log credential scope mismatch on failure

solo-io · Sep 12, 2023 · e11ac28 · e11ac28
1 parent c43e2b9
commit e11ac28
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/source/extensions/filters/http/aws_lambda/sts_fetcher.cc b/source/extensions/filters/http/aws_lambda/sts_fetcher.cc
@@ -149,6 +149,10 @@ class StsFetcherImpl : public StsFetcher,
         // TODO: cover more AWS error cases
         if (body.find(ExpiredTokenError) != std::string::npos) {
           callbacks_->onFailure(CredentialsFailureStatus::ExpiredToken);
+        } else if (body.find(SignaturedoesNotMatchError) != std::string::npos &&
+                   body.find(CredentialScopeMessage) != std::string::npos )
+        {
+          callbacks_->onFailure(CredentialsFailureStatus::CredentialScopeMismatch);
         } else {
           callbacks_->onFailure(CredentialsFailureStatus::Network);
         }

diff --git a/source/extensions/filters/http/aws_lambda/sts_fetcher.h b/source/extensions/filters/http/aws_lambda/sts_fetcher.h
@@ -25,6 +25,8 @@ namespace {
     "Version=2011-06-15";
 
 constexpr char ExpiredTokenError[] = "ExpiredTokenException";
+constexpr char SignaturedoesNotMatchError[] = "SignatureDoesNotMatch";
+constexpr char CredentialScopeMessage[] = "Credential should be scoped to a valid region.";
 } // namespace
 
 class StsCredentials : public Extensions::Common::Aws::Credentials {

diff --git a/source/extensions/filters/http/aws_lambda/sts_status.h b/source/extensions/filters/http/aws_lambda/sts_status.h
@@ -16,7 +16,9 @@ enum class CredentialsFailureStatus {
   /* Token is expired. */
   ClusterNotFound,
   /* The filter is being destroyed, therefore the request should be cancelled */
-  ContextCancelled
+  ContextCancelled,
+  /* The credentials computed by the filter are not valid in the current region */
+  CredentialScopeMismatch,
 };
 
 } // namespace AwsLambda