parsedmarc icon indicating copy to clipboard operation
parsedmarc copied to clipboard

Add support for AWSSigV4-based authentication for OpenSearch

Open Szasza opened this issue 11 months ago • 0 comments

AWS OpenSearch has two methods to authenticate with, details can be found at https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-master-user

parsedmarc can access AWS OpenSearch using master user credentials and the internal user database. This however comes with limitations which are outlined in the document linked above.

It would be great to have support for AWSSigV4 to enable a more robust authentication method. opensearch-py already supports it, in the following way:

import boto3
from opensearchpy import OpenSearch, RequestsHttpConnection
import os
from requests_aws4auth import AWS4Auth

region = os.environ['AWS_REGION']
service = 'es'
credentials = boto3.Session().get_credentials()
awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service, session_token=credentials.token)
host = 'some_host_here'

os_client = OpenSearch(
        hosts=[host],
        http_auth = awsauth,
        use_ssl = True,
        verify_certs = True,
        ssl_assert_hostname = False,
        ssl_show_warn = False,
        connection_class=RequestsHttpConnection,
)

parsedmarc currently doesn't support this authentication method. A way of implementation could be to add aws_region and authentication_type (basic or awssigv4) to the config ini file's [opensearch] section. Based on the authentication type the OpenSearch connector could create the OpenSearch connection accordingly.

Happy to work on the implementation if the approach is agreed upon, either as above, or in a better way.

Szasza avatar Mar 14 '24 08:03 Szasza