Module sigv4 

AWS Signature Version 4, the subset Route53 needs: no unsigned payload, and headers limited to host, x-amz-date and (when present) x-amz-security-token.

See https://docs.aws.amazon.com/IAM/latest/UserGuide/create-signed-request.html for the algorithm this implements. Each step is a function of its own, and the tests check each against AWS’s published answers.

Structs

Request 🔒

The request sign signs.

Scope 🔒

The region and service a signature is scoped to.

Signed 🔒

Constants

ROUTE53 🔒

Route53 is a global service; every request is signed against this fixed region regardless of where the caller runs.

Functions

canonical_query 🔒

canonical_request 🔒

The canonical request. headers are the headers the signature covers, each name in lower case, in any order.

encode_path 🔒

hex_sha256 🔒

hmac_bytes 🔒

host_header 🔒

sign 🔒

Signs request over the headers HttpTransport sends with it: host, x-amz-date and, for a temporary credential, x-amz-security-token.

signature 🔒

The signature: an HMAC of the string to sign, under a key derived from the secret, the date and the scope.

signed_headers 🔒

The SignedHeaders list: every name in headers, sorted.

string_to_sign 🔒

The string to sign: the algorithm, the moment, the credential scope and the canonical request’s hash.

uri_encode 🔒

AWS’s URI-encoding rules: unreserved characters pass through unescaped, / is left alone in a path, everything else becomes uppercase-hex %XX.