  5. use Aws\Arn\S3\OutpostsArnInterface;
  6. use Aws\Endpoint\PartitionEndpointProvider;
  7. use Aws\Exception\InvalidRegionException;
  8. /**
  9. * @internal
  10. */
  11. trait EndpointRegionHelperTrait
  12. {
  13. /** @var array */
  14. private $config;
  15. /** @var PartitionEndpointProvider */
  16. private $partitionProvider;
  17. /** @var string */
  18. private $region;
  19. /** @var Service */
  20. private $service;
  21. private function getPartitionSuffix(
  22. ArnInterface $arn,
  23. PartitionEndpointProvider $provider
  24. ) {
  25. $partition = $provider->getPartition(
  26. $arn->getRegion(),
  27. $arn->getService()
  28. );
  29. return $partition->getDnsSuffix();
  30. }
  31. private function getSigningRegion(
  32. $region,
  33. $service,
  34. PartitionEndpointProvider $provider
  35. ) {
  36. $partition = $provider->getPartition($region, $service);
  37. $data = $partition->toArray();
  38. if (isset($data['services'][$service]['endpoints'][$region]['credentialScope']['region'])) {
  39. return $data['services'][$service]['endpoints'][$region]['credentialScope']['region'];
  40. }
  41. return $region;
  42. }
  43. private function isFipsPseudoRegion($region)
  44. {
  45. return strpos($region, 'fips-') !== false || strpos($region, '-fips') !== false;
  46. }
  47. private function isMatchingSigningRegion(
  48. $arnRegion,
  49. $clientRegion,
  50. $service,
  51. PartitionEndpointProvider $provider
  52. ) {
  53. $arnRegion = $this->stripPseudoRegions(strtolower($arnRegion));
  54. $clientRegion = $this->stripPseudoRegions(strtolower($clientRegion));
  55. if ($arnRegion === $clientRegion) {
  56. return true;
  57. }
  58. if ($this->getSigningRegion($clientRegion, $service, $provider) === $arnRegion) {
  59. return true;
  60. }
  61. return false;
  62. }
  63. private function stripPseudoRegions($region)
  64. {
  65. return str_replace(['fips-', '-fips'], ['', ''], $region);
  66. }
  67. private function validateFipsNotUsedWithOutposts(ArnInterface $arn)
  68. {
  69. if ($arn instanceof OutpostsArnInterface) {
  70. if (empty($this->config['use_arn_region'])
  71. || !($this->config['use_arn_region']->isUseArnRegion())
  72. ) {
  73. $region = $this->region;
  74. } else {
  75. $region = $arn->getRegion();
  76. }
  77. if ($this->isFipsPseudoRegion($region)) {
  78. throw new InvalidRegionException(
  79. 'Fips is currently not supported with S3 Outposts access'
  80. . ' points. Please provide a non-fips region or do not supply an'
  81. . ' access point ARN.');
  82. }
  83. }
  84. }
  85. private function validateMatchingRegion(ArnInterface $arn)
  86. {
  87. if (!($this->isMatchingSigningRegion(
  88. $arn->getRegion(),
  89. $this->region,
  90. $this->service->getEndpointPrefix(),
  91. $this->partitionProvider)
  92. )) {
  93. if (empty($this->config['use_arn_region'])
  94. || !($this->config['use_arn_region']->isUseArnRegion())
  95. ) {
  96. throw new InvalidRegionException('The region'
  97. . " specified in the ARN (" . $arn->getRegion()
  98. . ") does not match the client region ("
  99. . "{$this->region}).");
  100. }
  101. }
  102. }
  103. }