Switch to using FIPS-enabled endpoints

This changeset switches AWS service touchpoints to use their FIPS-enabled counterparts.  Note that S3 has some specific configuration associated with it.

This changeset also updates our allow ACLs to cover the FIPS-enabled endpoints.  We should investigate removing the non-FIPS endpoints as a part of this.

Signed-off-by: Carlo Costino <carlo.costino@gsa.gov>

app/clients/__init__.py

@@ -1,3 +1,19 @@
+from botocore.config import Config
+
+AWS_CLIENT_CONFIG = Config(
+    # This config is required to enable S3 to connect to FIPS-enabled
+    # endpoints.  See https://aws.amazon.com/compliance/fips/ for more
+    # information.
+    s3={
+        'addressing_style': 'virtual',
+    },
+    use_fips_endpoint=True
+)
+STATISTICS_REQUESTED = 'requested'
+STATISTICS_DELIVERED = 'delivered'
+STATISTICS_FAILURE = 'failure'
+
+
 class ClientException(Exception):
     '''
     Base Exceptions for sending notifications that fail
@@ -12,11 +28,6 @@ class Client(object):
     pass
 
 
-STATISTICS_REQUESTED = 'requested'
-STATISTICS_DELIVERED = 'delivered'
-STATISTICS_FAILURE = 'failure'
-
-
 class NotificationProviderClients(object):
     sms_clients = {}
     email_clients = {}

app/clients/cloudwatch/aws_cloudwatch.py

@@ -4,7 +4,7 @@ import time
 
 from boto3 import client
 
-from app.clients import Client
+from app.clients import AWS_CLIENT_CONFIG, Client
 from app.cloudfoundry_config import cloud_config
 
 
@@ -18,7 +18,8 @@ class AwsCloudwatchClient(Client):
             "logs",
             region_name=cloud_config.sns_region,
             aws_access_key_id=cloud_config.sns_access_key,
-            aws_secret_access_key=cloud_config.sns_secret_key
+            aws_secret_access_key=cloud_config.sns_secret_key,
+            config=AWS_CLIENT_CONFIG
         )
         super(Client, self).__init__(*args, **kwargs)
         self.current_app = current_app

app/clients/email/aws_ses.py

@@ -4,7 +4,11 @@ import botocore
 from boto3 import client
 from flask import current_app
 
-from app.clients import STATISTICS_DELIVERED, STATISTICS_FAILURE
+from app.clients import (
+    AWS_CLIENT_CONFIG,
+    STATISTICS_DELIVERED,
+    STATISTICS_FAILURE,
+)
 from app.clients.email import (
     EmailClient,
     EmailClientException,
@@ -62,7 +66,8 @@ class AwsSesClient(EmailClient):
             'ses',
             region_name=cloud_config.ses_region,
             aws_access_key_id=cloud_config.ses_access_key,
-            aws_secret_access_key=cloud_config.ses_secret_key
+            aws_secret_access_key=cloud_config.ses_secret_key,
+            config=AWS_CLIENT_CONFIG
         )
         super(AwsSesClient, self).__init__(*args, **kwargs)
 

app/clients/sms/aws_sns.py

@@ -5,6 +5,7 @@ import botocore
 import phonenumbers
 from boto3 import client
 
+from app.clients import AWS_CLIENT_CONFIG
 from app.clients.sms import SmsClient
 from app.cloudfoundry_config import cloud_config
 
@@ -19,7 +20,8 @@ class AwsSnsClient(SmsClient):
             "sns",
             region_name=cloud_config.sns_region,
             aws_access_key_id=cloud_config.sns_access_key,
-            aws_secret_access_key=cloud_config.sns_secret_key
+            aws_secret_access_key=cloud_config.sns_secret_key,
+            config=AWS_CLIENT_CONFIG
         )
         super(SmsClient, self).__init__(*args, **kwargs)
         self.current_app = current_app