Stability	experimental
Maintainer	Lars Kuhtz <lars@alephcloud.com>
Safe Haskell	None

Aws.SignatureV4

Contents

AWS General API Version
Signature Version
AWS Credentials
Pure signing
Signing With Cached Key
Authorization Info
Internal
Signature
- Low level signing function

Description

AWS Signature Version 4

API Version: 1.0

http://docs.aws.amazon.com/general/1.0/gr/signature-version-4.html

Synopsis

AWS General API Version

generalVersionToText :: IsString a => GeneralVersion -> aSource

parseGeneralVersion :: CharParsing m => m GeneralVersion Source

Signature Version

signatureVersion :: IsString a => aSource

AWS Credentials

data SignatureV4Credentials Source

AWS access credentials.

This type is compatible with the Credential type from the aws package. You may use the following function to get a SignatureV4Credential from a Credential:

 cred2credv4 :: Credential -> SignatureV4Credential
 #if MIN_VERSION_aws(0,9,2)
 cred2credv4 (Credential a b c _) = SignatureV4Credential a b c
 #else
 cred2credv4 (Credential a b c) = SignatureV4Credential a b c
 #endif

Constructors

SignatureV4Credentials
Fields sigV4AccessKeyId :: ByteString sigV4SecretAccessKey :: ByteString sigV4SigningKeys :: IORef [SigV4Key] used internally for caching the singing key

Instances

Typeable SignatureV4Credentials

newCredentials Source

Arguments

:: (Functor m, MonadIO m)
=> ByteString	Access Key ID
-> ByteString	Secret Access Key
-> m SignatureV4Credentials

= AWS Signature 4 Request Types

There are two types of version 4 signed requests for GET and for POST requests

http://docs.aws.amazon.com/general/1.0/gr/sigv4-signed-request-examples.html

== Common Parameters

Both request types must include the following information in some way

http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html

Host * Action * Date * Authorization parameters:
Algorithm * Credential * Signed headers * signature

== POST Request

Computed by signPostRequest or signPostRequestIO.

Headers:

host, * x-amz-date (or date), * authorization (containing all authorization parameters), and * content-type: application/x-www-form-urlencoded. charset=utf-8.

The query parameters (including Action and Version) are placed in the body.

== GET Request

Computed with signGetRequest or signGetRequestIO.

Headers:

```
host
```

TODO why is this content-type required?

Query:

Action, * Version, * X-Amz-Algorithm, * X-Amz-Credential, * Authorization parameters:
X-Amz-Date, * X-Amz-SignedHeaders, * X-Amz-Signature, * SignedHeaders, * Signature.

(NOTE that the AWS specification considers X-Amz-Date an authorization parameter only for URI requests. So for URI requests there are five authorization parameters whereas otherwise there are just four.)

Somewhat surprisingly (and covered neither by the AWS Signature V4 test suite nor by the AWS API reference) the canonical request includes all authorization parameters except for the signature.

TODO: is it possible to do a POST with this style and place the query in the body?

Pure signing

signPostRequest Source

Arguments

:: SignatureV4Credentials	AWS credentials
-> Region	request region
-> ServiceNamespace	service of the request
-> UTCTime	request time
-> Method	HTTP method of request
-> UriPath	URI Path of request
-> UriQuery	URI Query of request
-> RequestHeaders	request headers
-> ByteString	request payload
-> Either String RequestHeaders

Compute an AWS Signature Version 4

This version computes the derivied signing key each time it is invoked

The request headers must include the host header. The query must include the Action parameter.

The x-amz-date header is generated by the code. A possibly existing x-amz-date header or date header is replaced.

signGetRequest Source

Arguments

:: SignatureV4Credentials	AWS credentials
-> Region	request region
-> ServiceNamespace	service of the request
-> UTCTime	request time
-> Method	HTTP method of request
-> UriPath	URI Path of request
-> UriQuery	URI Query of request
-> RequestHeaders	request headers
-> ByteString	request payload
-> Either String UriQuery

Compute an AWS Signature Version 4

This version computes the derivied signing key each time it is invoked

The request headers must include the host header. The query must include the Action parameter.

Signing With Cached Key

signPostRequestIO Source

Arguments

:: SignatureV4Credentials	AWS credentials
-> Region
-> ServiceNamespace
-> UTCTime
-> Method	HTTP method of request
-> UriPath	URI Path of request
-> UriQuery	URI Query of request
-> RequestHeaders	request headers
-> ByteString	request payload
-> IO (Either String RequestHeaders)

The request headers must include the host header. The query must include the Action parameter.

The x-amz-date header is generated by the code. A possibly existing x-amz-date header or date header is replaced.

signGetRequestIO Source

Arguments

:: SignatureV4Credentials	AWS credentials
-> Region
-> ServiceNamespace
-> UTCTime
-> Method	HTTP method of request
-> UriPath	URI Path of request
-> UriQuery	URI Query of request
-> RequestHeaders	request headers
-> ByteString	request payload
-> IO (Either String UriQuery)

The request headers must include the host header. The query must include the Action parameter.

Authorization Info

data AuthorizationInfo Source

Constructors

AuthorizationInfo
Fields authzInfoAlgorithm :: !ByteString authzInfoCredential :: !ByteString authzInfoSignedHeaders :: !ByteString authzInfoDate :: !UTCTime authzInfoSignature :: !ByteString

authorizationInfo :: SignatureV4Credentials -> CredentialScope -> SignedHeaders -> UTCTime -> Signature -> AuthorizationInfo Source

authorizationInfoQuery :: AuthorizationInfo -> UriQuery Source

authorizationInfoHeader :: AuthorizationInfo -> RequestHeaders Source

Internal

dateNormalizationEnabled :: Bool Source

Normalization of the date header breaks the AWS test suite, since the tests in that test suite use an invalid date.

Date normalization is enabled by default but can be turned of via the cabal (compiletime) flag normalize-signature-v4-date.

Constants

signingAlgorithm :: IsString a => aSource

We only support SHA256 since SHA1 has been deprecated

Canoncial URI

type UriPath = [Text]Source

type UriQuery = QueryText Source

normalizeUriPath :: UriPath -> UriPath Source

Normalize URI Path according to RFC 3986 (6.2.2)

normalizeUriQuery :: UriQuery -> UriQuery Source

Normalize URI Query according to RFC 3986 (6.2.2)

newtype CanonicalUri Source

Constructors

CanonicalUri ByteString

Instances

Eq CanonicalUri
Ord CanonicalUri
Read CanonicalUri
Show CanonicalUri
Typeable CanonicalUri

canonicalUri :: UriPath -> UriQuery -> CanonicalUri Source

Compute canonical URI

http://docs.aws.amazon.com/general/1.0/gr/sigv4-create-canonical-request.html

The input is assumed to be an absolute URI. If the first segment is .. it is kept as is. Most likely such an URI is invalid.

Canonical Headers

newtype CanonicalHeaders Source

Constructors

CanonicalHeaders ByteString

Instances

Eq CanonicalHeaders
Ord CanonicalHeaders
Read CanonicalHeaders
Show CanonicalHeaders
Typeable CanonicalHeaders

canonicalHeaders :: RequestHeaders -> CanonicalHeaders Source

Compute canonical HTTP headers

http://docs.aws.amazon.com/general/1.0/gr/sigv4-create-canonical-request.html

It is assumed (and not checked) that the header values comform with the definitions in RFC 2661. In particular non-comformant usage of quotation characters may lead to invalid results.

SignedHeaders

data SignedHeaders Source

Instances

Eq SignedHeaders
Ord SignedHeaders
Read SignedHeaders
Show SignedHeaders
Typeable SignedHeaders

signedHeaders :: RequestHeaders -> SignedHeaders Source

Compute signed headers

http://docs.aws.amazon.com/general/1.0/gr/sigv4-create-canonical-request.html

Canonical Request

newtype CanonicalRequest Source

Constructors

CanonicalRequest ByteString

Instances

Eq CanonicalRequest
Ord CanonicalRequest
Read CanonicalRequest
Show CanonicalRequest
Typeable CanonicalRequest

canonicalRequest Source

Arguments

:: Method	HTTP method of request
-> UriPath	canonical URI Path of request
-> UriQuery	canonical URI Query of request
-> RequestHeaders	canonical request headers
-> ByteString	Request payload
-> CanonicalRequest

Create Canonical Request for AWS Signature Version 4

http://docs.aws.amazon.com/general/1.0/gr/sigv4-create-canonical-request.html

This functions performs normalization of the URI and the Headers which is expensive. We should consider providing an alternate version of this function that bypasses these steps and simply assumes that the input is already canonical.

data HashedCanonicalRequest Source

Instances

Eq HashedCanonicalRequest
Ord HashedCanonicalRequest
Read HashedCanonicalRequest
Show HashedCanonicalRequest
Typeable HashedCanonicalRequest

hashedCanonicalRequest :: CanonicalRequest -> HashedCanonicalRequest Source

Credenital Scope

data CredentialScope Source

Constructors

CredentialScope
Fields credentialScopeDate :: !UTCTime credentialScopeRegion :: !Region credentialScopeService :: !ServiceNamespace

Instances

Eq CredentialScope
Read CredentialScope
Show CredentialScope
Typeable CredentialScope
Arbitrary CredentialScope
AwsType CredentialScope

credentialScopeToText :: (IsString a, Monoid a) => CredentialScope -> aSource

String to Sign

newtype StringToSign Source

Constructors

StringToSign ByteString

Instances

Eq StringToSign
Ord StringToSign
Read StringToSign
Show StringToSign
Typeable StringToSign

stringToSign Source

Arguments

:: UTCTime	request date
-> CredentialScope	credential scope for the request
-> CanonicalRequest	canonical request
-> StringToSign

Create the String to Sign for AWS Signature Version 4

http://docs.aws.amazon.com/general/1.0/gr/sigv4-create-string-to-sign.html

Signing Key

newtype SigningKey Source

This key can be computed once and cached. It is valid for all requests to the same service and the region till 00:00:00 UTC time.

Constructors

SigningKey ByteString

Instances

Eq SigningKey
Ord SigningKey
Read SigningKey
Show SigningKey
Typeable SigningKey

signingKey :: SignatureV4Credentials -> CredentialScope -> SigningKey Source

Derive the signing key

http://docs.aws.amazon.com/general/1.0/gr/sigv4-calculate-signature.html

Signature

newtype Signature Source

Constructors

Signature ByteString

Instances

Eq Signature
Ord Signature
Read Signature
Show Signature
Typeable Signature

Low level signing function

requestSignature :: SigningKey -> StringToSign -> Signature Source

Compute an AWS Signature Version 4

http://docs.aws.amazon.com/general/1.0/gr/sigv4-calculate-signature.html

Bounded GeneralVersion
Enum GeneralVersion
Eq GeneralVersion
Ord GeneralVersion
Read GeneralVersion
Show GeneralVersion
Typeable GeneralVersion
Arbitrary GeneralVersion
AwsType GeneralVersion