使用节点签署 AWS API 网关请求

Question

I've been searching for ways to restrict access to an API made for using a AWS Lambda function written on javascript.

I've found documentation on how to use AWS Signature S4, but I still do not understand it.

According to creating a signature , after applying the pseudocode I should get the signature to be placed on the header.

I've found the following code that addresses this point:

 // Example of signature generator var crypto = require("crypto-js"); function getSignatureKey(Crypto, key, dateStamp, regionName, serviceName) { var kDate = Crypto.HmacSHA256(dateStamp, "AWS4" + key); var kRegion = Crypto.HmacSHA256(regionName, kDate); var kService = Crypto.HmacSHA256(serviceName, kRegion); var kSigning = Crypto.HmacSHA256("aws4_request", kService); return kSigning; } console.log(getSignatureKey(crypto,'secretkey','date','us-east-2','iam'));

Here comes my first question, I do not know what should be the output of getSignatureKey()? This is because on the documentation it is a very long string, while the output I got was {words:[x,x,x,x,x,x,x,x],sigBytes: 32},where the x are random numbers.

Moreover, after getting the signature and filling the header for the request with the "authorization" field and others, how do I filter unproper requests? Do I have to create a policy for the AWS API so it only allows signed requests? Here I guess I should follow Signing Requests .

Thanks!

Answer 1

Here is the simple implementation of Signed URL's. aws-cloudfront-sign package offers simpler implementation.

var cfsign = require('aws-cloudfront-sign');

var signingParams = {
  keypairId: process.env.PUBLIC_KEY,
  privateKeyString: process.env.PRIVATE_KEY,
  // Optional - this can be used as an alternative to privateKeyString
  privateKeyPath: '/path/to/private/key',
  expireTime: 1426625464599
}

// Generating a signed URL
var signedUrl = cfsign.getSignedUrl(
  'http://example.cloudfront.net/path/to/s3/object', 
  signingParams
);

https://aws.amazon.com/blogs/developer/creating-amazon-cloudfront-signed-urls-in-node-js/

Purpose of SignedURL is to serve Private Contents.

More details at,

http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html

Hope it helps.

Answer 2

The Amazon API uses signatures derived from your Access Keys to control access to Amazon Resources. I think that you are confusing this with controlling access to API Gateway which is different.

API Gateway supports multiple mechanisms of access control, including metering or tracking API uses by clients using API keys. The standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API set or individual methods. Custom authorizers and Amazon Cognito user pools provide customizable authorization and authentication solutions.

Control Access in API Gateway