Add s3.signature_type setting

README.md

@@ -317,6 +317,11 @@ OPTIONS:
       using S3 proxy backend. Applies to s3 auth method(s): access_key.
       [$BAZEL_REMOTE_S3_SECRET_ACCESS_KEY]
 
+   --s3.signature_type value Which type of s3 signature to use when using S3
+      proxy backend. Only applies when using the s3 access_key auth method.
+      Allowed values: v2, v4, v4streaming, anonymous. (default: v4)
+      [$BAZEL_REMOTE_S3_SIGNATURE_TYPE]
+
    --s3.aws_shared_credentials_file value Path to the AWS credentials file.
       If not specified, the minio client will default to '~/.aws/credentials'.
       Applies to s3 auth method(s): aws_credentials_file.
@@ -515,6 +520,7 @@ http_address: 0.0.0.0:8080
 #  auth_method: access_key
 #  access_key_id: EXAMPLE_ACCESS_KEY
 #  secret_access_key: EXAMPLE_SECRET_KEY
+#  signature_type: v4
 #
 # IAM Role authentication.
 #  auth_method: iam_role

config/config.go

@@ -416,6 +416,13 @@ func validateConfig(c *Config) error {
 			return fmt.Errorf("s3.bucket_lookup_type must be one of: \"auto\", \"dns\", \"path\" or empty/unspecified, found: \"%s\"",
 				c.S3CloudStorage.BucketLookupType)
 		}
+
+		if c.S3CloudStorage.SignatureType != "" && c.S3CloudStorage.SignatureType != "v2" &&
+			c.S3CloudStorage.SignatureType != "v4" && c.S3CloudStorage.SignatureType != "v4streaming" &&
+			c.S3CloudStorage.SignatureType != "anonymous" {
+			return fmt.Errorf("s3.signature_type must be one of: \"v2\", \"v4\", \"v4streaming\", \"anonymous\" or empty/unspecified, found: \"%s\"",
+				c.S3CloudStorage.SignatureType)
+		}
 	}
 
 	if c.AzBlobConfig != nil {
@@ -519,6 +526,7 @@ func get(ctx *cli.Context) (*Config, error) {
 			AuthMethod:               ctx.String("s3.auth_method"),
 			AccessKeyID:              ctx.String("s3.access_key_id"),
 			SecretAccessKey:          ctx.String("s3.secret_access_key"),
+			SignatureType:            ctx.String("s3.signature_type"),
 			DisableSSL:               ctx.Bool("s3.disable_ssl"),
 			UpdateTimestamps:         ctx.Bool("s3.update_timestamps"),
 			IAMRoleEndpoint:          ctx.String("s3.iam_role_endpoint"),

config/s3.go

@@ -17,6 +17,7 @@ type S3CloudStorageConfig struct {
 	AuthMethod               string `yaml:"auth_method"`
 	AccessKeyID              string `yaml:"access_key_id"`
 	SecretAccessKey          string `yaml:"secret_access_key"`
+	SignatureType            string `yaml:"signature_type"`
 	DisableSSL               bool   `yaml:"disable_ssl"`
 	UpdateTimestamps         bool   `yaml:"update_timestamps"`
 	IAMRoleEndpoint          string `yaml:"iam_role_endpoint"`
@@ -39,7 +40,9 @@ func (s3c S3CloudStorageConfig) GetCredentials() (*credentials.Credentials, erro
 			return nil, fmt.Errorf("missing s3.secret_access_key for s3.auth_method = '%s'", s3proxy.AuthMethodAccessKey)
 		}
 		log.Println("S3 Credentials: using access/secret access key.")
-		return credentials.NewStaticV4(s3c.AccessKeyID, s3c.SecretAccessKey, ""), nil
+		signatureType := parseSignatureType(s3c.SignatureType)
+		log.Printf("S3 Sign: using %s sign\n", signatureType.String())
+		return credentials.NewStatic(s3c.AccessKeyID, s3c.SecretAccessKey, "", signatureType), nil
 	} else if s3c.AuthMethod == s3proxy.AuthMethodIAMRole {
 		// Fall back to getting credentials from IAM
 		log.Println("S3 Credentials: using IAM.")
@@ -48,3 +51,15 @@ func (s3c S3CloudStorageConfig) GetCredentials() (*credentials.Credentials, erro
 
 	return nil, fmt.Errorf("invalid s3.auth_method: %s", s3c.AuthMethod)
 }
+
+func parseSignatureType(str string) credentials.SignatureType {
+	// str has been verified in config.go/validateConfig, must be one of these keys
+	valMap := map[string]credentials.SignatureType{
+		"":            credentials.SignatureV4,
+		"v2":          credentials.SignatureV2,
+		"v4":          credentials.SignatureV4,
+		"v4streaming": credentials.SignatureV4Streaming,
+		"anonymous":   credentials.SignatureAnonymous,
+	}
+	return valMap[str]
+}

utils/flags/flags.go

@@ -296,6 +296,12 @@ func GetCliFlags() []cli.Flag {
 			Usage:   "The S3/minio secret access key to use when using S3 proxy backend. " + s3AuthMsg(s3proxy.AuthMethodAccessKey),
 			EnvVars: []string{"BAZEL_REMOTE_S3_SECRET_ACCESS_KEY"},
 		},
+		&cli.StringFlag{
+			Name:        "s3.signature_type",
+			Usage:       "Which type of s3 signature to use when using S3 proxy backend. Only applies when using the s3 access_key auth method. Allowed values: v2, v4, v4streaming, anonymous.",
+			DefaultText: "v4",
+			EnvVars:     []string{"BAZEL_REMOTE_S3_SIGNATURE_TYPE"},
+		},
 		&cli.StringFlag{
 			Name:    "s3.aws_shared_credentials_file",
 			Value:   "",