protected async Task SignAsync(HttpRequestMessage httpRequest)
{
if (credentials.ShouldRenew)
{
await mutex.WaitAsync().ConfigureAwait(false);
try
{
credentials = await credentials.RenewAsync().ConfigureAwait(false);
}
finally
{
mutex.Release();
}
}
var date = DateTimeOffset.UtcNow;
httpRequest.Headers.UserAgent.ParseAdd("Carbon/1.5");
httpRequest.Headers.Host = httpRequest.RequestUri.Host;
httpRequest.Headers.Date = date;
if (credentials.SecurityToken != null)
{
httpRequest.Headers.Add("x-amz-security-token", credentials.SecurityToken);
}
httpRequest.Headers.Add("x-amz-date", date.UtcDateTime.ToString("yyyyMMddTHHmmssZ"));
var scope = GetCredentialScope(httpRequest);
SignerV4.Default.Sign(credentials, scope, httpRequest);
}
public static string GetSignedUrl(GetUrlRequest request, IAwsCredentials credentials)
{
// You can specify any future expiration time in epoch or UNIX time (number of seconds since January 1, 1970).
var unixTime = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
long expires = unixTime + (long)request.ExpiresIn.TotalSeconds;
var stringToSign = ConstructStringToSign(
httpVerb: HttpMethod.Get,
contentType: string.Empty,
bucketName: request.BucketName,
key: request.Key,
headers: emptyStringDictionary,
query: string.Empty,
expiresOrDate: expires.ToString()
);
var signature = ComputeSignature(credentials.SecretAccessKey, stringToSign);
return(new StringBuilder()
.Append("https://")
.Append(request.BucketName)
.Append(".s3.amazonaws.com/")
.Append(request.Key)
.Append("?AWSAccessKeyId=")
.Append(credentials.AccessKeyId.UrlEncodeX2())
.Append("&Expires=")
.Append(expires)
.Append("&Signature=")
.Append(signature.UrlEncodeX2())
.ToString());
}
public byte[] GetSigningKey(IAwsCredentials credentials, CredentialScope scope)
{
#region Preconditions
if (credentials == null)
{
throw new ArgumentNullException(nameof(credentials));
}
if (scope == null)
{
throw new ArgumentNullException(nameof(scope));
}
#endregion
var kSecret = Encoding.ASCII.GetBytes("AWS4" + credentials.SecretAccessKey);
var kDate = HMACSHA256(kSecret, scope.Date.ToString("yyyyMMdd"));
var kRegion = HMACSHA256(kDate, scope.Region.Name);
var kService = HMACSHA256(kRegion, scope.Service.Name);
var signingKey = HMACSHA256(kService, "aws4_request");
return(signingKey);
}
public SqsQueue(AwsRegion region, string accountId, string queueName, IAwsCredentials credentials)
{
#region Preconditions
if (accountId == null)
{
throw new ArgumentNullException(nameof(accountId));
}
if (queueName == null)
{
throw new ArgumentNullException(nameof(queueName));
}
if (credentials == null)
{
throw new ArgumentNullException(nameof(credentials));
}
#endregion
this.url = new Uri($"https://sqs.{region}.amazonaws.com/{accountId}/{queueName}");
this.client = new SqsClient(region, credentials);
}
public AwsClient(AwsService service, AwsRegion region, IAwsCredentials credentials)
{
#region Preconditions
if (credentials == null)
{
throw new ArgumentNullException(nameof(credentials));
}
#endregion
this.service = service;
this.region = region;
this.credentials = credentials;
Endpoint = $"https://{service.Name}.{region.Name}.amazonaws.com/";
}
public SignatureInfo GetInfo(IAwsCredentials credentials, CredentialScope scope, HttpRequestMessage request)
{
var signingKey = GetSigningKey(credentials, scope);
var stringToSign = GetStringToSign(scope, request);
var signature = Signature.ComputeHmacSha256(signingKey, Encoding.UTF8.GetBytes(stringToSign)).ToHexString();
var signedHeaders = GetSignedHeaders(request);
var auth = $"AWS4-HMAC-SHA256 Credential={credentials.AccessKeyId}/{scope},SignedHeaders={signedHeaders},Signature={signature}";
return(new SignatureInfo {
CanonicalizedString = GetCanonicalRequest(request),
StringToSign = stringToSign,
Auth = auth
});
}
public DynamoDbClient(IAwsCredentials credentials)
: base(AwsService.DynamoDb, AwsRegion.USEast1, credentials)
{
#region Preconditions
if (credentials == null)
{
throw new ArgumentNullException(nameof(credentials));
}
#endregion
httpClient.Timeout = TimeSpan.FromSeconds(10);
#if net461
ServicePointManager.Expect100Continue = false;
#endif
}
public SnsTopic(AwsRegion region, string accountId, string topicName, IAwsCredentials credentials)
{
#region Preconditions
if (accountId == null)
{
throw new ArgumentNullException(nameof(accountId));
}
if (topicName == null)
{
throw new ArgumentNullException(nameof(topicName));
}
#endregion
this.client = new SnsClient(region, credentials);
this.arn = $"arn:aws:sns:{region}:{accountId}:{topicName}";
}
public void Sign(IAwsCredentials credentials, CredentialScope scope, HttpRequestMessage request)
{
#region Preconditions
if (credentials == null)
{
throw new ArgumentNullException(nameof(credentials));
}
if (scope == null)
{
throw new ArgumentNullException(nameof(scope));
}
if (request == null)
{
throw new ArgumentNullException(nameof(request));
}
#endregion
// If we're using S3, ensure the request content has been signed
if (scope.Service == AwsService.S3 && !request.Headers.Contains("x-amz-content-sha256"))
{
request.Headers.Add("x-amz-content-sha256", ComputeSHA256(request.Content));
}
var signingKey = GetSigningKey(credentials, scope);
var stringToSign = GetStringToSign(scope, request);
var signature = Signature.ComputeHmacSha256(signingKey, Encoding.UTF8.GetBytes(stringToSign)).ToHexString();
var signedHeaders = GetSignedHeaders(request);
// AWS4-HMAC-SHA256 Credential={0},SignedHeaders={0},Signature={0}
var auth = $"AWS4-HMAC-SHA256 Credential={credentials.AccessKeyId}/{scope},SignedHeaders={signedHeaders},Signature={signature}";
// AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20120228/us-east-1/iam/aws4_request,SignedHeaders=content-type;host;x-amz-date,Signature=HexEncode(calculated-signature-from-task-3)
request.Headers.TryAddWithoutValidation("Authorization", auth);
}
public KmsProtector(AwsRegion region, IAwsCredentials credentials, string keyId)
{
#region Preconditions
if (region == null)
{
throw new ArgumentNullException(nameof(region));
}
if (credentials == null)
{
throw new ArgumentNullException(nameof(credentials));
}
if (keyId == null)
{
throw new ArgumentNullException(nameof(keyId));
}
#endregion
this.client = new KmsClient(region, credentials);
this.keyId = keyId;
}
public DynamoTable(IAwsCredentials credentials)
: this(metadata.Name, new DynamoDbClient(credentials))
{
}
public DynamoTable(string tableName, IAwsCredentials credentials)
: this(tableName, new DynamoDbClient(credentials))
{
}
public SnsClient(AwsRegion region, IAwsCredentials credentials)
: base(AwsService.Sns, region, credentials)
{
}
public Ec2Client(AwsRegion region, IAwsCredentials credentials)
: base(AwsService.Ec2, region, credentials)
{
}
public S3Client(IAwsCredentials credentials)
: this(AwsRegion.Standard, credentials)
{
}
public KmsProtector(IAwsCredentials credentials, string keyId)
: this(AwsRegion.Standard, credentials, keyId)
{
}
public LambdaClient(AwsRegion region, IAwsCredentials credentials)
: base(AwsService.Lambda, region, credentials)
{
}
public SesClient(IAwsCredentials credentials)
: base(AwsService.Ses, AwsRegion.USEast1, credentials)
{
}
public S3Bucket(string bucketName, IAwsCredentials credentials)
: this(AwsRegion.Standard, bucketName, credentials)
{
}
public CloudWatchClient(AwsRegion region, IAwsCredentials credentials)
: base(AwsService.Monitoring, region, credentials)
{
}
public S3Bucket(AwsRegion region, string bucketName, IAwsCredentials credentials)
: this(bucketName, client : new S3Client(region, credentials))
{
}
