Documentation
¶
Overview ¶
Package awssig signs AWS Signature Version 4 requests without an SDK dependency.
Index ¶
- Variables
- func CanonicalQuery(u *url.URL) (string, error)
- func Presign(req *http.Request, creds Credentials, region, service string, ...) (string, error)
- func SHA256Hex(body []byte) string
- func Sign(req *http.Request, body []byte, creds Credentials, region, service string, ...) error
- type Credentials
Constants ¶
This section is empty.
Variables ¶
var ErrNoCredentials = errors.New("aws: no credentials")
ErrNoCredentials means a request cannot be signed because a key pair is absent.
Functions ¶
func CanonicalQuery ¶
CanonicalQuery renders a query exactly as AWS's signer does.
func Presign ¶
func Presign( req *http.Request, creds Credentials, region, service string, expires time.Duration, now time.Time, ) (string, error)
Presign puts the whole signature in the query string, so a URL alone is the credential.
A DIFFERENT SIGNATURE FROM Sign, NOT A REARRANGEMENT OF ONE. The six X-Amz-* parameters are part of the canonical request rather than headers, the payload hash is the literal UNSIGNED-PAYLOAD rather than a digest, and only Host is signed -- a presigned URL is fetched by something billet does not control and cannot make send a particular header.
EXPIRY IS THE ONLY THING BOUNDING IT. Anyone holding the URL can fetch the object until it lapses, so callers pass the shortest window that covers the fetch and stage nothing behind one that a longer secret would protect.
func Sign ¶
func Sign( req *http.Request, body []byte, creds Credentials, region, service string, now time.Time, ) error
Sign adds SigV4 headers for one AWS service and region.
Its output is exercised by the EC2 package's vector generated with AWS's own signer. Keeping services on this one implementation prevents a second reading of the signing specification from becoming a second security boundary.
Types ¶
type Credentials ¶
Credentials are the material SigV4 needs. Every rendering path redacts secrets.
func (Credentials) Format ¶
func (c Credentials) Format(f fmt.State, _ rune)
Format catches every fmt verb.
func (Credentials) LogValue ¶
func (c Credentials) LogValue() slog.Value
LogValue is the slog-safe rendering.
func (Credentials) MarshalJSON ¶
func (c Credentials) MarshalJSON() ([]byte, error)
MarshalJSON prevents structural serializers from exposing the secret fields.
func (Credentials) String ¶
func (c Credentials) String() string
String renders only the diagnostic key identifier.
Source Files