Fix possible panic in aws app access (#39673)

lib/srv/app/aws/handler.go

@@ -228,7 +228,10 @@ func rewriteRequest(ctx context.Context, r *http.Request, re *endpoints.Resolved
 		outReq.URL.Scheme = "https"
 		outReq.URL.Host = u.Host
 	}
-	outReq.Body = io.NopCloser(io.LimitReader(r.Body, teleport.MaxHTTPRequestSize))
+	outReq.Body = http.NoBody
+	if r.Body != nil {
+		outReq.Body = io.NopCloser(io.LimitReader(r.Body, teleport.MaxHTTPRequestSize))
+	}
 	// need to rewrite the host header as well. The oxy forwarder will do this for us,
 	// since we use the PassHostHeader(false) option, but if host is a signed header
 	// then we must make the host match the URL host before signing the request or AWS

lib/srv/app/aws/handler_test.go

@@ -416,6 +416,20 @@ func TestAWSSignerHandler(t *testing.T) {
 	}
 }
 
+func TestRewriteRequest(t *testing.T) {
+	expectedReq, err := http.NewRequest("GET", "https://example.com", http.NoBody)
+	require.NoError(t, err)
+	ctx := context.Background()
+
+	inputReq := mustNewRequest(t, "GET", "https://example.com", nil)
+	actualOutReq, err := rewriteRequest(ctx, inputReq, &endpoints.ResolvedEndpoint{})
+	require.NoError(t, err)
+	require.Equal(t, expectedReq, actualOutReq, err)
+
+	_, err = io.ReadAll(actualOutReq.Body)
+	require.NoError(t, err)
+}
+
 func TestURLForResolvedEndpoint(t *testing.T) {
 	tests := []struct {
 		name                 string