class AGCOD::Signature

Constants

SERVICE

Public Class Methods

new(credentials) click to toggle source
# File lib/aws_agcod/signature.rb, line 13
def initialize(credentials)
  @access_key = credentials.access_key
  @secret_key = credentials.secret_key
  @region = credentials.region || DEFAULT_REGION
end

Public Instance Methods

sign(uri, headers, body = '') click to toggle source
# File lib/aws_agcod/signature.rb, line 19
def sign(uri, headers, body = '')
  @uri = uri
  @headers = headers
  @body = body
  @date = headers['x-amz-date']

  signed_headers = headers.dup
  signed_headers['Authorization'] = authorization

  signed_headers
end

Private Instance Methods

authorization() click to toggle source
# File lib/aws_agcod/signature.rb, line 33
def authorization
  [
    "AWS4-HMAC-SHA256 Credential=#{@access_key}/#{credential_string}",
    "SignedHeaders=#{@headers.keys.map(&:downcase).sort.join(";")}",
    "Signature=#{signature}"
  ].join(', ')
end
canonical_request() click to toggle source

Reference docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html

# File lib/aws_agcod/signature.rb, line 65
def canonical_request
  @canonical_request ||= [
    'POST', # HTTPRequestMethod
    Pathname.new(@uri.path).cleanpath.to_s, # CanonicalURI
    @uri.query, # CanonicalQueryString
    @headers.sort.map { |k, v| [k.downcase, v.strip].join(":") }.join("\n") + "\n", # CanonicalHeaders
    @headers.sort.map { |k, v| k.downcase }.join(';'), # SignedHeaders
    hexdigest(@body) # HexEncode(Hash(RequestPayload))
  ].join("\n")
end
credential_string() click to toggle source
# File lib/aws_agcod/signature.rb, line 60
def credential_string
  @credential_string ||= [@date[0, 8], @region, SERVICE, 'aws4_request'].join('/')
end
hexdigest(value) click to toggle source

Hexdigest simply produces an ascii safe way to view the bytes produced from the hash algorithm. It takes the hex representation of each byte and concatenates them together to produce a string

# File lib/aws_agcod/signature.rb, line 80
def hexdigest(value)
  Digest::SHA256.new.update(value).hexdigest
end
hexhmac(key, value) click to toggle source
# File lib/aws_agcod/signature.rb, line 91
def hexhmac(key, value)
  OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), key, value)
end
hmac(key, value) click to toggle source

Hash-based message authentication code (HMAC) is a mechanism for calculating a message authentication code involving a hash function in combination with a secret key

# File lib/aws_agcod/signature.rb, line 87
def hmac(key, value)
  OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), key, value)
end
signature() click to toggle source

Reference docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html

# File lib/aws_agcod/signature.rb, line 42
def signature
  k_date = hmac('AWS4' + @secret_key, @date[0, 8])
  k_region = hmac(k_date, @region)
  k_service = hmac(k_region, SERVICE)
  k_credentials = hmac(k_service, 'aws4_request')
  hexhmac(k_credentials, string_to_sign)
end
string_to_sign() click to toggle source

Reference docs.aws.amazon.com/general/latest/gr/sigv4-create-string-to-sign.html

# File lib/aws_agcod/signature.rb, line 51
def string_to_sign
  @string_to_sign ||= [
    'AWS4-HMAC-SHA256', # Algorithm
    @date, # RequestDate
    credential_string, # CredentialScope
    hexdigest(canonical_request) # HashedCanonicalRequest
  ].join("\n")
end