AWS Request Authenticator

Build a library that authenticates HTTP requests to AWS services using AWS Signature Version 4.

Requirements

Your library should provide functionality to sign HTTP requests using AWS credentials (access key ID and secret access key) following the AWS Signature Version 4 signing process. The authenticator should integrate with the Python requests library and add the necessary authentication headers to outgoing requests.

The authenticator should:

• Accept AWS credentials (access key, secret access key) and AWS service information (region, service name, host)
• Generate properly signed authorization headers following AWS Signature Version 4 specifications
• Integrate with the requests library as an authentication handler
• Support signing requests for different AWS services and regions

Capabilities

Basic Request Signing

• When signing a GET request to an AWS service with valid credentials, the authorization header is added correctly @test
• When signing a POST request with a request body, the payload hash is calculated and included in the signature @test

Credential Handling

• When initialized with access key and secret access key, these credentials are used to generate the signature @test
• When temporary credentials with a session token are provided, the security token header is included in the request @test

Canonical Request Construction

• Query parameters in the request URL are properly formatted in the canonical query string @test
• Special characters in the URL path are properly encoded according to AWS specifications @test

Implementation

@generates

API

class AWSRequestAuth:
    """
    Authenticates HTTP requests using AWS Signature Version 4.

    This class integrates with the requests library to automatically
    sign HTTP requests with AWS credentials.
    """

    def __init__(self, aws_access_key, aws_secret_access_key, aws_host,
                 aws_region, aws_service, aws_token=None):
        """
        Initialize the AWS request authenticator.

        Args:
            aws_access_key: AWS access key ID
            aws_secret_access_key: AWS secret access key
            aws_host: AWS service host (e.g., 'es.us-east-1.amazonaws.com')
            aws_region: AWS region (e.g., 'us-east-1')
            aws_service: AWS service name (e.g., 'es', 'execute-api')
            aws_token: Optional session token for temporary credentials
        """
        pass

    def __call__(self, request):
        """
        Sign the request and add authentication headers.

        This method is called by the requests library when this
        authenticator is used as the auth parameter.

        Args:
            request: A requests PreparedRequest object

        Returns:
            The modified request with authentication headers added
        """
        pass

Dependencies { .dependencies }

aws-requests-auth { .dependency }

Provides AWS Signature Version 4 signing functionality for HTTP requests.

@satisfied-by