Authentication

The AWS connector authenticates every request with a hand-rolled AWS Signature V4 (SigV4) verifier (standard-library crypto only — no AWS SDK at runtime). It supports two postures: accept-any (the zero-friction local-dev default) and configured static credentials (a secured connector). Exactly one action — SNS ConfirmSubscription — is SigV4-exempt.

SigV4 verification

The verifier accepts both signature styles your SDK can produce:

• header-style — Authorization: AWS4-HMAC-SHA256 Credential=…, SignedHeaders=…, Signature=…;
• query-style / presigned — X-Amz-Algorithm=AWS4-HMAC-SHA256 plus the X-Amz-* query params.

The verification rules are the same in both styles:

Accept-any mode (the default)

When no credentials are configured, the credential store is empty: the verifier only parses the AccessKeyId and uses it as the ClientID. The middleware logs once on startup — aws connector running without credential verification. This is the default, intended for zero-friction local development.

export AWS_ACCESS_KEY_ID="x"       # any value — used as the ClientID in accept-any mode
export AWS_SECRET_ACCESS_KEY="x"   # any value — the SDK needs it to sign
export AWS_REGION="us-east-1"      # not enforced

Configured static credentials

When Credentials / CredentialsData are set, SigV4 is fully verified:

• the presented access key must match a configured AwsCredential.AccessKeyId;
• the secret must match (a constant-time compare of the signature);
• the authenticated ClientID becomes AwsCredential.ClientID (defaults to the AccessKeyId).

CredentialsData is a JSON (optionally base64-encoded) credential array — the env / operator path. See Configuration for the JSON shape. This is a getting-started / auth-banner toggle, not a separate example program.

The ConfirmSubscription exemption

A request with Action=ConfirmSubscription, no Authorization header, and no X-Amz-Algorithm query param bypasses SigV4 entirely (its ClientID becomes sns-confirmation). This is the only SigV4-exempt action — it exists so the SubscribeURL confirmation GET embedded in an SNS SubscriptionConfirmation envelope is usable as-is. A signed ConfirmSubscription is still verified normally. See SNS fan-out.

Casbin authorization

On top of SigV4, the connector applies per-channel Casbin checks:

• SQS data-plane operations authorize write / read on sqs.{queue};
• SNS topic management authorizes write on the pseudo-resource sns.{topic};
• SNS fan-out applies a per-target write check on each sqs.{queue} it delivers to.

A denied SQS data-plane operation (for example SendMessage) returns AccessDeniedException (403).

Failure mapping

All authentication failures are audited as aws.auth.failure. See Error codes.

Related