ContextQMD
Back to Opa

AWS Built-ins

docs/docs/policy-reference/builtins/providers.aws.mdx

1.20.16.3 KB
Original Source

<BuiltinTable category={"providers.aws"}/> The AWS Request Signing builtin in OPA implements the header-based auth, single-chunk method described in the AWS SigV4 docs. It will default to signing the payload when present, configurable via aws_config, and will sign most user-provided headers for the request, to ensure their integrity.

:::info Note that the authorization, user-agent, and x-amzn-trace-id headers, are commonly modified by proxy systems, and as such are ignored by OPA for signing. :::

The request object parameter may contain any and all of the same fields as for http.send. The following fields will have effects on the output Authorization header signature:

FieldRequiredTypeDescription
urlyesstringHTTP URL to specify in the request. Used in the signature.
methodyesstringHTTP method to specify in request. Used in the signature.
bodynoanyHTTP message body. The JSON serialized version of this value will be used for the payload portion of the signature if present.
raw_bodynostringHTTP message body. This will be used for the payload portion of the signature if present.
headersnoobjectHTTP headers to include in the request. These will be added to the list of headers to sign.

The aws_config object parameter may contain the following fields:

FieldRequiredTypeDescription
aws_access_keyyesstringAWS access key.
aws_secret_access_keyyesstringAWS secret access key. Used in generating the signing key for the request.
aws_serviceyesstringAWS service the request will be valid for. (e.g. "s3")
aws_regionyesstringAWS region for the request. (e.g. "us-east-1")
aws_session_tokennostringAWS security token. Used for the x-amz-security-token request header.
disable_payload_signingnobooleanWhen true an UNSIGNED-PAYLOAD value will be used for calculating the x-amz-content-sha256 header during signing, and will be returned in the response. Applicable only for s3 and glacier service. Default: false.

AWS Request Signing Examples

Basic Request Signing Example

The example below shows using hard-coded AWS credentials for signing the request object for http.send.

:::info For deployments, a common way to provide AWS credentials is via environment variables, usually by using the results of opa.runtime().env. :::

rego
req := {"method": "get", "url": "https://examplebucket.s3.amazonaws.com/data"}
aws_config := {
    "aws_access_key": "MYAWSACCESSKEYGOESHERE",
    "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
    "aws_service": "s3",
    "aws_region": "us-east-1",
}

example_verify_resource {
    resp := http.send(providers.aws.sign_req(req, aws_config, time.now_ns()))
    # process response from AWS ...
}
Unsigned Payload Request Signing Example

The AWS S3 request signing API supports unsigned payload signing option. This example below shows s3 request signing with payload signing disabled.

rego
req := {"method": "get", "url": "https://examplebucket.s3.amazonaws.com/data"}
aws_config := {
    "aws_access_key": "MYAWSACCESSKEYGOESHERE",
    "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
    "aws_service": "s3",
    "aws_region": "us-east-1",
    "disable_payload_signing": true,
}

example_verify_resource {
    resp := http.send(providers.aws.sign_req(req, aws_config, time.now_ns()))
    # process response from AWS ...
}
Pre-Signed Request Example

The AWS S3 request signing API supports pre-signing requests, so that they will only be valid at a future date. To do this in OPA, simply adjust the time parameter:

rego
env := opa.runtime().env
req := {"method": "get", "url": "https://examplebucket.s3.amazonaws.com/data"}
aws_config := {
    "aws_access_key": env["AWS_ACCESS_KEY"],
    "aws_secret_access_key": env["AWS_SECRET_ACCESS_KEY"],
    "aws_service": "s3",
    "aws_region": env["AWS_REGION"],
}
# Request will become valid 2 days from now.
signing_time := time.add_date(time.now_ns(), 0, 0, 2)

pre_signed_req := providers.aws.sign_req(req, aws_config, signing_time))