aws_runtime/auth/
sigv4a.rs

1/*
2 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 * SPDX-License-Identifier: Apache-2.0
4 */
5
6use crate::auth::{
7    apply_signing_instructions, extract_endpoint_auth_scheme_signing_name,
8    extract_endpoint_auth_scheme_signing_options, SigV4OperationSigningConfig, SigV4SigningError,
9};
10use aws_credential_types::Credentials;
11use aws_sigv4::http_request::{sign, SignableBody, SignableRequest, SigningSettings};
12use aws_sigv4::sign::v4a;
13use aws_smithy_runtime_api::box_error::BoxError;
14use aws_smithy_runtime_api::client::auth::{
15    AuthScheme, AuthSchemeEndpointConfig, AuthSchemeId, Sign,
16};
17use aws_smithy_runtime_api::client::identity::{Identity, SharedIdentityResolver};
18use aws_smithy_runtime_api::client::orchestrator::HttpRequest;
19use aws_smithy_runtime_api::client::runtime_components::{GetIdentityResolver, RuntimeComponents};
20use aws_smithy_types::config_bag::ConfigBag;
21use aws_types::region::{Region, SigningRegionSet};
22use aws_types::SigningName;
23use std::borrow::Cow;
24use std::time::SystemTime;
25
26const EXPIRATION_WARNING: &str = "Presigned request will expire before the given \
27        `expires_in` duration because the credentials used to sign it will expire first.";
28
29/// Auth scheme ID for SigV4a.
30pub const SCHEME_ID: AuthSchemeId = AuthSchemeId::new("sigv4a");
31
32/// SigV4a auth scheme.
33#[derive(Debug, Default)]
34pub struct SigV4aAuthScheme {
35    signer: SigV4aSigner,
36}
37
38impl SigV4aAuthScheme {
39    /// Creates a new `SigV4aHttpAuthScheme`.
40    pub fn new() -> Self {
41        Default::default()
42    }
43}
44
45impl AuthScheme for SigV4aAuthScheme {
46    fn scheme_id(&self) -> AuthSchemeId {
47        SCHEME_ID
48    }
49
50    fn identity_resolver(
51        &self,
52        identity_resolvers: &dyn GetIdentityResolver,
53    ) -> Option<SharedIdentityResolver> {
54        identity_resolvers.identity_resolver(self.scheme_id())
55    }
56
57    fn signer(&self) -> &dyn Sign {
58        &self.signer
59    }
60}
61
62/// SigV4a HTTP request signer.
63#[derive(Debug, Default)]
64#[non_exhaustive]
65pub struct SigV4aSigner;
66
67impl SigV4aSigner {
68    /// Creates a new signer instance.
69    pub fn new() -> Self {
70        Self
71    }
72
73    fn settings(operation_config: &SigV4OperationSigningConfig) -> SigningSettings {
74        super::settings(operation_config)
75    }
76
77    fn signing_params<'a>(
78        settings: SigningSettings,
79        identity: &'a Identity,
80        operation_config: &'a SigV4OperationSigningConfig,
81        request_timestamp: SystemTime,
82    ) -> Result<v4a::SigningParams<'a, SigningSettings>, SigV4SigningError> {
83        if let Some(expires_in) = settings.expires_in {
84            if let Some(identity_expiration) = identity.expiration() {
85                let presigned_expires_time = request_timestamp + expires_in;
86                if presigned_expires_time > identity_expiration {
87                    tracing::warn!(EXPIRATION_WARNING);
88                }
89            }
90        }
91
92        Ok(v4a::SigningParams::builder()
93            .identity(identity)
94            .region_set(
95                operation_config
96                    .region_set
97                    .as_ref()
98                    .ok_or(SigV4SigningError::MissingSigningRegionSet)?
99                    .as_ref(),
100            )
101            .name(
102                operation_config
103                    .name
104                    .as_ref()
105                    .ok_or(SigV4SigningError::MissingSigningName)?
106                    .as_ref(),
107            )
108            .time(request_timestamp)
109            .settings(settings)
110            .build()
111            .expect("all required fields set"))
112    }
113
114    fn extract_operation_config<'a>(
115        auth_scheme_endpoint_config: AuthSchemeEndpointConfig<'a>,
116        config_bag: &'a ConfigBag,
117    ) -> Result<Cow<'a, SigV4OperationSigningConfig>, SigV4SigningError> {
118        let operation_config = config_bag
119            .load::<SigV4OperationSigningConfig>()
120            .ok_or(SigV4SigningError::MissingOperationSigningConfig)?;
121
122        let name = extract_endpoint_auth_scheme_signing_name(&auth_scheme_endpoint_config)?
123            .or(config_bag.load::<SigningName>().cloned());
124
125        let region_set = config_bag
126            .load::<SigningRegionSet>()
127            .cloned()
128            .or(extract_endpoint_auth_scheme_signing_region_set(
129                &auth_scheme_endpoint_config,
130            )?)
131            .or(config_bag
132                .load::<Region>()
133                .cloned()
134                .map(SigningRegionSet::from));
135
136        let signing_options = extract_endpoint_auth_scheme_signing_options(
137            &auth_scheme_endpoint_config,
138            &operation_config.signing_options,
139        )?;
140
141        match (region_set, name, signing_options) {
142            (None, None, Cow::Borrowed(_)) => Ok(Cow::Borrowed(operation_config)),
143            (region_set, name, signing_options) => {
144                let mut operation_config = operation_config.clone();
145                operation_config.region_set = region_set.or(operation_config.region_set);
146                operation_config.name = name.or(operation_config.name);
147                operation_config.signing_options = match signing_options {
148                    Cow::Owned(opts) => opts,
149                    Cow::Borrowed(_) => operation_config.signing_options,
150                };
151                Ok(Cow::Owned(operation_config))
152            }
153        }
154    }
155}
156
157fn extract_endpoint_auth_scheme_signing_region_set(
158    endpoint_config: &AuthSchemeEndpointConfig<'_>,
159) -> Result<Option<SigningRegionSet>, SigV4SigningError> {
160    use aws_smithy_types::Document::Array;
161    use SigV4SigningError::BadTypeInEndpointAuthSchemeConfig as UnexpectedType;
162
163    match super::extract_field_from_endpoint_config("signingRegionSet", endpoint_config) {
164        Some(Array(docs)) => {
165            // The service defines the region set as a string array. Here, we convert it to a comma separated list.
166            let region_set: SigningRegionSet =
167                docs.iter().filter_map(|doc| doc.as_string()).collect();
168
169            Ok(Some(region_set))
170        }
171        None => Ok(None),
172        _it => Err(UnexpectedType("signingRegionSet")),
173    }
174}
175
176impl Sign for SigV4aSigner {
177    fn sign_http_request(
178        &self,
179        request: &mut HttpRequest,
180        identity: &Identity,
181        auth_scheme_endpoint_config: AuthSchemeEndpointConfig<'_>,
182        runtime_components: &RuntimeComponents,
183        config_bag: &ConfigBag,
184    ) -> Result<(), BoxError> {
185        let operation_config =
186            Self::extract_operation_config(auth_scheme_endpoint_config, config_bag)?;
187        let request_time = runtime_components.time_source().unwrap_or_default().now();
188
189        if identity.data::<Credentials>().is_none() {
190            return Err(SigV4SigningError::WrongIdentityType(identity.clone()).into());
191        }
192
193        let settings = Self::settings(&operation_config);
194        let signing_params =
195            Self::signing_params(settings, identity, &operation_config, request_time)?;
196
197        let (signing_instructions, _signature) = {
198            // A body that is already in memory can be signed directly. A body that is not in memory
199            // (any sort of streaming body or presigned request) will be signed via UNSIGNED-PAYLOAD.
200            let signable_body = operation_config
201                .signing_options
202                .payload_override
203                .as_ref()
204                // the payload_override is a cheap clone because it contains either a
205                // reference or a short checksum (we're not cloning the entire body)
206                .cloned()
207                .unwrap_or_else(|| {
208                    request
209                        .body()
210                        .bytes()
211                        .map(SignableBody::Bytes)
212                        .unwrap_or(SignableBody::UnsignedPayload)
213                });
214
215            let signable_request = SignableRequest::new(
216                request.method(),
217                request.uri().to_string(),
218                request.headers().iter(),
219                signable_body,
220            )?;
221            sign(signable_request, &signing_params.into())?
222        }
223        .into_parts();
224
225        apply_signing_instructions(signing_instructions, request)?;
226        Ok(())
227    }
228}
229
230#[cfg(test)]
231mod tests {
232    use super::{SigV4OperationSigningConfig, SigV4aSigner, EXPIRATION_WARNING};
233    use crate::auth::{HttpSignatureType, SigningOptions};
234    use aws_credential_types::Credentials;
235    use aws_sigv4::http_request::SigningSettings;
236    use aws_smithy_runtime_api::client::auth::AuthSchemeEndpointConfig;
237    use aws_smithy_types::config_bag::{ConfigBag, Layer};
238    use aws_smithy_types::Document;
239    use aws_types::region::{Region, SigningRegionSet};
240    use aws_types::SigningName;
241    use std::borrow::Cow;
242    use std::collections::HashMap;
243    use std::time::{Duration, SystemTime};
244    use tracing_test::traced_test;
245
246    #[test]
247    #[traced_test]
248    fn expiration_warning() {
249        let now = SystemTime::UNIX_EPOCH + Duration::from_secs(1000);
250        let creds_expire_in = Duration::from_secs(100);
251
252        let mut settings = SigningSettings::default();
253        settings.expires_in = Some(creds_expire_in - Duration::from_secs(10));
254
255        let identity = Credentials::new(
256            "test-access-key",
257            "test-secret-key",
258            Some("test-session-token".into()),
259            Some(now + creds_expire_in),
260            "test",
261        )
262        .into();
263        let operation_config = SigV4OperationSigningConfig {
264            region_set: Some("test".into()),
265            name: Some(SigningName::from_static("test")),
266            signing_options: SigningOptions {
267                double_uri_encode: true,
268                content_sha256_header: true,
269                normalize_uri_path: true,
270                omit_session_token: true,
271                signature_type: HttpSignatureType::HttpRequestHeaders,
272                signing_optional: false,
273                expires_in: None,
274                payload_override: None,
275            },
276            ..Default::default()
277        };
278        SigV4aSigner::signing_params(settings, &identity, &operation_config, now).unwrap();
279        assert!(!logs_contain(EXPIRATION_WARNING));
280
281        let mut settings = SigningSettings::default();
282        settings.expires_in = Some(creds_expire_in + Duration::from_secs(10));
283
284        SigV4aSigner::signing_params(settings, &identity, &operation_config, now).unwrap();
285        assert!(logs_contain(EXPIRATION_WARNING));
286    }
287
288    #[test]
289    fn endpoint_config_overrides_region_and_service() {
290        let mut layer = Layer::new("test");
291        layer.store_put(SigV4OperationSigningConfig {
292            region_set: Some("test".into()),
293            name: Some(SigningName::from_static("override-this-service")),
294            ..Default::default()
295        });
296        let config = Document::Object({
297            let mut out = HashMap::new();
298            out.insert("name".to_owned(), "sigv4a".to_owned().into());
299            out.insert("signingName".to_owned(), "qldb-override".to_owned().into());
300            out.insert(
301                "signingRegionSet".to_string(),
302                Document::Array(vec!["us-east-override".to_string().into()]),
303            );
304            out
305        });
306        let config = AuthSchemeEndpointConfig::from(Some(&config));
307
308        let cfg = ConfigBag::of_layers(vec![layer]);
309        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
310
311        assert_eq!(result.region_set, Some("us-east-override".into()));
312        assert_eq!(result.name, Some(SigningName::from_static("qldb-override")));
313        assert!(matches!(result, Cow::Owned(_)));
314    }
315
316    #[test]
317    fn endpoint_config_supports_fallback_when_region_or_service_are_unset() {
318        let mut layer = Layer::new("test");
319        layer.store_put(SigV4OperationSigningConfig {
320            region_set: Some("us-east-1".into()),
321            name: Some(SigningName::from_static("qldb")),
322            ..Default::default()
323        });
324        let cfg = ConfigBag::of_layers(vec![layer]);
325        let config = AuthSchemeEndpointConfig::empty();
326
327        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
328
329        assert_eq!(result.region_set, Some("us-east-1".into()));
330        assert_eq!(result.name, Some(SigningName::from_static("qldb")));
331        assert!(matches!(result, Cow::Borrowed(_)));
332    }
333
334    #[test]
335    fn user_config_wins_over_endpoint_rules() {
336        let mut layer = Layer::new("test");
337        layer.store_put(SigV4OperationSigningConfig::default());
338        layer.store_put(SigningRegionSet::from("*"));
339        let config = Document::Object({
340            let mut out = HashMap::new();
341            out.insert("name".to_owned(), "sigv4a".to_owned().into());
342            out.insert(
343                "signingRegionSet".to_string(),
344                Document::Array(vec!["us-west-2".to_string().into()]),
345            );
346            out
347        });
348        let config = AuthSchemeEndpointConfig::from(Some(&config));
349
350        let cfg = ConfigBag::of_layers(vec![layer]);
351        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
352
353        assert_eq!(result.region_set, Some("*".into()));
354    }
355
356    #[test]
357    fn endpoint_rules_used_when_no_user_config() {
358        let mut layer = Layer::new("test");
359        layer.store_put(SigV4OperationSigningConfig::default());
360        let config = Document::Object({
361            let mut out = HashMap::new();
362            out.insert("name".to_owned(), "sigv4a".to_owned().into());
363            out.insert(
364                "signingRegionSet".to_string(),
365                Document::Array(vec!["*".to_string().into()]),
366            );
367            out
368        });
369        let config = AuthSchemeEndpointConfig::from(Some(&config));
370
371        let cfg = ConfigBag::of_layers(vec![layer]);
372        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
373
374        assert_eq!(result.region_set, Some("*".into()));
375    }
376
377    #[test]
378    fn falls_back_to_client_region_when_nothing_configured() {
379        let mut layer = Layer::new("test");
380        layer.store_put(SigV4OperationSigningConfig::default());
381        layer.store_put(Region::new("us-west-2"));
382        let config = AuthSchemeEndpointConfig::empty();
383
384        let cfg = ConfigBag::of_layers(vec![layer]);
385        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
386
387        assert_eq!(result.region_set, Some("us-west-2".into()));
388    }
389
390    #[test]
391    fn endpoint_rules_win_over_client_region_when_no_user_config() {
392        let mut layer = Layer::new("test");
393        layer.store_put(SigV4OperationSigningConfig::default());
394        layer.store_put(Region::new("us-west-2"));
395        let config = Document::Object({
396            let mut out = HashMap::new();
397            out.insert("name".to_owned(), "sigv4a".to_owned().into());
398            out.insert(
399                "signingRegionSet".to_string(),
400                Document::Array(vec!["*".to_string().into()]),
401            );
402            out
403        });
404        let config = AuthSchemeEndpointConfig::from(Some(&config));
405
406        let cfg = ConfigBag::of_layers(vec![layer]);
407        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
408
409        assert_eq!(result.region_set, Some("*".into()));
410    }
411
412    #[test]
413    fn user_config_wins_over_both_endpoint_and_region() {
414        let mut layer = Layer::new("test");
415        layer.store_put(SigV4OperationSigningConfig::default());
416        layer.store_put(SigningRegionSet::from("eu-west-1"));
417        layer.store_put(Region::new("us-west-2"));
418        let config = Document::Object({
419            let mut out = HashMap::new();
420            out.insert("name".to_owned(), "sigv4a".to_owned().into());
421            out.insert(
422                "signingRegionSet".to_string(),
423                Document::Array(vec!["*".to_string().into()]),
424            );
425            out
426        });
427        let config = AuthSchemeEndpointConfig::from(Some(&config));
428
429        let cfg = ConfigBag::of_layers(vec![layer]);
430        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
431
432        assert_eq!(result.region_set, Some("eu-west-1".into()));
433    }
434
435    #[test]
436    fn region_set_is_none_when_nothing_is_configured() {
437        let mut layer = Layer::new("test");
438        layer.store_put(SigV4OperationSigningConfig::default());
439        let config = AuthSchemeEndpointConfig::empty();
440
441        let cfg = ConfigBag::of_layers(vec![layer]);
442        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
443
444        assert_eq!(result.region_set, None);
445    }
446
447    #[test]
448    fn multi_region_endpoint_rules_preserved() {
449        let mut layer = Layer::new("test");
450        layer.store_put(SigV4OperationSigningConfig::default());
451        let config = Document::Object({
452            let mut out = HashMap::new();
453            out.insert("name".to_owned(), "sigv4a".to_owned().into());
454            out.insert(
455                "signingRegionSet".to_string(),
456                Document::Array(vec![
457                    "us-east-1".to_string().into(),
458                    "eu-west-1".to_string().into(),
459                ]),
460            );
461            out
462        });
463        let config = AuthSchemeEndpointConfig::from(Some(&config));
464
465        let cfg = ConfigBag::of_layers(vec![layer]);
466        let result = SigV4aSigner::extract_operation_config(config, &cfg).expect("success");
467
468        assert_eq!(result.region_set, Some("us-east-1,eu-west-1".into()));
469    }
470}
aws_runtime/auth/sigv4a.rs

aws_runtime/auth/
sigv4a.rs
