Announcement: smithy-go now supports sigv4 and sigv4a

[lucix-aws]

The 2024-09-25 release of smithy-go introduces a new standalone module, aws-http-auth, which provides APIs for SigV4 and SigV4a signing.

See aws/aws-sdk-go-v2#2812 for more details.

[pmcanseco]

Hello @lucix-aws , I'm trying to take this library out for a spin, but the v4a version we require doesn't seem to work with IAM role-chaining, which is a pattern heavily used in my org.

We have API Gateways with IAM authorization which require a v4 or v4a signature to work.

I notice that if I use the first role in the chain, the request goes through. If I then use that role to assume a different role and then use the resulting credentials with this library, I get the following from my API Gateway.

< Date: Sat, 18 Jan 2025 01:57:57 GMT
< Content-Type: application/json
< Content-Length: 35
< X-Amzn-Requestid: < i can provide if helpful >
< X-Amzn-Errortype: AccessDeniedException
{"Message":"Authentication failed"}

The only notable difference that I've found is that the value of the request header X-Amz-Security-Token looks quite a bit different in non-chained (working) vs chained (failing) requests. The main difference is in the beginning so I've snipped the rest.

Working Security Token:

 X-Amz-Security-Token: IQoJb3JpZ2luX2VjEHIaCXVzLWVhc3QtMSJ<snip>

Non-working Security Token:

 X-Amz-Security-Token: FwoGZXIvYXdzEIP//////////wEaDCSlbCvh1CdFCBXZJyKuAcN3lvp/2oZfrniv/ZgJ39<snip>

All other parts of the request (host, path, body, method) are identical. The only difference is the credentials used to sign the request. Both roles have the ability to invoke the api gateway.

Would you be able to see if the v4a signatures generated from this library work with credentials obtained by iam role-chaining?

[lucix-aws]

I'm not an IAM/STS expert but my previous understanding was that yes, there are two types of session tokens. IAM docs seem to allude to this being the case.

Whether that's indeed the difference you're seeing here, whether that's the cause of the signature failure, or why you'd get different types of tokens across chained roles, I don't know. Looking to confirm internally.