Skip to content

removing references to aws-sdk-go v1#5856

Merged
javiermolinar merged 4 commits intografana:mainfrom
anglerfishlyy:upgrade-aws-sdk-v2
Nov 10, 2025
Merged

removing references to aws-sdk-go v1#5856
javiermolinar merged 4 commits intografana:mainfrom
anglerfishlyy:upgrade-aws-sdk-v2

Conversation

@anglerfishlyy
Copy link
Copy Markdown
Contributor

@anglerfishlyy anglerfishlyy commented Nov 5, 2025

What this PR does:
Migrates the S3 backend from AWS SDK for Go v1 to v2, since v1 reached End of Support on July 31, 2025 and contains known security vulnerabilities (CVE-2020-8911, CVE-2020-8912).

Changes include:

  • Updated imports and configuration in tempodb/backend/s3/s3.go
  • Updated go.mod and go.sum to include AWS SDK v2 modules
  • Synced vendor directory using go mod tidy and go mod vendor
  • Verified functionality with go test ./tempodb/backend/s3 -v (all tests passed)

Which issue(s) this PR fixes:
Fixes #4706

Verification:
All unit tests for the S3 backend passed successfully.

root@DESKTOP-91QP86G:~/tempo# go test ./tempodb/backend/s3 -v
--- PASS: TestMarkBlockCompacted (0.03s)
--- PASS: TestFetchCreds (20.06s)
--- PASS: TestHedge (0.92s)
--- PASS: TestNilConfig (0.00s)
--- PASS: TestObjectBlockTags (0.00s)
--- PASS: TestObjectWithPrefix (0.01s)
--- PASS: TestListBlocksWithPrefix (0.01s)
--- PASS: TestObjectStorageClass (0.00s)
PASS
ok  	github.com/grafana/tempo/tempodb/backend/s3	21.057s

References

  • AWS SDK for Go v1 End of Support: AWS Blog

Related: https://github.com/aws/aws-sdk-go-v2

Note

  • The main S3 backend (s3.go) has been fully migrated to AWS SDK v2.

Copy link
Copy Markdown
Contributor

@javiermolinar javiermolinar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why don't do the same change for the s3_test.go? After removing all the references and running a go mod tidy && go mod vendor the github.com/aws/aws-sdk-go v1.55.7 is deleted from the mod file

 git diff
diff --git a/go.mod b/go.mod
index 483163a7e..bd12cc6df 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,6 @@ require (
        cloud.google.com/go/storage v1.56.0
        github.com/alecthomas/kong v1.12.1
        github.com/alicebob/miniredis/v2 v2.35.0
-       github.com/aws/aws-sdk-go v1.55.7
        github.com/cespare/xxhash/v2 v2.3.0
        github.com/cristalhq/hedgedhttp v0.9.1
        github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc

Comment thread tempodb/backend/s3/s3.go Outdated
Comment thread tempodb/backend/s3/s3.go Outdated
Comment thread tempodb/backend/s3/s3.go.bak Outdated
@javiermolinar
Copy link
Copy Markdown
Contributor

@anglerfishlyy the title is a bit misleading, could we change it to something like "removing references to aws-sdk-go v1" ?

…minio.NoSuchKey, clean backup, ran go mod tidy & vendor,add to changelog.md, make test-e2e-api pass
@anglerfishlyy anglerfishlyy changed the title Upgrade Tempo S3 backend to AWS SDK for Go v2 removing references to aws-sdk-go v1 Nov 7, 2025
@javiermolinar
Copy link
Copy Markdown
Contributor

Thank you for your contribution!

@javiermolinar javiermolinar merged commit 22da63b into grafana:main Nov 10, 2025
21 checks passed
@anglerfishlyy anglerfishlyy deleted the upgrade-aws-sdk-v2 branch November 10, 2025 09:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Tempo - Upgrade deps with github.com/aws/aws-sdk-go (v1) before end-of-support July 31, 2025 / fix CVE-2020-8911 + CVE-2020-8912

2 participants