CIINABox Pipelines - S3 Region Authorization Fix

Introduction

This release addresses a critical issue in the CIINABox Pipelines library where S3 bucket location queries were failing with authorization header errors when accessing buckets in certain regions, specifically ap-southeast-1. The fix ensures that the S3 client uses the correct region when making getBucketLocation API calls, preventing authorization header mismatches.

The Issue

When attempting to query bucket locations for S3 buckets hosted in ap-southeast-1, the getBucketLocation method was using the default region (us-east-1) in the S3 client, resulting in the following error:

com.amazonaws.services.s3.model.AmazonS3Exception: The authorization header is malformed; 
the region 'us-east-1' is wrong; expecting 'ap-southeast-1' 
(Service: Amazon S3; Status Code: 400; Error Code: AuthorizationHeaderMalformed; 
Request ID: 7MS6DSEXVCGSDAMC; S3 Extended Request ID: W+TtTvGGr631WQusxuCjqbwNqVbMYxOroPzHKGXIMuJZe28Z4mGbWM5wCyr94U1q7kAUoT9ccHw=; 
Proxy: null)

This issue persisted for over 48 hours and was specific to the ap-southeast-1 region, while other regions such as sa-east-1, eu-central-1, and us-east-1 were not affected.

Features

S3 Client Region Configuration Fix

The fix modifies the getBucketRegion method in the CloudformationStack.groovy class to ensure the S3 client is initialized with the correct region from the parent client builder.

What Changed

In the CloudformationStack.groovy file, the S3 client initialization was updated:

Before:

def getBucketRegion(String bucket) {
    def s3GetRegionClient = new AwsClientBuilder().s3()
    def bucketRegion = s3GetRegionClient.getBucketLocation(bucket)
    // ... rest of the method
}

After:

def getBucketRegion(String bucket) {
    def s3GetRegionClient = new AwsClientBuilder([region: clientBuilder.region]).s3()
    def bucketRegion = s3GetRegionClient.getBucketLocation(bucket)
    // ... rest of the method
}

Technical Details

The key change is passing the region configuration from the parent clientBuilder to the new AwsClientBuilder instance. This ensures that:

1. The S3 client uses the same region as the CloudFormation stack operations
2. The authorization header includes the correct region information
3. Cross-region bucket location queries are properly authenticated

Impact and Benefits

• Fixes Authorization Errors: Resolves the AuthorizationHeaderMalformed error when querying bucket locations in ap-southeast-1
• Maintains Compatibility: The fix doesn’t affect operations in other regions that were already working correctly
• Improves Reliability: Ensures consistent behavior across all AWS regions for S3 bucket location queries
• No Breaking Changes: The fix is backward compatible and requires no changes to existing pipeline configurations

Examples

Using CloudFormation Stack with S3 Templates

When using CloudFormation stacks with templates stored in S3 buckets across different regions:

// Initialize the CloudFormation stack
def clientBuilder = new AwsClientBuilder([region: 'ap-southeast-1'])
def stack = new CloudformationStack(clientBuilder, 'my-stack-name')

// Get template from S3 bucket in ap-southeast-1
def templateUrl = 's3://my-bucket-in-ap-southeast-1/templates/my-template.yaml'
def template = stack.getTemplateFromUrl(templateUrl)

// The getBucketRegion method will now correctly use ap-southeast-1 region
// preventing authorization header errors

Stack Parameter Resolution

When resolving stack parameters with templates in cross-region buckets:

def overrideParams = [
    'Environment': 'production',
    'InstanceType': 't3.medium'
]

// This will now work correctly even if the template is in ap-southeast-1
def stackParams = stack.getStackParams(overrideParams, templateUrl)

Implementation Notes

The fix is minimal and focused, changing only the S3 client initialization to inherit the region from the parent client builder. This approach:

• Preserves the existing logic for region mapping (US → us-east-1, EU → eu-west-1)
• Maintains the same API and method signatures
• Requires no changes to calling code
• Ensures the S3 client has the proper regional context for authorization

Conclusion

This release resolves a critical issue affecting CIINABox Pipelines users working with S3 buckets in the ap-southeast-1 region. The fix ensures proper authorization headers are sent with S3 API requests by correctly configuring the S3 client with the appropriate region.

Users experiencing AuthorizationHeaderMalformed errors when working with CloudFormation templates stored in S3 buckets should update to this version. The fix is backward compatible and requires no changes to existing pipeline configurations.

For any issues or questions regarding this release, please open an issue in the CIINABox Pipelines repository.