View Source aws_signature (aws_signature v0.3.0)

This module contains functions for signing requests to AWS services.

Link to this section Summary

Link to this section Types

Specs

header() :: {binary(), binary()}.

Specs

headers() :: [header()].

Specs

query_param() :: {binary(), binary()}.

Specs

query_params() :: [query_param()].

Link to this section Functions

Link to this function

sign_v4(AccessKeyID, SecretAccessKey, Region, Service, DateTime, Method, URL, Headers, Body)

View Source
Same as sign_v4/10 with no options.
Link to this function

sign_v4(AccessKeyID, SecretAccessKey, Region, Service, DateTime, Method, URL, Headers, Body, Options)

View Source

Specs

sign_v4(AccessKeyID, SecretAccessKey, Region, Service, DateTime, Method, URL, Headers, Body,
        Options) ->
           FinalHeaders
           when
               AccessKeyID :: binary(),
               SecretAccessKey :: binary(),
               Region :: binary(),
               Service :: binary(),
               DateTime :: calendar:datetime(),
               Method :: binary(),
               URL :: binary(),
               Headers :: headers(),
               Body :: binary(),
               Options :: [Option],
               Option :: {uri_encode_path, boolean()},
               FinalHeaders :: headers().

Implements the Signature Version 4 (SigV4) algorithm.

This function takes AWS client credentials and request details, based on which it computes the signature and returns headers extended with the authorization entries.

DateTime is a datetime tuple used as the request date. You most likely want to set it to the value of calendar:universal_time() when making the request.

URL must be valid, with all components properly escaped. For example, "https://example.com/path%20to" is valid, whereas "https://example.com/path to" is not.

It is essential that the provided request details are final and the returned headers are used to make the request. All custom headers need to be assembled before the signature is calculated.

The signature is computed by normalizing request details into a well defined format and combining it with the credentials using a number of cryptographic functions. Upon receiving a request, the server calculates the signature using the same algorithm and compares it with the value received in headers. For more details check out the AWS documentation.

The following options are supported:

uri_encode_path
When true, the request URI path is URI-encoded during request canonicalization, which is required for every service except S3. Note that the given URL should already be properly encoded, so this results in each segment being URI-encoded twice, as expected by AWS. Defaults to true.
Link to this function

sign_v4_query_params(AccessKeyID, SecretAccessKey, Region, Service, DateTime, Method, URL)

View Source
Same as sign_v4_query_params/7 with no options.
Link to this function

sign_v4_query_params(AccessKeyID, SecretAccessKey, Region, Service, DateTime, Method, URL, Options)

View Source

Specs

sign_v4_query_params(AccessKeyID, SecretAccessKey, Region, Service, DateTime, Method, URL,
                     Options) ->
                        FinalURL
                        when
                            AccessKeyID :: binary(),
                            SecretAccessKey :: binary(),
                            Region :: binary(),
                            Service :: binary(),
                            DateTime :: calendar:datetime(),
                            Method :: binary(),
                            URL :: binary(),
                            Options :: [Option],
                            Option ::
                                {uri_encode_path, boolean()} |
                                {session_token, binary()} |
                                {ttl, non_neg_integer()} |
                                {body, binary()} |
                                {body_digest, binary()},
                            FinalURL :: binary().

Implements the Signature Version 4 (SigV4) algorithm for query parameters.

This function takes AWS client credentials and request details, based on which it computes the signature and returns the URL extended with the signature entries. Note that anchors are ignored in the resulting URL.

DateTime is a datetime tuple used as the request date. You most likely want to set it to the value of calendar:universal_time() when making the request.

URL must be valid, with all components properly escaped. For example, "https://example.com/path%20to" is valid, whereas "https://example.com/path to" is not.

It is essential that the provided request details are final and the returned query params are used to make the request with the provided URL.

The signature is computed by normalizing request details into a well defined format and combining it with the credentials using a number of cryptographic functions. Upon receiving a request, the server calculates the signature using the same algorithm and compares it with the value received in headers. For more details check out the AWS documentation.

The following options are supported:

ttl
Time-to-live value that tells how long this URL is valid in seconds. Defaults to 86400, which means one day.
uri_encode_path
When true, the request URI path is URI-encoded during request canonicalization, which is required for every service except S3. Note that the given URL should already be properly encoded, so this results in each segment being URI-encoded twice, as expected by AWS. Defaults to true.
session_token
Optional credential parameter if using credentials sourced from the STS service.
body
Request body to compute SHA256 digest for. Defaults to an empty binary. Note that body_digest always takes precedence when set.
body_digest
Optional SHA256 digest of the request body. This option can be used to provide a fixed digest value, such as "UNSIGNED-PAYLOAD", when sending requests without signing the body, which is expected for S3.