Removing AWS SDK v1 (targeted early 2025)

[khrm]

Amazon has announced the End of Support for AWS SDK for Go (v1). Can we now drop this library from the dependencies? I see that the default behaviour is now sdk v2.

Is any help required to do this before July 31st 2025?

https://aws.amazon.com/blogs/developer/announcing-end-of-support-for-aws-sdk-for-go-v1-on-july-31-2025/

[khrm]

If any help is required on this, I am willing to step up.

[vangent]

I announced on the latest release that we plan to remove V1 support in early 2025:

https://groups.google.com/g/go-cloud/c/I5XUddBHLCU

We can use this bug to track it.

[S-YOU]

@vangent, @khrm

Any update on this? some vulnerability scans raising some CVEs on SDKv1 that depends on this library.

[vangent]

No progress as of yet. I am hoping https://github.com/google/go-cloud/pull/3519 will land soon so v1 can be removed entirely.

Note that if you don't use AWSv1, you shouldn't be exposed to any vulnerabilities in v1 libraries.

[S-YOU]

Note that if you don't use AWSv1, you shouldn't be exposed to any vulnerabilities in v1 libraries.

Thats correct but by term of vulnerabilities checkers like the one AWS provided, they check signatures on binary, having a Struct reference to AWS V1 will include all related dependencies from AWS V1 and that will still triggered those alerts.

But hopfully there seems to be some progress. Looking forward to it.

[jba]

I have bandwidth this week to get this done.

[vangent]

Support is dropped for everything except docstore at this point.

[vangent]

docstore just got v2 support, so I'll make a release with that, and then drop AWSv1 for the next release.