AwsRequestSigning

This documentation is for the Envoy v3 API.

As of Envoy v1.18 the v2 API has been removed and is no longer supported.

If you are upgrading from v2 API config you may wish to view the v2 API documentation:

This extension may be referenced by the qualified name envoy.filters.http.aws_request_signing

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is not hardened and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

AwsRequestSigning configuration overview.

extensions.filters.http.aws_request_signing.v3.AwsRequestSigning

[extensions.filters.http.aws_request_signing.v3.AwsRequestSigning proto]

Top level configuration for the AWS request signing filter.

{
  "service_name": "...",
  "region": "...",
  "host_rewrite": "...",
  "use_unsigned_payload": "..."
}
service_name

(string, REQUIRED) The service namespace of the HTTP endpoint.

Example: s3

region

(string, REQUIRED) The region hosting the HTTP endpoint.

Example: us-west-2

host_rewrite

(string) Indicates that before signing headers, the host header will be swapped with this value. If not set or empty, the original host header value will be used and no rewrite will happen.

Note: this rewrite affects both signing and host header forwarding. However, this option shouldn’t be used with HCM host rewrite given that the value set here would be used for signing whereas the value set in the HCM would be used for host header forwarding which is not the desired outcome.

use_unsigned_payload

(bool) Instead of buffering the request to calculate the payload hash, use the literal string UNSIGNED-PAYLOAD to calculate the payload hash. Not all services support this option. See the S3 policy for details.