aws-simple-sign.core — dk.emcken/aws-simple-sign 2.0.0

Relevant AWS documentation:

• https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
• https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAuthentication.html

When the documentation references a client it is either a awyeah client, a Cognitect AWS API client or a map with the following structure:

{:credentials #:aws{:access-key-id "some-access-key"
               :secret-access-key "wild_secr3t"
               :session-token "FwoG..."}
 :region "us-east-1"
 :endpoint {:protocol :https
            :hostname "s3.amazonaws.com"}}

Notice: :endpoint is optional.

generate-presigned-url clj

(generate-presigned-url client
                        bucket
                        object-key
                        {:keys [endpoint path-style region] :as opts})

Takes client, bucket name, object key and an options map with the following default values:

{:path-style false    ; path-style is the 'old way' of URL's
 :endpoint nil}       ; alternative endpoint eg. "http://localhost:9000"

The options map is 'forwarded' to presign, see that function for more relevant options. Returns a presigned URL.

presign clj

(presign credentials url)

(presign credentials
         url
         {:keys [ref-time region expires]
          :or {ref-time (Date.) region "us-east-1" expires "3600"}})

Take an URL for a S3 object and returns a string with a presigned GET-URL for that particular object. Takes the following options (a map) as the last argument, the map value shows the default values:

{:ref-time (java.util.Date.) ; timestamp incorporated into the signature
 :expires "3600"           ; signature expires x seconds after ref-time
 :region "us-east-1"}      ; signature locked to AWS region

By default credentials are read from standard AWS location.

sign-request clj

(sign-request
  client
  {:keys [body headers method url] :as request}
  {:keys [ref-time region service]
   :or {region (:region client) service "execute-api" ref-time (Date.)}})

Takes a client and a Ring style request map. Returns an enriched Ring style map with the required headers needed for AWS signing.

signature clj

(signature credentials
           canonical-url
           {:keys [scope method timestamp region service query-params
                   content-sha256 signed-headers]})

AWS specification: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html Inspired by https://gist.github.com/souenzzo/21f3e81b899ba3f04d5f8858b4ecc2e9