Crate reqsign_aws_v4

Expand description

AWS SigV4 signing implementation for reqsign.

This crate provides AWS Signature Version 4 (SigV4) signing capabilities for authenticating requests to AWS services like S3, DynamoDB, Lambda, and more.

§Overview

AWS SigV4 is the authentication protocol used by most AWS services. This crate implements the complete signing algorithm along with credential loading from various sources including environment variables, credential files, IAM roles, and more.

§Quick Start

use reqsign_aws_v4::{RequestSigner, DefaultCredentialProvider};
use reqsign_core::{Context, Signer};
use reqsign_file_read_tokio::TokioFileRead;
use reqsign_http_send_reqwest::ReqwestHttpSend;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Create context
    let ctx = Context::new()
        .with_file_read(TokioFileRead::default())
        .with_http_send(ReqwestHttpSend::default());

    // Create credential loader
    let loader = DefaultCredentialProvider::new();

    // Create request builder for S3
    let builder = RequestSigner::new("s3", "us-east-1");

    // Create the signer
    let signer = Signer::new(ctx, loader, builder);

    // Sign requests
    let mut req = http::Request::get("https://s3.amazonaws.com/mybucket/mykey")
        .body(())
        .unwrap()
        .into_parts()
        .0;

    signer.sign(&mut req, None).await?;
    Ok(())
}

§Credential Sources

The crate supports loading credentials from multiple sources:

Environment Variables: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
Credential File: ~/.aws/credentials
IAM Roles: For EC2 instances and ECS tasks
AssumeRole: Via STS AssumeRole operations
WebIdentity: For Kubernetes service accounts
SSO: AWS SSO credentials

§Supported Services

This implementation works with any AWS service that uses SigV4:

Amazon S3
Amazon DynamoDB
AWS Lambda
Amazon SQS
Amazon SNS
And many more…

§Advanced Configuration

§Using Custom Credential Providers

use reqsign_aws_v4::{EnvCredentialProvider, ProfileCredentialProvider};
use reqsign_core::ProvideCredentialChain;

// Create a custom credential chain
let chain = ProvideCredentialChain::new()
    .push(EnvCredentialProvider::new())
    .push(ProfileCredentialProvider::new()
        .with_profile("production"));

§Customizing DefaultCredentialProvider Slots

use reqsign_aws_v4::{DefaultCredentialProvider, ProfileCredentialProvider};

let provider = DefaultCredentialProvider::builder()
    .no_env()
    .profile(ProfileCredentialProvider::new().with_profile("production"))
    .no_imds()
    .build();

§Selecting a Profile

Use one explicit profile for the shared profile, SSO, and process credential sources:

use reqsign_aws_v4::DefaultCredentialProvider;

let provider = DefaultCredentialProvider::builder()
    .with_profile("production")
    .build();

§Custom Credential Provider

You can create custom credential providers by implementing the ProvideCredential trait:

use reqsign_core::{ProvideCredential, Context, Result};

impl ProvideCredential for MyCredentialProvider {
    type Credential = Credential;
     
    async fn provide_credential(&self, ctx: &Context) -> Result<Option<Self::Credential>> {
        // Your custom credential loading logic
        Ok(None)
    }
}

§Examples

Check out the examples directory for more detailed usage:

Modules§

constants

Structs§

AssumeRoleCredentialProvider: Loads credentials through one fixed AWS STS AssumeRole flow.
AssumeRoleGrant: A typed AWS STS AssumeRole authority transition.
AssumeRoleGranter: Explicitly grants an AWS STS assumed-role credential.
AssumeRoleWithWebIdentityCredentialProvider: AssumeRoleWithWebIdentityCredentialProvider will load credential via assume role with web identity.
CognitoIdentityCredentialProvider: Cognito Identity Credentials Provider
Credential: Credential that holds the access_key and secret_key.
DefaultCredentialProvider: DefaultCredentialProvider is a loader that will try to load credential via default chains.
DefaultCredentialProviderBuilder: Builder for DefaultCredentialProvider.
ECSCredentialProvider: ECS Task Role Credentials Provider
EnvCredentialProvider: EnvCredentialProvider loads AWS credentials from environment variables.
IMDSv2CredentialProvider
ProcessCredentialProvider: Process Credentials Provider
ProfileCredentialProvider: ProfileCredentialProvider loads AWS credentials from configuration files.
RequestSigner: RequestSigner that implement AWS SigV4.
S3AccessGrantsConfig: Stable configuration identifying one regional S3 Access Grants instance.
S3AccessGrantsGrant: One complete, typed S3 Access Grants GetDataAccess authorization request.
S3AccessGrantsGranter: Grants temporary AWS credentials through S3 Access Grants GetDataAccess.
S3AccessGrantsTarget: A typed S3 bucket, prefix, or object target for GetDataAccess.
S3ExpressSessionConfig: Validated, stable S3 Express directory bucket configuration.
S3ExpressSessionGrant: A complete S3 Express CreateSession authorization grant.
S3ExpressSessionGranter: Grants expiration-aware credentials for one S3 Express directory bucket or one caller-configured compatible endpoint.
S3ExpressSessionProvider: S3 Express fixed-flow credential provider.
SSOCredentialProvider: SSO Credentials Provider
StaticCredentialProvider: StaticCredentialProvider provides static AWS credentials.

Enums§

S3AccessGrantsPermission: The permission requested from S3 Access Grants.
S3AccessGrantsPrivilege: How tightly S3 Access Grants scopes the returned temporary credential.
S3ExpressSessionGrantSelection: Selects how S3 Express determines the CreateSession permission mode.
S3ExpressSessionMode: The permission mode of an S3 Express directory bucket session.
S3ExpressSessionPartition: An AWS partition supported by the S3 Express session endpoint model.

Constants§

EMPTY_STRING_SHA256