adam-fowler/aws-signer-v4

Generate a signed URL or Request headers for submitting to Amazon Web Services.

AWS Signer

Generate a signed URL or Request headers for submitting to Amazon Web Services. Supply the library with your URL, HTTP method, headers and body and get back a signed URL or signed headers to use in your HTTP Request.

Usage Guide

Create an AWSSigner object. Initialise it with security credentials for accessing Amazon Web Services, the signing name of the service you are using and the AWS region you are working in. You can create a credentials object directly and enter your credentials or get them from the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY using the EnvironmentCredential struct. There are other ways of accessing AWS security credentials but that isn't the purpose of this library. The signing name in general is the same as the service name eg s3, sns, iam but this is not always the case.

The following example code creates a signed URL to access a file in S3.

let credentials = StaticCredential(accessKeyId: "MYACCESSKEY", secretAccessKey: "MYSECRETACCESSKEY")
let signer = AWSSigner(credentials: credentials, name: "s3", region: "us-east-1")
let signedURL = signer.signURL(
                    url: URL(string:"mybucket.s3.us-east-1.amazonaws.com/myfile")!,
                    method: .GET)

Alternatively you can store the authentication details in the request headers. The following returns the headers required to sign a request plus the original headers. The signature is stored in the 'Authorization' header. This request will return a response containing a list of SNS Topics from AWS region us-east-1.

let credentials = StaticCredential(accessKeyId: "MYACCESSKEY", secretAccessKey: "MYSECRETACCESSKEY")
let signer = AWSSigner(credentials: credentials, name: "sns", region: "us-east-1")
let body = "Action=ListTopics&Version=2010-03-31"
let signedHeaders = signer.signHeaders(
                  url: URL(string:"sns.us-east-1.amazonaws.com/")!,
                  method: .GET,
                  headers: ["Content-Type": "application/x-www-form-urlencoded; charset=utf-8"],
                  body: .string(body))

aws-signer-v4's Issues

Signing URLs with explicit ports

Great library, definitely gets the job done for us! We've vendored it and noticed an issue with how this code interacts with URLSession.

When signing a url (e.g., for S3) with a port in it, such as https://s3.amazonaws.com:443/bucket... the signature will be computed with the port. However, when requesting the content of that URL with URLSession (or Data(contentsOf:)), the port is stripped out, and the signature is no longer correct, and AWS returns a 403.

We're currently playing with a few solutions, including stripping the port before signing.

Trailing slash required

Hi,

It's not an issue just maybe something to note in the README in the signHeaders example. If you don't include the trailing slash in the URL, you will get an InvalidSignatureException from AWS. Adding the trailing slash fixes the issue. This was with using POST for DynamoDB.

For anyone curious:

Here is my URL without the trailing slashes

po signingData.unsignedURL
https://dynamodb.us-west-1.amazonaws.com

po signingData.unsignedURL.path
""

As per step 2 in Task 1 of Signing AWS Requests

Add the canonical URI parameter ...

Example Canonical URI with encoding
/documents%2520and%2520settings/

Example Canonical URI
/

So, no trailing slash == 400