Getting Started

Directory Structure and File Descriptions

nginx-aws-signature│├── core│   ├── awscredentials.js       common lib to read and write AWS credentials│   ├── awssig2.js              common lib to build AWS signature v2│   ├── awssig4.js              common lib to build AWS signature v4│   │                           :│   │                           add new lib when AWS releases new signature ver.│   │                           :│   └── utils.js                common lib to be reused by all NJS codebase│├── tests│   ├── docker│   │   ├── build_text          Docker environments for testing NJS codebases│   │   │   ├── nginx           NGINX config files for testing NJS codebases│   │   │   └── ssl             NGINX Plus license files when testing lib on NGINX Plus│   │   ├── Dockerfile.oss      for testing AWS signaure lib on NGINX OSS│   │   ├── Dockerfile.plus     for testing AWS signaure lib on NGINX Plus│   │   └── docker-compose.yml  to build and run a container for testing AWS signaure lib│   ├── unit-test               contains automated tests for validang that the lib works│   └── test.sh                 test launcher│└── Makefile                    automate to build/start/stop testing environment

NGINX AWS Signature Signing Flow

How to Use

Sparse Checkouts of Submodules

Step 1. Choose one of the following options

Step 2. Sparse checkouts of submodules

git submodule absorbgitdirsgit -C<path/to/submodule> config core.sparseCheckouttrueecho'core/*'>>.git/modules/<path/to/submodule>/info/sparse-checkoutgit submodule update --force --checkout<path/to/submodule>

Configure NGINX

js_import /etc/nginx/awssig/awscredentials.js;js_import /etc/nginx/awssig/awssig4.js;js_import /etc/nginx/serverless/lambdagateway.js;js_set$awsDate                 awssig4.awsHeaderDate;js_set$awsPayloadHash          awssig4.awsHeaderPayloadHash;js_set$awsSessionToken         awscredentials.sessionToken;js_set$lambdaFunctionARNAuth   lambdagateway.lambdaFunctionARNAuth;js_var$defaultHostName'nginx-lambda-gateway';map$request_uri$lambda_url { default  https://lambda.us-east-1.amazonaws.com;}server {listen80;# Use SSL/TLS in productionlocation/2015-03-31/functions/foo/invocations{auth_request /aws/credentials/retrieval;proxy_set_header x-amz-date$awsDate;proxy_set_header x-amz-content-sha256$awsPayloadHash;proxy_set_header x-amz-security-token$awsSessionToken;proxy_set_header Authorization$lambdaFunctionARNAuth;proxy_pass$lambda_url$request_uri;    }location/aws/credentials/retrieval{internal;js_content awscredentials.fetchCredentials;    }}

Integrate AWS Signature Lib To Your Custom NJS

importawscredfrom"../awssig/awscredentials.js";importawssig4from"../awssig/awssig4.js";importutilsfrom"../awssig/utils.js";constSERVICE='lambda';utils.requireEnvVar('LAMBDA_SERVER');utils.requireEnvVar('LAMBDA_REGION');functionlambdaFunctionARNAuth(r){consthost=process.env['LAMBDA_SERVER'];constregion=process.env['LAMBDA_REGION'];constqueryParams='';constcredentials=awscred.readCredentials(r);constsignature=awssig4.signatureV4(r,awscred.Now(),region,SERVICE,r.variables.request_uri,queryParams,host,credentials);returnsignature;}

Contributing

Authors and acknowledgment

License