Switch to using FIPS-enabled endpoints

This changeset switches AWS service touchpoints to use their FIPS-enabled counterparts.  Note that S3 has some specific configuration associated with it.

This changeset also updates our allow ACLs to cover the FIPS-enabled endpoints.  We should investigate removing the non-FIPS endpoints as a part of this.

Signed-off-by: Carlo Costino <carlo.costino@gsa.gov>

app/s3_client/__init__.py

@@ -1,7 +1,18 @@
 import botocore
 from boto3 import Session
+from botocore.config import Config
 from flask import current_app
 
+AWS_CLIENT_CONFIG = Config(
+    # This config is required to enable S3 to connect to FIPS-enabled
+    # endpoints.  See https://aws.amazon.com/compliance/fips/ for more
+    # information.
+    s3={
+        'addressing_style': 'virtual',
+    },
+    use_fips_endpoint=True
+)
+
 
 def get_s3_object(
     bucket_name,
@@ -11,7 +22,12 @@ def get_s3_object(
     region,
 ):
     # To inspect contents: obj.get()['Body'].read().decode('utf-8')
-    session = Session(aws_access_key_id=access_key, aws_secret_access_key=secret_key, region_name=region)
+    session = Session(
+        aws_access_key_id=access_key,
+        aws_secret_access_key=secret_key,
+        region_name=region,
+        config=AWS_CLIENT_CONFIG
+    )
     s3 = session.resource('s3')
     obj = s3.Object(bucket_name, filename)
     return obj

deploy-config/egress_proxy/notify-admin-demo.allow.acl

@@ -1,2 +1,6 @@
+s3-fips.us-east-1.amazonaws.com
+s3-fips.us-east-2.amazonaws.com
+s3-fips.us-west-1.amazonaws.com
+s3-fips.us-west-2.amazonaws.com
 gov-collector.newrelic.com
 egress-proxy-notify-admin-demo.apps.internal

deploy-config/egress_proxy/notify-admin-production.allow.acl

@@ -1,2 +1,4 @@
+s3-fips.us-gov-east-1.amazonaws.com
+s3-fips.us-gov-west-1.amazonaws.com
 gov-collector.newrelic.com
 egress-proxy-notify-admin-production.apps.internal

deploy-config/egress_proxy/notify-admin-staging.allow.acl

@@ -1,2 +1,6 @@
+s3-fips.us-east-1.amazonaws.com
+s3-fips.us-east-2.amazonaws.com
+s3-fips.us-west-1.amazonaws.com
+s3-fips.us-west-2.amazonaws.com
 gov-collector.newrelic.com
 egress-proxy-notify-admin-staging.apps.internal