Drop AWS SDK for Go v1 and upgrade to v2 before EOL/end-of-support at July 31, 2025 / fix CVE-2020-8911 + CVE-2020-8912 - Alloy

[rgoltz]

Request

Currently Alloy using GO dependencies and libraries, which are using/reference the version 1 of the AWS SDK for Go (github.com/aws/aws-sdk-go). AWS as maintainer of this AWS SDK for Go package announced the EOL of the version 1 for July 31, 2025. After this date, there are no critical bug fixes and no security issues provided. For details: https://aws.amazon.com/blogs/developer/announcing-end-of-support-for-aws-sdk-for-go-v1-on-july-31-2025/

It’s recommended to migrate to AWS SDK for Go v2 - https://github.com/aws/aws-sdk-go-v2/
Since Alloy is still indirectly using the EOL-version of AWS SDK for Go v1, it’s also affected be at least two security issues (which will never be fixed in version 1 codestream):

• CVE-2020-8911: A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket.

• CVE-2020-8912: A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR.

Use case

I’d like to start the joint discussion for a step-by-step investigation and upgrade to AWS SDK for Go v2 for Alloy. I’m aware that is not an easy step. Furthermore, some dependency already using v2. It’s more like a "progress-tracking and discussion-ticket". I assume in some cases, it’s a update of a dependency, in other cases, it might be necessary to address this v1 to v2 upgrade to other package maintainers - See lists below!

In order to get an overview of the "areas" of affected Go dependencies for , I’ve used deptree to identify github.com/aws/aws-sdk-go references (in total 28x times based on main from 09.03.2025):

github.com/grafana/alloy (go1.23.5)
…
 ├── <529> github.com/aws/[email protected] (go1.19)
 │    └── github.com/jmespath/[email protected] (go1.14), see <178> for 1 children (branch 'github.com/grafana/alloy' level 1)
…
 ├── <308> github.com/go-kit/[email protected] (go1.17)
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/google/[email protected] (go1.21) => [v0.52.1]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/grafana/beyla/[email protected] (go1.23.0) => [v2.0.5]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/grafana/[email protected] (go1.21) => [v0.0.0-20250306142006-a53bcf294bdf]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/grafana/loki/[email protected] (go1.21.8)
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/hashicorp/[email protected] (go1.17) => [v0.0.0-20250129070739-0302a330aaa0]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <383> github.com/hashicorp/go-secure-stdlib/[email protected] (go1.16) => [v0.3.0]
 │    ├── <382> github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/hashicorp/vault/api/auth/[email protected] (go1.16) => [v0.9.0]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19), see <382> for 1 children (branch 'github.com/hashicorp/go-secure-stdlib/[email protected]' level 2)
…
 ├── <329> github.com/heroku/[email protected] (go1.17) => [v0.4.3]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <323> github.com/influxdata/[email protected] (go1.15) => [v1.33.3]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <588> github.com/jaegertracing/[email protected] (go1.22.7) => [v1.67.0]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <627> github.com/mongodb/[email protected] (go1.21) => [v0.0.0-20250307203412-7e5349ef2bba]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/nerdswords/[email protected] (go1.22.0) => [v0.62.1]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/open-telemetry/opentelemetry-collector-contrib/exporter/[email protected] (go1.22.0) => [v0.121.0]
 │    ├── github.com/aws/[email protected] (go1.19), see <529> for 1 children (branch 'github.com/grafana/alloy' level 1)
…
 ├── <614> github.com/open-telemetry/opentelemetry-collector-contrib/exporter/[email protected] (go1.22.7) => [v0.121.0]
 │    ├── github.com/aws/[email protected] (go1.19), see <529> for 1 children (branch 'github.com/grafana/alloy' level 1)
…
 ├── github.com/open-telemetry/opentelemetry-collector-contrib/exporter/[email protected] (go1.22.0) => [v0.121.0]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <589> github.com/open-telemetry/opentelemetry-collector-contrib/internal/[email protected] (go1.22.0) => [v0.121.0]
 │    ├── github.com/aws/[email protected] (go1.19), see <529> for 1 children (branch 'github.com/grafana/alloy' level 1)
…
 ├── <536> github.com/open-telemetry/opentelemetry-collector-contrib/processor/[email protected] (go1.22.0) => [v0.121.0]
 │    ├── github.com/aws/[email protected] (go1.19), see <529> for 1 children (branch 'github.com/grafana/alloy' level 1)
…
 ├── github.com/open-telemetry/opentelemetry-collector-contrib/receiver/[email protected] (go1.22.0) => [v0.121.0]
 │    ├── github.com/aws/[email protected] (go1.19), see <529> for 1 children (branch 'github.com/grafana/alloy' level 1)
…
 ├── github.com/open-telemetry/opentelemetry-collector-contrib/receiver/[email protected] (go1.22.7) => [v0.121.0]
 │    ├── github.com/aws/[email protected] (go1.19), see <529> for 1 children (branch 'github.com/grafana/alloy' level 1)
…
 ├── github.com/percona/[email protected] (go1.23)
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <625> github.com/percona/[email protected] (go1.22)
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── github.com/prometheus-operator/[email protected] (go1.20) => [v0.80.1]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <331> github.com/prometheus/[email protected] (go1.21) => [v0.28.1]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <332> github.com/prometheus/common/[email protected] (go1.15)
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <360> github.com/prometheus/[email protected] (go1.22.0) => [v1.99.0]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)
…
 ├── <275> go.opentelemetry.io/contrib/detectors/aws/[email protected] (go1.21) => [v1.35.0]
 │    ├── github.com/aws/[email protected] => [v1.55.6] (go1.19)

Issues/project with v1 reference in go.mod files (+ currently open issues, so there is no update of this module in Alloy possible yet):

• Drop AWS SDK for Go v1 and upgrade to v2 before EOL/end-of-support at July 31, 2025 - Heroku X heroku/x#234
• [receiver/awsecscontainermetrics] migrate to AWS v2 SDK open-telemetry/opentelemetry-collector-contrib#38479
• Migrate AWS discovery code to a new AWS SDK prometheus/prometheus#15572
• Migrate AWS code to a new AWS SDK v2 before end-of-support / EOL on July 31, 2025 prometheus/alertmanager#4255
• Switch to AWS SDK v2 before v1 is end-of-support/EOL on July 31, 2025 - Hashicorp Vault hashicorp/vault#29884
• Awareness for end-of-support/EOL of AWS SDK v1 in indirect-require deps (update ref/switch to v2 before July 31, 2025) percona/mongodb_exporter#1043
• [Feature]: Upgrade deps to AWS SDK for Go v2 before EOL/end-of-support at July 31, 2025 jaegertracing/jaeger#6742
• Awareness for end-of-support/EOL of AWS SDK v1 in indirect-require deps (update ref/switch to v2 before July 31, 2025) prometheus-operator/prometheus-operator#7390
• Awareness for end-of-support/EOL of AWS SDK v1 in indirect-require deps (update ref/switch to v2 before July 31, 2025) beyla#1727
• Loki - Upgrade deps with github.com/aws/aws-sdk-go (v1) before end-of-support July 31, 2025 / fix CVE-2020-8911 + CVE-2020-8912 loki#16309
• Switch to AWS SDK v2 before v1 is end-of-support/EOL on July 31, 2025 - Grafana Dskit dskit#663
• https://jira.mongodb.org/browse/TOOLS-3783 (for github.com/mongodb/mongo-tools)

Updated go.mod files found - There should be a update for package (via PR):

• github.com/go-kit/kit / Drop AWS SDK for Go v1 and upgrade to v2 before EOL/end-of-support at July 31, 2025 go-kit/kit#1303
• github.com/hashicorp/go-discover
• github.com/influxdata/telegraf
• github.com/nerdswords/yet-another-cloudwatch-exporter // github.com/prometheus-community/yet-another-cloudwatch-exporter
• github.com/hashicorp/go-secure-stdlib/awsutil
• github.com/percona/percona-backup-mongodb