AWS SigV4 Credential Signing

AWS SigV4 credential signing lets sandbox agents call AWS services (Bedrock, S3, STS, and others) through the proxy’s CONNECT tunnel. The proxy intercepts outbound requests, strips the sandbox client’s placeholder Authorization header, and re-signs the request with real AWS credentials from the provider. The sandbox never sees the real credentials.

Prerequisites

• A provider with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY credentials configured. Optionally include AWS_SESSION_TOKEN for STS temporary credentials.
• An endpointless aws provider profile when the sandbox policy defines the service endpoints, or an endpoint-bearing service profile such as aws-s3.
• A sandbox policy with credential_signing enabled on the target endpoint. For the endpointless aws profile, the endpoint must also set credential_binding.provider to the attached provider name.

Provider Setup

Create a provider with AWS credentials:

$
openshell provider create \
>
  --name aws-prod \
>
  --type aws \
>
  --credential AWS_ACCESS_KEY_ID=AKIA... \
>
  --credential AWS_SECRET_ACCESS_KEY=wJalr...

For STS temporary credentials, include the session token:

$
openshell provider create \
>
  --name aws-sts \
>
  --type aws \
>
  --credential AWS_ACCESS_KEY_ID=ASIA... \
>
  --credential AWS_SECRET_ACCESS_KEY=secret... \
>
  --credential AWS_SESSION_TOKEN=FwoGZX...

To have the gateway mint and rotate STS credentials for you instead of supplying them statically, use the aws or aws-s3 profile with the aws_sts_assume_role refresh strategy. A single sts:AssumeRole mints all three env vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) that the signer reads. See Manage Providers.

Policy Configuration

Enable SigV4 signing on a per-endpoint basis. The binding selects which provider instance supplies credentials, while the signing fields control how the proxy applies them:

Bedrock Example

1
network_policies:
2
  aws_bedrock:
3
    endpoints:
4
      - host: bedrock-runtime.us-east-1.amazonaws.com
5
        port: 443
6
        protocol: rest
7
        credential_binding:
8
          provider: aws-prod
9
        credential_signing: sigv4
10
        signing_service: bedrock
11
        rules:
12
          - allow:
13
              method: POST
14
              path: /model/*/invoke

S3 Example

1
network_policies:
2
  aws_s3:
3
    endpoints:
4
      - host: "*.s3.us-east-1.amazonaws.com"
5
        port: 443
6
        protocol: rest
7
        access: full
8
        credential_binding:
9
          provider: aws-prod
10
        credential_signing: sigv4
11
        signing_service: s3

STS Example

1
network_policies:
2
  aws_sts:
3
    endpoints:
4
      - host: sts.us-east-1.amazonaws.com
5
        port: 443
6
        protocol: rest
7
        access: full
8
        credential_binding:
9
          provider: aws-prod
10
        credential_signing: sigv4
11
        signing_service: sts

Signing Modes

The credential_signing field accepts three values:

In sigv4 auto-detect mode, the proxy inspects the x-amz-content-sha256 header sent by the client SDK:

• Hex hash → buffer body and sign it (same as sigv4:body).
• UNSIGNED-PAYLOAD → sign headers only (same as sigv4:no_body).
• STREAMING-UNSIGNED-PAYLOAD-TRAILER → sign headers only, stream body through.
• Absent → sign body if Content-Length is present, otherwise use unsigned payload.

Region Detection

The proxy extracts the AWS region from the endpoint hostname automatically. It supports standard, dualstack, FIPS, virtual-hosted, GovCloud, and China partition hostnames.

For endpoints where the region cannot be inferred from the hostname, set signing_region explicitly:

1
endpoints:
2
  - host: custom-vpc-endpoint.example.com
3
    port: 443
4
    protocol: rest
5
    access: full
6
    credential_binding:
7
      provider: aws-prod
8
    credential_signing: sigv4
9
    signing_service: s3
10
    signing_region: us-west-2

Restrictions

• credential_signing and request_body_credential_rewrite are mutually exclusive on the same endpoint. The policy validator rejects policies that set both.
• credential_binding.provider must name a provider attached to that sandbox. Use it only when the selected provider profile has no endpoints. Endpoint-bearing profiles already define their credential boundary.
• OpenShell rejects a signed sandbox policy before activation unless the endpoint has a resolvable AWS credential source. An endpoint-bearing profile must declare AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY and cover the signed host, port, and path. An endpointless profile must declare those keys and be selected with credential_binding.provider on the signed endpoint.
• The sigv4:body mode buffers at most 10 MiB. Requests with larger bodies are rejected. Use sigv4:no_body or sigv4 (auto-detect) for large payloads.
• The active provider must contain current AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY values. If either becomes unavailable after policy activation, the request fails closed.

Use from a Sandbox

Inside a sandbox, configure the AWS SDK with placeholder credentials. The proxy replaces them with real credentials during re-signing:

$
export AWS_ACCESS_KEY_ID=placeholder
$
export AWS_SECRET_ACCESS_KEY=placeholder
$
export AWS_DEFAULT_REGION=us-east-1

Then use any AWS SDK or CLI normally. The proxy transparently re-signs requests before forwarding to AWS.