AWS Sigv4 - signing requests against Lambda Function-URL

[schmallaria]

We've to call a Lambda function via Azure API Gateway. For the Lambda function, we've enabled Function-URL feature and auth type is set to AWS_IAM. We've also configured an Identity Provider and a Custom Role to trust the Azure Identity and the role have the permission to call the Function-Url. Setup was done following this guide.

Now we've to sign the request to the Lambda function via AWS Sigv4. While we've to prevent the original authorization header, we can't sign the request via HTTP headers. We need to use query string signature for this request. However, query string signature is not working. AWS responds with the error The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

To calculate the correct signature, we're using AWS4Signer (AWSSDK.Core 3.7.402.33).

We've created a simple console application to test both signature methods, header signature and query string signature. Header signature is working as expected, we can sign the request and successfully call the Lambda function. We tried to compare both signature methods, but we can't figure out why query string signature is not working.

Is there anyone who can take a look at the code and point us into the right direction? Why is header signature working and query string signature not? I guess the signature for header and query string is the same, only the way it is transmitted is different.

using System.Net.Http.Headers;
using System.Text;
using Amazon.Lambda;
using Amazon.Lambda.Model;
using Amazon.Runtime;
using Amazon.Runtime.Internal;
using Amazon.Runtime.Internal.Auth;
using Amazon.Runtime.Internal.Util;
using Amazon.SecurityToken;
using Amazon.SecurityToken.Model;
using Amazon.Util;

//get temporary credentials, via STS, using a web identity token
var stsClient = new AmazonSecurityTokenServiceClient(new AnonymousAWSCredentials());

var assumeRoleRequest = new AssumeRoleWithWebIdentityRequest
{
    RoleArn = "arn:aws:iam::<aws-account-id>:role/SWOExecutePowerProxy",
    WebIdentityToken ="<azure-token>",
    RoleSessionName = "my-session"
};

var response = await stsClient.AssumeRoleWithWebIdentityAsync(assumeRoleRequest);

var immutableCredentials = await new SessionAWSCredentials(response.Credentials.AccessKeyId,
    response.Credentials.SecretAccessKey,
    response.Credentials.SessionToken).GetCredentialsAsync();

var url = new Uri("https://<function-url-id>.lambda-url.eu-central-1.on.aws");
var body = "<xml><test>test</test></xml>";

await WithHeaderAuth(url, "eu-central-1", immutableCredentials, body);
await WithQueryStringAuth(url, "eu-central-1", immutableCredentials, body);

async Task WithHeaderAuth(Uri lambdaFunctionUrl, string region, ImmutableCredentials credentials, string content)
{
    using var httpClient = new HttpClient();
    httpClient.BaseAddress = lambdaFunctionUrl;

    using var httpRequest = new HttpRequestMessage(HttpMethod.Post, "/");

    httpRequest.Content = new StringContent(content, Encoding.UTF8, "application/xml");

    httpRequest.Headers.Add("Host", lambdaFunctionUrl.Host);
    httpRequest.Headers.Add("X-Amz-Content-Sha256", await GetContentHash(httpRequest.Content));
    httpRequest.Headers.Add("X-Amz-Security-Token", credentials.Token);

    var headers = new Dictionary<string, string>();

    foreach (var (key, value) in httpRequest.Headers)
    {
        headers.Add(key, value.FirstOrDefault() ?? string.Empty);
    }

    var signature = GetAwsSignature(lambdaFunctionUrl, region, credentials, headers, content);

    httpRequest.Headers.Add("X-Amz-Date", signature.ISO8601DateTime);
    httpRequest.Headers.Authorization =
        new AuthenticationHeaderValue(AWS4Signer.AWS4AlgorithmTag, signature.ForAuthorizationHeader.Replace(AWS4Signer.AWS4AlgorithmTag, ""));

    using var httpResponse = await httpClient.SendAsync(httpRequest);

    var responseBody = await httpResponse.Content.ReadAsStringAsync();

    Console.WriteLine(responseBody);
}

async Task WithQueryStringAuth(Uri lambdaFunctionUrl, string region, ImmutableCredentials credentials, string content)
{
    using var stringContent = new StringContent(content, Encoding.UTF8, "application/xml");
    using var httpClient = new HttpClient();
    httpClient.BaseAddress = lambdaFunctionUrl;

    var headers = new Dictionary<string, string>
    {
        { "Host", lambdaFunctionUrl.Host },
        { "X-Amz-Content-Sha256", await GetContentHash(stringContent) },
        { "X-Amz-Security-Token", credentials.Token }
    };

    var signature = GetAwsSignature(lambdaFunctionUrl, region, credentials, headers, content, true);

    using var httpRequest = new HttpRequestMessage(HttpMethod.Post,
        $"/?{signature.ForQueryParameters}&X-Amz-Security-Token={AWSSDKUtils.UrlEncode(credentials.Token, false)}");

    httpRequest.Content = stringContent;

    using var httpResponse = await httpClient.SendAsync(httpRequest);

    var responseBody = await httpResponse.Content.ReadAsStringAsync();

    Console.WriteLine(responseBody);
}

AWS4SigningResult GetAwsSignature(Uri lambdaFunctionUrl, string region, ImmutableCredentials credentials, IDictionary<string, string> headers, string body,
    bool useQueryString = false)
{
    var invokeRequest = new InvokeRequest();
    var defaultRequest = new DefaultRequest(invokeRequest, "lambda")
    {
        SignatureVersion = SignatureVersion.SigV4,
        HttpMethod = "POST",
        Endpoint = lambdaFunctionUrl,
        Content = Encoding.UTF8.GetBytes(body),
        AuthenticationRegion = region,
        UseQueryString = useQueryString
    };

    foreach (var (key, value) in headers)
    {
        defaultRequest.Headers.Add(key, value);
    }

    return new AWS4Signer(true).SignRequest(defaultRequest, new AmazonLambdaConfig(), new RequestMetrics(), credentials.AccessKey, credentials.SecretKey);
}

async Task<string> GetContentHash(HttpContent? content)
{
    if (content == null)
    {
        return AWS4Signer.EmptyBodySha256;
    }

    var contentStream = await content.ReadAsStreamAsync().ConfigureAwait(false);

    var currentPosition = contentStream.Position;

    var hash = CryptoUtilFactory.CryptoInstance.ComputeSHA256Hash(contentStream);

    contentStream.Position = currentPosition;

    return AWSSDKUtils.ToHex(hash, true);
}

[schmallaria]

Anyone out there who knows if it's possible to sign Lambda Function-URL? I didn't find any working example. I checked Postman for that, signing requests via HTTP header is working, signing via Query string throws the exact same error.

[dscpinheiro]

The SDK signer at the moment does not support generic request signing, since as you noticed it relies on a lot of internal components (it's something we want to address in the future but won't be ready short term - #1905).

Having said that, if this is similar to the IAM database authentication feature RDS has, you can look at this class (you'll need to change the parameters but it's probably the best example we have today): https://github.com/aws/aws-sdk-net/blob/main/sdk/src/Services/RDS/Custom/Util/RDSAuthTokenGenerator.cs

If that still doesn't work, you can check the https://github.com/aws-samples/sigv4-signing-examples/tree/main/no-sdk/dotnet repository. It has some examples on signing requests without using the SDK (but disclaimer our team doesn't own that repository so we may not be able to help with any questions).

[schmallaria]

@dscpinheiro, taking the code from RDSAuthTokenGenerator.cs does not help, I get the exact same error as in my question.

I suspect that the signature verification within Lambda is calculated differently than described in all other documentation.