Documentation
¶
Overview ¶
Package sigv4 implements AWS Signature Version 4 request signing.
SigV4 is the request-signing scheme used by S3, STS, and every S3-compatible object store (R2, MinIO, B2, etc.). The algorithm and credentials are per-service: the signing math is identical, but credentials issued by one provider only authenticate against that provider's endpoints.
Spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/create-signed-request.html
Index ¶
- Constants
- func DeriveSigningKey(secret, dateStamp, region, service string) []byte
- func HMACSHA256(key, data []byte) []byte
- func SHA256Hex(data []byte) string
- func Sign(req *http.Request, body []byte, region, service string, creds Credentials) error
- func URIEncode(s string, encodeSlash bool) string
- type Credentials
Constants ¶
const ( Algorithm = "AWS4-HMAC-SHA256" // EmptyPayloadSHA is the lowercase-hex SHA-256 of the empty string, used // as the canonical payload hash for requests with no body. EmptyPayloadSHA = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" )
Variables ¶
This section is empty.
Functions ¶
func DeriveSigningKey ¶
DeriveSigningKey returns the SigV4 signing key for the given secret, date (YYYYMMDD), region, and service.
func HMACSHA256 ¶
HMACSHA256 returns HMAC-SHA256(data) keyed with key.
func Sign ¶
Sign signs req in place using SigV4 for the given region and service.
The host is taken from req.Host (falling back to req.URL.Host). The body parameter is hashed for the canonical-payload component; pass nil for empty bodies. X-Amz-Date, X-Amz-Content-Sha256, and Authorization headers are set on the request; X-Amz-Security-Token is set when creds.SessionToken is non-empty.
Headers included in the signed-headers set: host, x-amz-*, content-*. Other headers (Accept-Encoding, User-Agent, etc.) are intentionally excluded so the signature isn't invalidated by middleware that mutates them.
Types ¶
type Credentials ¶
Credentials are static SigV4 credentials. SessionToken is optional and only populated for temporary credentials (STS, IAM Roles Anywhere, etc.).
Source Files