Hierarchical Keyring: cold-cache stampede — N concurrent decrypts → N DynamoDB/KMS calls

未关闭
#1,663 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
52/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
冷清
技术栈
aws, node.js, typescript
领域
backend, security

调研方向

从 Node Hierarchical Keyring 的 getBranchKeyMaterials 路径开始，跟踪 materials cache 如何处理冷缓存查找。针对一个分支密钥版本执行并发解密或加密以重现该问题，并验证共享的是同一个正在进行的 keystore 请求、已结算的条目会被移除，以及失败的请求可以重试。

由索引模型根据 Issue 内容生成。

描述

Security issue notifications

If you discover a potential security issue in the AWS Encryption SDK we ask that you notify AWS Security via our vulnerability reporting page. Please do not create a public GitHub issue.

Problem:

The Node Hierarchical Keyring doesn't de-dupe concurrent branch-key lookups. If I fire a lot of decrypts for the same branch key at once against a cold cache, they all miss the cache together (it's only filled after the keystore call returns), so each one hits the keystore on its own.

So instead of one lookup I get N DynamoDB GetItem + N KMS Decrypt calls. Easy to repro: await Promise.all of ~3000 decrypts for the same key version, and you see ~3000 keystore calls instead of 1. Encrypt has the same problem since it shares the same code path.

Solution:

Add single-flight to getBranchKeyMaterials: on a miss, the first caller starts the keystore fetch and stores the in-flight promise (keyed by cache entry id); everyone else for the same key awaits that promise instead of starting their own. The entry is dropped once it settles, so the materials cache still owns caching and TTL, and a failed request isn't shared — the next call just retries.

Out of scope:

The legacy caching CMM has the same gap but it's a separate path, so I'm not touching it here.

主要语言
TypeScript
星标
260
派生
68
30 天内没有已合并 PR

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

aws/aws-encryption-sdk-javascript 的其他 Issue

查看 aws/aws-encryption-sdk-javascript 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。