Unable to access kibana with /_plugin/kibana path

[nikhilo]

I'm trying to access an ES domain inside of a VPC. I'm running this proxy on one of hosts which has a public IP and is inside of the same VPC.

docker run --rm -p 5601:8080 --name aws-sigv4-proxy kaggggggga/aws-sigv4-proxy -v

following paths work,

• /
• /_cat/indices
• /_plugin/kibana/app/kibana#/home?_g=()

But this path doesn't work (which is supposed to take you to _plugin/kibana/app/kibana#/home?_g=()

• `/_plugin/kibana/

I get following error

time="2020-04-29T17:13:44Z" level=error msg="error proxying request" message="{\"message\":\"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\"}"

Any idea what could be the problem ?

[bandesz]

This is caused by the default http client following redirects and each new http call should be separately signed.

One way to fix this is to create a client with redirect handling disabled in main.go:

client := &http.Client{
  CheckRedirect: func(req *http.Request, via []*http.Request) error {
    return http.ErrUseLastResponse
  },
}

log.Fatal(
  http.ListenAndServe(*port, &handler.Handler{
    ProxyClient: &handler.ProxyClient{
      Signer: signer,
      Client: client,
      StripRequestHeaders: *strip,
      SigningNameOverride: *signingNameOverride,
      HostOverride: *hostOverride,
      RegionOverride: *regionOverride,
    },
  }),
)

[dfontenot]

Is it possible to get this update merged into mainline? I'm running into this same issue as well with the latest version. This proxy would be very helpful in accessing the Kibana instance that is set up with AWS Elasticsearch service instances.

[dekimsey]

I too was hoping to use this to access the Elasticsearch Service. It works great for hitting ES from dumb (non-AWS signing aware) clients, but the Kibana access being broken is an issue. If this is an issue specifically for redirects, it sounds like a legitimate bug in the way signatures are being calculated by the sig proxy.

[dekimsey]

Just confirming, I built a fork and the suggested solution by @bandesz works.

I know nothing about the implementation to recommend if it's a good solution, but it is a solution that works.

[ycourtois]

I have the same issue. Even if the suggested fix did the job, it would be great if it could be merged.