how to signV4 a request

[ymwjbxxq]

Hello all,

if I use your example:

let identity = Credentials::new(
    "AKIDEXAMPLE",
    "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
    None,
    None,
    "hardcoded-credentials"
).into();
let signing_settings = SigningSettings::default();
let signing_params = v4::SigningParams::builder()
    .identity(&identity)
    .region("us-east-1")
    .name("exampleservice")
    .time(SystemTime::now())
    .settings(signing_settings)
    .build()
    .unwrap()
    .into();
// Convert the HTTP request into a signable request
let signable_request = SignableRequest::new(
    "GET",
    "https://some-endpoint.some-region.amazonaws.com",
    std::iter::empty(),
    SignableBody::Bytes(&[])
).expect("signable request");
let mut my_req = http::Request::new("...");
// Sign and then apply the signature to the request
let (signing_instructions, _signature) = sign(signable_request, &signing_params)?.into_parts();
signing_instructions.apply_to_request_http0x(&mut my_req);

This line:
signing_instructions.apply_to_request_http0x(&mut my_req);

It is not a compatible type, and the compiler points the finger at HTTP lib.

Would you happen to have a working example somewhere?

Thanks

[rcoh]

this is example is compiled as part of tests—what version of http are you using? Note that this method explicitly works on http 0.2. (Note the method name)

[ymwjbxxq]

Ah ok, because latest is http = "1.0.0"

[ymwjbxxq]

if you see the official example
https://docs.rs/aws-sigv4/1.1.2/aws_sigv4/http_request/index.html
there is the part of the credential

let identity = Credentials::new(
    "AKIDEXAMPLE",
    "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
    None,
    None,
    "hardcoded-credentials"
).into();

I am inside a Lambda, so I have an IAM Role and for sure no accesskey and secretkeuy but all the example are with

    /// let creds = Credentials::from_keys("akid", "secret_key", None);
    /// let config = Config::builder()
    ///     .credentials_provider(creds)
    ///     .build();

could you point me to a working example?

[rcoh]

You should create a credential provider with the default chain and load credentials. I should probably double check that manually signing a request is actually required though, it isn't for most use cases. What are you using it for?

[ymwjbxxq]

Connecting to Amazon OpenSearch

I wi try and let you know

[ymwjbxxq]

Hello @rcoh

this is the full code

let now = SystemTime::now();
        let body_array = body.to_string().into_bytes();

        let signing_settings = SigningSettings::default();
        let identity = DefaultCredentialsChain::builder().build()
            .await;

        let signing_params = v4::SigningParams::builder()
            .identity(identity)
            .region(&self.region)
            .name("es")
            .time(now)
            .settings(signing_settings)
            .build()
            .unwrap()
            .into();

        let signable_request = SignableRequest::new(
            "GET",
            uri,
            std::iter::empty(),
            SignableBody::Bytes(&body_array),
        )
        .expect("signable request");

        // Sign and then apply the signature to the request
        let (signing_instructions, _signature) = sign(signable_request, &signing_params)
            .unwrap()
            .into_parts();

        let mut my_req: http::Request<String> = http::Request::new(body.clone().to_string());

        // Sign and then apply the signature to the request
        signing_instructions.apply_to_request_http0x(&mut my_req);

        Ok(my_req)

The identity -> DefaultCredentialsChain is not the same type

mismatched types
expected `&Identity`, found `DefaultCredentialsChain`

Can you please tell me what I miss? The code was initially built with aws-sig-auth, so trying to convert it to aws_sigv4 but I have this identity problem

[rcoh]

Yes, the default credentials chain is a credentials provider, but not an identity itself. You need to call provide_credentials() to retrieve credentials, then use .into() to convert Credentials into an Identity

[vtstanescu]

Hi @rcoh!
I'm trying to sign a request with aws-sigv4 too and hitting the 401 AWS was not able to validate the provided access credentials error without any pointers to what's causing it.

My code is

pub async fn get_availability_zone_id_from_name(
    client: &reqwest::Client,
    zone_name: &str,
) -> Result<String, InfraError> {
    let credentials = DefaultCredentialsChain::builder()
        .build()
        .await
        .provide_credentials()
        .await?
        .into();
    let region = DefaultRegionChain::builder()
        .build()
        .region()
        .await
        .ok_or_else(|| InfraError::Default("AWS Region not found".into()))?;

    let signing_settings = SigningSettings::default();
    let signing_params = v4::SigningParams::builder()
        .identity(&credentials)
        .region(region.as_ref())
        .name("ec2")
        .time(SystemTime::now())
        .settings(signing_settings)
        .build()
        .map_err(|e| InfraError::AwsSigning(e.into()))?
        .into();

    let mut request = http::Request::builder()
        .method("GET")
        .uri(format!(
            "http://ec2.{region}.amazonaws.com?Action=DescribeAvailabilityZones&Version=2016-11-15&ZoneName.1={zone_name}",
        ),)
        .body("")?;
    let signable_request = SignableRequest::new(
        request.method().as_str(),
        request.uri().to_string(),
        std::iter::empty(),
        SignableBody::UnsignedPayload,
    )
    .map_err(|e| InfraError::AwsSigning(e.into()))?;

    let (signing_instructions, _) = sign(signable_request, &signing_params)
        .map_err(|e| InfraError::AwsSigning(e.into()))?
        .into_parts();

    signing_instructions.apply_to_request_http1x(&mut request);

    let signed_request = reqwest::Request::try_from(request)?;
    let response = client.execute(signed_request).await?;

    if !response.status().is_success() {
        return Err(InfraError::Default(format!(
            "DescribeAvailabilityZones API failed: [HTTP {code}] {content}",
            code = response.status().as_u16(),
            content = response.text().await?,
        ).into()));
    }

    let availability_zones = serde_xml_rs::from_str::<
        DescribeAvailabilityZonesResponse,
    >(&response.text().await?)?
    .availability_zones
    .ok_or(InfraError::Default(
        "Availability zone not found in DescribeAvailabilityZones response"
            .into(),
    ))?;

    if availability_zones.is_empty() {
        return Err(InfraError::Default(
            "Availability zone not found in DescribeAvailabilityZones response"
                .into(),
        ));
    }

    Ok(availability_zones[0].zone_id.clone())
}

I tried a lot of things among them:

• setting my local machine NTP server to Amazon's time.aws.com (otherwise my machine's on Apple's default - so that should be the problem)
• instead of the DefaultCredentialsChain I tried a hardcoded set of credentials for an IAM user
  On this one, I've tried the same credentials with the Python example from [aws-samples|https://github.com/aws-samples/sigv4-signing-examples/blob/main/sdk/python/main.py] and it works with this one.
• fiddling with the settings in SigningSettings and logging the signed requests to compare with those generated by the Python sample, and nothing's different between them with default settings (as expected)

I'm at a point thinking aws-sigv4 doesn't work correctly, but since I assume this is used by the SDK under the hood to sign requests, it must be, but I'm missing something.

Can you assist with any pointers? This crate is not very straightforward to use.