Giters

awslabs / aws-sdk-kotlin

Multiplatform AWS SDK for Kotlin

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Public API for URL signing?

trevjonez opened this issue · comments

commented

Describe the issue

Currently trying to build an ApiGateway websocket driven app that is using IAM for auth and need a way to sign a wss URL in order to connect.

Steps to Reproduce

This SO answer gives a good description of what I am wanting to achieve.

I have got an answer from AWS support. I will need to sign the wss URL. So instead of
setting request headers in a HTTP request, the signature information will be passed to the
url in the query string parameters. A signed wss URL looks like: wss://API_ID.execute-
api.region.amazonaws.com/dev?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-
Credential=ACCESSKEY/20200131/region/execute-api/aws4_request&X-Amz-Date=20200131T100233Z&X-
Amz-Security-Token=SECURITY_TOKEN&X-Amz-SignedHeaders=host&X-Amz-Signature=SIGNATURE.

To generate the signed URL, I can use Signer.signUrl method from @aws-amplify/core library.

Current behavior

All of the signing details are buried in the Smithy SDK as an implementation detail of the things that provide pre-signing options. (IE: S3)

AWS Kotlin SDK version used

0.29.0-beta

Platform (JVM/JS/Native)

JVM

Operating System and version

N/A

commented

Thanks for the question. Can you share more information about the specific SDK operation you're trying to create a presigned URL for? You're correct that we don't expose pre-signing capabilities and instead generate them for a few specific services. We may be able to add it for API Gateway depending on the use case.

commented

My usecase is I believe very similar to the SO answer.

I want to sign a wss://API_ID.execute-api.REGION.amazonaws.com/STAGE?potentiallyWithQueryArgs=true URL so that I can use AWS_IAM as the auth type.

In my case it will be from the JVM most likely using OKHttp as the client implementation.

Current best looking workaround I think will be using the com.amazonaws.auth.AWS4Signer from the android aws core sdk. But I do think having some sort of public API similar to what the android sdk provides would be appropriate for the kotlin SDK.