Example of configuring client with smithy-rs (SigV4 signing, url)?

[Samrose-Ahmed]

I have a Smithy service generated by smithy-rs behind an API Gateway with IAM authentication. I have generated a smithy Rust client to call this service. I need to add the SigV4 signing to the requests and add the url of the deployed API Gateway endpoint.

I believe this is done by a middleware, but the types were quite confusing and I was not able to make it work. Is there any minimal example for a standard client to use SigV4 signing, as I imagine this is a common usecase.

[Velfi]

While this was previously handled by middleware, it's currently handled as part of the endpoint/auth scheme/identity resolution process in the new "orchestrator".

Sigv4 signing is AWS-specific and will be automatically included for any client generated in "AWS-mode". As for how to do that, we still don't have guides for it as the team is specifically focused on tasks related to a 1.0 release.

You may be able to get things working by:

• (In your local copy of smithy-rs) adding your service's model to aws/sdk/aws-models.
• (In the smithy-rs project root) running ./gradlew :aws:sdk:assemble -Paws.services=+your-service-name,+sts,+sso to build an AWS-mode version of your service.

[Samrose-Ahmed]

I wasn't able to get that work, I remember I hacked the interceptors to make it work, is there an easier way to do this now?

[Velfi]

No, we haven't touched this since I last posted. It's not currently on our roadmap either. Are you able to post more info about how you're generating your client and your need to support Sigv4 signing?

[Samrose-Ahmed]

Sure, I'm just generating a pretty standard service similar to the Pokemon service and then deploying it on a Lambda function with an API Gateway that has SigV4/IAM Auth in front.

I was able to hack this to make it work but it should be easier, a lot of people use API Gateway with SigV4 auth.

use anyhow::Context;
use aws_sigv4::http_request::{sign, SignableRequest, SigningParams, SigningSettings};
use my_cp_service_client_sdk::config::Intercept;

pub fn env_var(name: &str) -> anyhow::Result<String> {
    std::env::var(name).with_context(|| format!("Error loading environment variable: {}", name))
}

#[derive(Debug)]
struct Sigv4Interceptor;

impl Intercept for Sigv4Interceptor {
    fn name(&self) -> &'static str {
        "sigv4"
    }

    fn modify_before_signing(
        &self,
        context: &mut my_cp_service_client_sdk::config::interceptors::BeforeTransmitInterceptorContextMut<'_>,
        _runtime_components: &my_cp_service_client_sdk::config::RuntimeComponents,
        _cfg: &mut my_cp_service_client_sdk::config::ConfigBag,
    ) -> Result<(), my_cp_service_client_sdk::error::BoxError> {
        // todo: should use the identity cache thing
        let creds = aws_credential_types::Credentials::new(
            env_var("AWS_ACCESS_KEY_ID")?,
            env_var("AWS_SECRET_ACCESS_KEY")?,
            env_var("AWS_SESSION_TOKEN").ok(),
            None,
            "aws",
        );
        let region = env_var("AWS_REGION")
            .or(env_var("AWS_DEFAULT_REGION"))
            .unwrap_or_else(|_| "us-east-1".to_string());
        let identity = aws_smithy_runtime_api::client::identity::Identity::new(creds, None);

        let s_settings = SigningSettings::default();
        let s_params = aws_sigv4::sign::v4::SigningParams::builder()
            .name("execute-api")
            .region(&region)
            .time(std::time::SystemTime::now())
            .identity(&identity)
            .settings(s_settings)
            .build()?;
        let s_params = SigningParams::V4(s_params);

        let req_mut = context.request_mut();

        let body = req_mut.body().bytes().unwrap_or_default();
        let body = aws_sigv4::http_request::SignableBody::Bytes(body);

        let s_req = SignableRequest::new(
            req_mut.method(),
            req_mut.uri(),
            req_mut.headers().iter(),
            body,
        )?;
        let so = sign(s_req, &s_params)?;
        let (si, _) = so.into_parts();
        let (new_headers, new_query) = si.into_parts();

        for header in new_headers.into_iter() {
            let mut value = http::HeaderValue::from_str(header.value())?;
            value.set_sensitive(header.sensitive());
            req_mut.headers_mut().insert(header.name(), value);
        }

        if !new_query.is_empty() {
            let mut query =
                aws_smithy_http::query_writer::QueryWriter::new_from_string(req_mut.uri())?;
            for (name, value) in new_query {
                query.insert(name, &value);
            }
            req_mut.set_uri(query.build_uri())?;
        }

        Ok(())
    }
}

pub fn configure_my_client(
    conf: my_cp_service_client_sdk::config::Builder,
    endpoint_url: &str,
) -> my_cp_service_client_sdk::config::Builder {
    conf.behavior_version_latest()
        .endpoint_url(endpoint_url)
        .interceptor(Sigv4Interceptor {})
}