1437928 - [ops infra socorro] Allow minidump-stackwalker in new infra to access private symbols bucket

Status: RESOLVED FIXED

(Socorro :: Infra, task)

Description

[Brian Pitts]

Discussion of potential approaches: https://docs.google.com/document/d/1MmzpCyh8WxuYP_yd5wNm0_8pkTNbHrBxY86RNH1VEnA/edit?usp=sharing

Comment 1

[Miles Crabill [:miles]]

I looked at some of the other implementations that we found, and avoided them for these reasons:
  - discomfort with lua
  - go code using nonstandard AWS libraries (not official AWS SDK)
  - outdated / unmaintained

I've implemented a proxy that signs requests with AWS V4 Signatures. I've tested it in -new-stage.

Code: http://github.com/mozilla-services/aws-signing-proxy
PR to add it to processor infra code: https://github.com/mozilla-services/cloudops-deployment/pull/1618
Docker images: https://hub.docker.com/r/mozilla/aws-signing-proxy/

Once that PR is merged, we'll be set here.

Comment 2

[Miles Crabill [:miles]]

That PR has been merged. I've confirmed that requests from minidump-stackwalker in -new-stage and -new-prod are going through the proxy and that objects that exist in S3 are properly served via the proxy. (objects that do not exist return 403s).

Marking this fixed.