signer

Documentation

Overview

Package signer signs outbound HTTP requests with AWS Signature Version 4.

New constructs a reusable SigV4Signer from a service, region and credentials provider in Config. SigV4Signer.Sign clones request headers and URL and produces a replayable body. It signs locally without sending the request.

Transport and body ownership

Transport adapts a signer to net/http.RoundTripper, while HTTPClient copies an existing HTTP client and disables redirects by default. The downstream transport owns signed bodies after handoff. When signing manually, callers retain the input body and must close both input and signed bodies.

Credentials are retrieved per request; use an AWS credentials cache explicitly when needed. Applications own retries, trusted redirect policy and endpoint selection. ConfigError and SigningError identify configuration and signing failures and preserve underlying errors where applicable.

For usage and compatibility details, see the user guide.

Index

• func HTTPClient(s Signer, client *http.Client) *http.Client
• type Config
• type ConfigError
  • func (e *ConfigError) Error() string
• type SigV4Signer
  • func New(config Config) (*SigV4Signer, error)
  • func (s *SigV4Signer) Sign(request *http.Request) (*http.Request, error)
• type Signer
• type SigningError
  • func (e *SigningError) Error() string
  • func (e *SigningError) Unwrap() error
• type Transport
  • func (t *Transport) RoundTrip(request *http.Request) (*http.Response, error)

Examples

• SigV4Signer.Sign

Functions

func HTTPClient

func HTTPClient(s Signer, client *http.Client) *http.Client

HTTPClient copies a client and installs signing without changing its owner. Redirects are disabled by default to avoid signing an untrusted destination. Supply CheckRedirect explicitly to permit trusted redirects; each is re-signed.

Types

type Config

type Config struct {
	Service     string
	Region      string
	Credentials aws.CredentialsProvider
	Clock       func() time.Time
	// DisableURIPathEscaping is needed for S3's single-escaped path convention.
	DisableURIPathEscaping bool
}

Config controls signing without loading the SDK configuration/provider chain. Credentials are retrieved for every request; use aws.CredentialsCache explicitly when provider caching is desired. Callbacks must be safe for concurrent use.

type ConfigError

type ConfigError struct{ Message string }

ConfigError indicates missing signing configuration or environment credentials.

func (*ConfigError) Error

func (e *ConfigError) Error() string

type SigV4Signer

type SigV4Signer struct {
	// contains filtered or unexported fields
}

SigV4Signer is immutable after construction and safe for concurrent requests.

func New

func New(config Config) (*SigV4Signer, error)

func (*SigV4Signer) Sign

func (s *SigV4Signer) Sign(request *http.Request) (*http.Request, error)

Sign clones headers and URL and returns a request with a replayable body. With GetBody, the input stream is untouched. Otherwise the input body is read and restored; it must not be used concurrently. Callers retain ownership of the input body and must close both requests' bodies when signing standalone. Provider failures and cancellation remain discoverable through errors.Is/As.

Example

package main

import (
	"context"
	"fmt"
	"net/http"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/rambow-cloud/powertools-lambda-go/signer"
)

func main() {
	// Synthetic credentials are only for demonstrating local signing.
	// Production callers supply their application-owned credentials provider.
	s, err := signer.New(signer.Config{
		Service: "execute-api", Region: "ap-east-1",
		Credentials: aws.CredentialsProviderFunc(func(context.Context) (aws.Credentials, error) {
			return aws.Credentials{AccessKeyID: "EXAMPLE", SecretAccessKey: "example-secret"}, nil
		}),
	})
	if err != nil {
		panic(err)
	}
	request, err := http.NewRequest(http.MethodGet, "https://example.com/orders", nil)
	if err != nil {
		panic(err)
	}
	signed, err := s.Sign(request)
	if err != nil {
		panic(err)
	}
	if signed.Body != nil {
		defer signed.Body.Close()
	}
	fmt.Println(signed.Header.Get("Authorization") != "")
	fmt.Println(request.Header.Get("Authorization") == "")
}

Output:
true
true

type Signer

type Signer interface {
	Sign(*http.Request) (*http.Request, error)
}

Signer separates request signing from sending and permits custom algorithms.

type SigningError

type SigningError struct{ Err error }

SigningError preserves the underlying request conversion or signing failure.

func (*SigningError) Error

func (e *SigningError) Error() string

func (*SigningError) Unwrap

func (e *SigningError) Unwrap() error

type Transport

type Transport struct {
	Signer Signer
	Base   http.RoundTripper
}

Transport signs each round trip, including requests followed by http.Client. It performs no retries. Signer and Base must support concurrent calls.

func (*Transport) RoundTrip

func (t *Transport) RoundTrip(request *http.Request) (*http.Response, error)