v0.40.0
New: AWS Request Signing
The new aws_auth transform re-signs inbound AWS SigV4 requests with real credentials pulled from any registered secret source (env, aws_sm, aws_ssm, 1password, and others). Clients configure their AWS SDK with placeholder credentials and point it at the proxy. The proxy reads the region and service from the inbound credential scope and re-signs with the real ones, so a single config entry covers every AWS service the client talks to. Use allowed_regions and allowed_services to gate which scopes the entry will sign for.
- name: aws_auth
config:
access_key_id: {type: env, var: AWS_ACCESS_KEY_ID}
secret_access_key: {type: env, var: AWS_SECRET_ACCESS_KEY}
# allowed_regions: ["us-east-1", "eu-west-1"] # optional; default allows any region
# allowed_services: ["bedrock", "s3", "dynamodb"] # optional; default allows any service
# unsigned_payload: false
# allow_chunked_body: false
rules:
- host: "*.amazonaws.com"Requires MITM mode. Chunked request bodies are rejected (400) unless allow_chunked_body: true. For streaming uploads or cases where the body must not be buffered (S3 multipart, etc.), set unsigned_payload: true.