AWS sigv4 support for subgraph requests #134

[o0Ignition0o]

Configure AWS sigv4 authentication for subgraph requests

Secure your router to subgraph communication on AWS by using Sigv4!
This changeset provides you with a way to set up Hardcoded credentials, as well as a Default provider chain.
We recommend using the DefaultChain configuration.

Full use example:

    authentication:
      subgraph:
        all: # configuration that will apply to all subgraphs
          aws_sig_v4:
            default_chain:
              profile_name: "my-test-profile" # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#ec2-instance-profile
              region: "us-east-1" # https://docs.aws.amazon.com/general/latest/gr/rande.html
              service_name: "lambda" # https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html
              assume_role: # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html
                role_arn: "test-arn"
                session_name: "test-session"
                external_id: "test-id"
        subgraphs:
          products:
            aws_sig_v4:
              hardcoded: # Not recommended, prefer using default_chain as shown above
                access_key_id: "my-access-key"
                secret_access_key: "my-secret-access-key"
                region: "us-east-1"
                service_name: "vpc-lattice-svcs" # "s3", "lambda" etc.

The full documentation can be found in the router documentation

[router-perf]

CI performance tests

• reload - Reload test over a long period of time at a constant rate of users
• no-graphos - Basic stress test, no GraphOS.
• step - Basic stress test that steps up the number of users over time
• events_big_cap_high_rate - Stress test for events with a lot of users, deduplication enabled and high rate event with a big queue capacity
• const - Basic stress test that runs with a constant number of users
• large-request - Stress test with a 1 MB request payload
• xxlarge-request - Stress test with 100 MB request payload
• events - Stress test for events with a lot of users and deduplication ENABLED
• events_without_dedup - Stress test for events with a lot of users and deduplication DISABLED
• xlarge-request - Stress test with 10 MB request payload

[o0Ignition0o]

@BrynCooke It took me a while, but I'll make it up to you by adding counters and integration tests 5c3ee56 :D

[o0Ignition0o]

{
  "data": null,
  "errors": [
    {
      "message": "HTTP fetch failed from 'redacted': redacted",
      "path": [],
      "extensions": {
        "code": "SUBREQUEST_HTTP_ERROR",
        "service": "redacted",
        "reason": "redacted"
      }
    }
  ]
}

apollo_router_operations_authentication_aws_sigv4_total{authentication_aws_sigv4_failed="true",service_name="apollo-router",subgraph_service_name="accounts",otel_scope_name="apollo/router",otel_scope_version=""} 1

we're good!

[o0Ignition0o]

ok three things are remaining:

• @nmoutschen to give it a spin and lmk if it works for your use case
• @Meschreiber if there's anything really wrong in the docs
• @BlenderDude (optional) to maybe give it a try as well :)

[Meschreiber]

Left some suggestions for clarity. We can also briefly discuss during our meet and greet. 😊

[o0Ignition0o]

@Meschreiber Just polished the docs a bit, feel free to followup on it, thanks again for your feedback!