Sign API GW requests

[mbergkvist]

I have an API GW with IAM authorization on the endpoints. How can I use this SDK to sign the request?

[rcoh]

this is an open design area. Do you mind sharing a bit more about your situation? (eg. what libraries are you using, etc.). Currently there is a standalone signer available here: https://awslabs.github.io/aws-sdk-rust/aws_sig_auth/signer/struct.SigV4Signer.html#method.sign

However, depending on how your stack is set up, it might be hard to use.

[mbergkvist]

I'm afraid I can't be of much help there...

[mbergkvist]

@rcoh Any updates on this?

[Velfi]

Hey @mbergkvist, you're in luck! I was recently looking at what it would take to support using async-std/surf/http_types in place of our current default of tokio/hyper/http and it turns out that's really tough and requires a lot of conversions. Your case is much easier because reqwest already works with tokio and http.

The code from my previous investigation can be seen here.

As I understand it, all you need is a way to convert the http::Request<SdkBody> into a reqwest::Request<reqwest::Body> right?
In that case, here's how you can do that:

// In your Cargo.toml
// [dependencies]
// aws-config = "0.47.0"
// aws-sig-auth = "0.47.0"
// aws-smithy-http = "0.47.0"
// aws-types = "0.47.0"
// http = "0.2.8"
// reqwest = { version = "0.11.11", features = ["stream"] }
// tokio = { version = "1.20.1", features = ["full"] }

use aws_config::default_provider::credentials::DefaultCredentialsChain;
use aws_sig_auth::signer::{OperationSigningConfig, RequestConfig, SigV4Signer};
use aws_smithy_http::body::SdkBody;
use aws_smithy_http::byte_stream::ByteStream;
use aws_types::credentials::ProvideCredentials;
use aws_types::region::{Region, SigningRegion};
use aws_types::SigningService;
use std::error::Error;
use std::time::SystemTime;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let sdk_body = SdkBody::from("Your request body");
    let mut sdk_req = http::Request::builder()
        .method("POST")
        .uri("https://example.com")
        .header("key", "value")
        .body(sdk_body)
        .expect("request is valid");

    let region = Region::from_static("us-east-1");
    let credentials_provider = DefaultCredentialsChain::builder()
        .region(region.clone())
        .build()
        .await;

    sign_request(&mut sdk_req, region, &credentials_provider)
        .await
        .expect("signing will succeed");

    let client = reqwest::Client::new();
    let req = convert_req(&client, sdk_req);
    let _res = client.execute(req).await?;

    Ok(())
}

async fn sign_request(
    mut request: &mut http::Request<SdkBody>,
    region: Region,
    credentials_provider: &impl ProvideCredentials,
) -> Result<(), Box<dyn Error + Send + Sync>> {
    let now = SystemTime::now();
    let signer = SigV4Signer::new();
    let request_config = RequestConfig {
        request_ts: now,
        region: &SigningRegion::from(region),
        service: &SigningService::from_static("execute-api"),
        payload_override: None,
    };
    signer.sign(
        &OperationSigningConfig::default_config(),
        &request_config,
        &credentials_provider.provide_credentials().await?,
        &mut request,
    )?;
    Ok(())
}

fn convert_req(client: &reqwest::Client, req: http::Request<SdkBody>) -> reqwest::Request {
    let (head, body) = req.into_parts();
    let url = head.uri.to_string();

    let body = {
        // `SdkBody` doesn't currently impl stream but we can wrap
        // it in a `ByteStream` and then we're good to go.
        let stream = ByteStream::new(body);
        // Requires `reqwest` crate feature "stream"
        reqwest::Body::wrap_stream(stream)
    };

    client
        .request(head.method, url)
        .headers(head.headers)
        .version(head.version)
        .body(body)
        .build()
        .expect("request is valid")
}

Disclaimer: I've compiled this code but I haven't run it. Still, I'm 98% confident it'll work

[mbergkvist]

Hi @Velfi Thanks for the sample code. Finally, we got around to try this, and indeed, it does work 😀

[rlbrillband]

Thanks for this! I've been struggling with manually signing requests for the selling partner API and just found this which looks like exactly what I needed. My code uses reqwest (this is flexible if really necessary) so appreciate the snippet to convert for that. Was just wondering if there were any updates on this I should be aware of?

I am not overall familiar with the AWS Rust ecosystem, but I also noticed this comment on the sign function:

Although this function may be used, end users will not typically interact with this code. It is generally used via middleware in the request pipeline.

This implies that there may be some other libraries which could further simplify the process for me?

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.