s3.go: Added options to use paths with S3 and the ability to disable SSL

physical/s3/s3.go

@@ -72,6 +72,22 @@ func NewS3Backend(conf map[string]string, logger log.Logger) (physical.Backend,
 			}
 		}
 	}
+	s3ForceStylePathStr, ok := conf["s3_force_style_path"]
+	if !ok {
+		s3ForceStylePathStr = "false"
+	}
+	s3ForceStylePathBool, err := strconv.ParseBool(s3ForceStylePathStr)
+	if err != nil {
+		return nil, fmt.Errorf("invalid boolean set for s3_force_style_path: '%s'", s3ForceStylePathStr)
+	}
+	disableSSLStr, ok := conf["disable_ssl"]
+	if !ok {
+		disableSSLStr = "false"
+	}
+	disableSSLBool, err := strconv.ParseBool(disableSSLStr)
+	if err != nil {
+		return nil, fmt.Errorf("invalid boolean set for disable_ssl: '%s'", disableSSLStr)
+	}
 
 	credsConfig := &awsutil.CredentialsConfig{
 		AccessKey:    accessKey,
@@ -91,8 +107,10 @@ func NewS3Backend(conf map[string]string, logger log.Logger) (physical.Backend,
 		HTTPClient: &http.Client{
 			Transport: pooledTransport,
 		},
-		Endpoint: aws.String(endpoint),
-		Region:   aws.String(region),
+		Endpoint:         aws.String(endpoint),
+		Region:           aws.String(region),
+		S3ForcePathStyle: aws.Bool(s3ForceStylePathBool),
+		DisableSSL:       aws.Bool(disableSSLBool),
 	}))
 
 	_, err = s3conn.ListObjects(&s3.ListObjectsInput{Bucket: &bucket})

website/source/docs/configuration/storage/s3.html.md

@@ -58,9 +58,15 @@ cause Vault to attempt to retrieve credentials from the AWS metadata service.
 - `session_token` `(string: "")` – Specifies the AWS session token. This can
   also be provided via the environment variable `AWS_SESSION_TOKEN`.
 
-- `max_parallel` `(string: "128")` – Specifies The maximum number of concurrent
+- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
   requests to S3.
 
+- `s3_force_style_path` `(string: "false")` - Specifies whether to use host
+  bucket style domains with the configured endpoint.
+
+- `disable_ssl` `(string: "false")` - Specifies if SSL should be used for the
+  endpoint connection (highly recommended not to disable for production).
+
 ## `s3` Examples
 
 ### Default Example