Correctly generating AWS auth headers from temporary credentials

9
votes

I have an API Gateway that has two endpoints:

  1. Authorization type is NONE. Delegates to a lambda named fooLambda.
  2. Authorization type is AWS_IAM.

The client is supposed to call endpoint 1 to obtain credentials from the fooLambda so that they can successfully call endpoint 2.

I am using the AWS Node.js sdk and the aws4 npm module for signing aws requests. Here is some pseudocode for my fooLambda:

// get the role using this...
STS.assumeRole({
    RoleArn: 'arn of my role that can call endpoint 2',
    RoleSessionName: 'foobar',
})

// parse the sts creds like this....
const stsCredentials = STS.credentialsFrom(assumeRoleResponse)

// get a collection of signed headers like so
const signedHeaders = aws4.sign({
    service: 'execute-api',
    region: process.env.REGION,
}, {
    secretAccessKey: stsCredentials.secretAccessKey,
    accessKeyId: stsCredentials.accessKeyId,
    sessionToken: stsCredentials.sessionToken,
}).headers;

// return the following headers to the client
return {
    authorizationHeader: signedHeaders['Authorization'],
    stsSecurityToken: signedHeaders['X-Amz-Security-Token'],
}

Now my intent is that the client can attach these two headers to their requests so that they can successfully call endpoint 2 but I get an error saying that the security token is invalid but I'm not sure why.

UPDATE: When I use Postman's AWS Signature Authorization type and supply my accessKey, secretKey, aws region, service name, and session token parameters - it creates the authorization headers and the request to endpoint 2 is successful!

After inspecting the postman-generated authorization headers, it seems that the Authorization header has a different signature. So now the problem is: "How is postman generating a correct authorization header but aws4 isn't?"

2
amazon-web-servicesaws-sdk

2 Answers

3
votes

When using the aws4.sign function, you have to provide the path that the request will have. Otherwise there is a mismatch between the signed request and the actual request that is made and AWS will barf.

1
votes

1. You must attach the following policy AmazonAPIGatewayInvokeFullAccess a your users, maybe also you can create a user group and attach that policy.

2. Just for discard, create a new method (endpoint) without authentication, something like:

    https://uid.execute-api.regionidentifier.amazonaws.com/test/ping

So, we're discarding any issue related with apigateway.

Once having the method "ping" implemented, you can use postman for test it.

3. Verify that AWS_IAM_AUTH is working in your method (endpoint).

So, i've found this video that it can be very helpful for test your endpoint with auth header.

Good luck, tell me later how it went.