aws-simple-sign.core — dk.emcken/aws-simple-sign 2.2.0

Relevant AWS documentation:

• https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
• https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAuthentication.html

When the documentation references a client it is either a awyeah client, a Cognitect AWS API client or a map with the following structure:

{:credentials #:aws{:access-key-id "some-access-key"
                    :secret-access-key "wild_secr3t"
                    :session-token "FwoG..."}
 :region "us-east-1"
 :endpoint {:protocol :https
            :hostname "s3.amazonaws.com"}}

Notice: :endpoint is optional.

canonical-request-str clj

(canonical-request-str
  canonical-url
  {:keys [content-sha256 method query-params signed-headers] :as _opts})

Generates a canonical request string as specified here: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html#canonical-request

generate-presigned-url clj

(generate-presigned-url client
                        bucket
                        object-key
                        {:keys [endpoint path-style region] :as opts})

Takes client, bucket name, object key and an options map with the following default values:

{:path-style false    ; path-style is the 'old way' of URL's
 :endpoint nil}       ; alternative endpoint eg. "http://localhost:9000"

The options map is 'forwarded' to presign, see that function for more relevant options. Returns a presigned URL.

hash-input clj

(hash-input payload)

Takes input as either String or InputStream to calculate and return a hash.

hash-sha256 clj multimethod

Takes input like String or InputStream and returns a SHA256 hash.

presign clj

(presign credentials url)

(presign credentials
         url
         {:keys [ref-time region expires method]
          :or {ref-time (Date.) region "us-east-1" expires "3600"}})

Take an URL for a S3 object and returns a string with a presigned URL for that particular object. Takes the following options (a map) as the last argument, the map value shows the default values:

{:ref-time (java.util.Date.) ; timestamp incorporated into the signature
 :expires "3600"           ; signature expires x seconds after ref-time
 :region "us-east-1"       ; signature locked to AWS region
 :method :get}               ; http method the url is to be called with

By default credentials are read from standard AWS location.

sign-request clj

(sign-request
  client
  {:keys [body headers method url] :as request}
  {:keys [ref-time region service payload-hash]
   :or {region (:region client) service "execute-api" ref-time (Date.)}
   :as _opts})

Takes a client and a Ring style request map. Returns an enriched Ring style map with the required headers needed for AWS signing.

signature clj

(signature credentials
           canonical-url
           {:keys [scope timestamp region service] :as opts})

AWS specification: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html

Inspired by https://gist.github.com/souenzzo/21f3e81b899ba3f04d5f8858b4ecc2e9