Issue
- AWS S3 signature version 2 is scheduled to be discontinued, will this affect Liferay DXP?
Environment
- Liferay Portal 6.2, Liferay DXP 7.0, Liferay DXP 7.1
Resolution
- If you are using LiferayDXP, you basically do not need to support Liferay since it supports signature version 4.
Liferay uses the AWS SDK to connect to AWS S3.
According to the official AWS website, the recommended version is 1.11.x.
The version of the SDK used by Liferay varies depending on the FixPack, and applying FixPack 41 or higher is the recommended version by AWS.
On the engineering side, testing was conducted using FixPack41 and older versions of FixPack for buckets in regions that support onlysignature version 4.
In both cases, we have confirmed that communication is possible without any particular problems.
If you are currently connected to a bucket where both signature versions 2 and 4 are available, you may have a mix of signature versions used in your communication.
This is because each AWS region has a different preferred signature version and does not depend on settings on the Liferay side.(AWS SDK always selects the best signature version)
We do not anticipate any problems if signature version 2 is discontinued, but we recommend upgrading to FixPack 41 or higher if possible.
If some requirement makes it difficult to upgrade FixPack, it is possible to fix the signature version used to 4.
You can adjust the Java startup options by checking thisAWS official page.
Additional Information
- https://docs.aws.amazon.com/ja_jp/AmazonS3/latest/dev/UsingAWSSDK.html?shortFooter=true#UsingAWSSDK-move-to-Sig4
- https://docs.aws.amazon.com/ja_jp/AmazonS3/latest/dev/UsingAWSSDK.html#UsingAWSSDK-sig2-deprecation
- https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region
- https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version