[Security] Re-enable S3 connectors only with pinned SDK peers and redirects #34

New Issue

zemion · 2026-07-21T16:40:42+02:00

zemion commented

2026-07-21 16:40:42 +02:00

Outcome

S3-compatible connectors can be enabled without weakening the deployment-wide connector egress boundary. Every actual peer, redirect, endpoint-discovery result, and retry destination is authorized and DNS/IP pinned before the socket is opened.

Context

The initial S3 connector from #20 is intentionally fail-closed because boto3/botocore manages secondary connections that the current boundary cannot prove are pinned. This is a security follow-up, not a regression of the profile/catalog work already completed.

Acceptance

No boto3/botocore client is constructed while peer pinning cannot be enforced.
The implementation validates and pins the exact address used for every connection, including redirects, region/endpoint discovery, retries, and provider aliases.
TLS hostname verification and SNI retain the configured authority while the socket uses an approved address.
DNS rebinding, redirect-to-private, mixed-answer, and peer-change tests fail closed.
Deployment-wide private-network policy is applied consistently.
Operator documentation and target-provider tests describe supported topologies and residual limitations.

## Outcome S3-compatible connectors can be enabled without weakening the deployment-wide connector egress boundary. Every actual peer, redirect, endpoint-discovery result, and retry destination is authorized and DNS/IP pinned before the socket is opened. ## Context The initial S3 connector from #20 is intentionally fail-closed because boto3/botocore manages secondary connections that the current boundary cannot prove are pinned. This is a security follow-up, not a regression of the profile/catalog work already completed. ## Acceptance - No boto3/botocore client is constructed while peer pinning cannot be enforced. - The implementation validates and pins the exact address used for every connection, including redirects, region/endpoint discovery, retries, and provider aliases. - TLS hostname verification and SNI retain the configured authority while the socket uses an approved address. - DNS rebinding, redirect-to-private, mixed-answer, and peer-change tests fail closed. - Deployment-wide private-network policy is applied consistently. - Operator documentation and target-provider tests describe supported topologies and residual limitations.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-files#34