awsv4signer

README

awsv4signer: aws-sdk-go pluggable request signer

awsv4signer is a fork of the aws-sdk-go v4 signer that allows you to provide your own HMAC hasher. The envisioned use-case for this is to allow you to store your AWS API keys in hardware (a TPM) that supports HMAC operations.

Usage

aws-sdk-go allows you to replace the request signer on a per service basis.

func listBucket(accessKeyID, secretAccessKey, bucket string) {
	s := awsv4signer.Signer{
		AccessKeyID:               accessKeyID,
		SecretAccessKeyHmacSha256: awsv4signer.StaticAccessKeyHmac(secretAccessKey),
	}

	sess := session.New(&aws.Config{
		Region: region,
	})
	svc := s3.New(sess)

	// remove the default v4 signing handler
	svc.Handlers.Sign.RemoveByName(v4.SignRequestHandler.Name)
	// add our signing handler
	svc.Handlers.Sign.PushBack(s.SignSDKRequest)

	resp, err := svc.ListObjects(&s3.ListObjectsInput{
		Bucket: aws.String(bucket),
	})
	if err != nil {
		panic(err)
	}

	for _, obj := range resp.Contents {
		fmt.Printf("%s\n", *obj.Key)
	}
}

The above example can be found in examples/s3ls.

For a working example of storing your secret access key in your TPM, see examples/tpmsigner.

Copyright

Code in internal/awssign is derived from https://github.com/aws/aws-sdk-go. Copyright for that code can be found in NOTICE.txt.

Credits

This work was inspired by the demo @salrashid123's demo in https://github.com/salrashid123/aws_hmac.

Documentation

Index

• func StaticAccessKeyHmac(secretAccessKey string) func() hash.Hash
• type Option
• type Signer
  • func (s *Signer) Presign(r *http.Request, body io.ReadSeeker, service, region string, exp time.Duration, ...) (http.Header, error)
  • func (s *Signer) Sign(r *http.Request, body io.ReadSeeker, service, region string, ...) (http.Header, error)
  • func (s *Signer) SignSDKRequest(req *request.Request)
  • func (s *Signer) SignSDKRequestWithOpts(req *request.Request, opts ...Option)

Functions

func StaticAccessKeyHmac

func StaticAccessKeyHmac(secretAccessKey string) func() hash.Hash

Types

type Option

type Option interface {
	// contains filtered or unexported methods
}

type Signer

type Signer struct {
	AccessKeyID string
	// SecretAccessKeyHmacSha256 should return a new hash.Hash every time it is called.
	// The key for this hmac must be the string: "AWS4"+SecretAccessKey
	// A common implementation will be to return hmac.New() from this function.
	SecretAccessKeyHmacSha256 func() hash.Hash
	SessionToken              string
}

func (*Signer) Presign

func (s *Signer) Presign(r *http.Request, body io.ReadSeeker, service, region string, exp time.Duration, signTime time.Time) (http.Header, error)

func (*Signer) Sign

func (s *Signer) Sign(r *http.Request, body io.ReadSeeker, service, region string, signTime time.Time) (http.Header, error)

func (*Signer) SignSDKRequest

func (s *Signer) SignSDKRequest(req *request.Request)

func (*Signer) SignSDKRequestWithOpts

func (s *Signer) SignSDKRequestWithOpts(req *request.Request, opts ...Option)