| 1 | # VCL snippet to authenticate Fastly<->S3 requests. |
| 2 | # |
| 3 | # https://docs.fastly.com/en/guides/amazon-s3#using-an-amazon-s3-private-bucket |
| 4 | |
| 5 | if (req.method == "GET" && !req.backend.is_shield && req.backend == ${backend_name}) { |
| 6 | set var.awsAccessKey = "${access_key}"; |
| 7 | set var.awsSecretKey = "${secret_key}"; |
| 8 | set var.awsS3Bucket = "${bucket}"; |
| 9 | set var.awsRegion = "${aws_region}"; # Change this value to your own data |
| 10 | set var.awsS3Host = var.awsS3Bucket ".s3." var.awsRegion ".amazonaws.com"; |
| 11 | |
| 12 | set bereq.http.x-amz-content-sha256 = digest.hash_sha256(""); |
| 13 | set bereq.http.x-amz-date = strftime({"%Y%m%dT%H%M%SZ"}, now); |
| 14 | set bereq.http.x-amz-request-payer = "requester"; |
| 15 | set bereq.http.host = var.awsS3Host; |
| 16 | |
| 17 | set bereq.url = querystring.remove(bereq.url); |
| 18 | set bereq.url = regsuball(urlencode(urldecode(bereq.url.path)), {"%2F"}, "/"); |
| 19 | set var.dateStamp = strftime({"%Y%m%d"}, now); |
| 20 | set var.canonicalHeaders = "" |
| 21 | "host:" bereq.http.host LF |
| 22 | "x-amz-content-sha256:" bereq.http.x-amz-content-sha256 LF |
| 23 | "x-amz-date:" bereq.http.x-amz-date LF |
| 24 | "x-amz-request-payer:" bereq.http.x-amz-request-payer LF |
| 25 | ; |
| 26 | set var.canonicalQuery = ""; |
| 27 | set var.signedHeaders = "host;x-amz-content-sha256;x-amz-date;x-amz-request-payer"; |
| 28 | set var.canonicalRequest = "" |
| 29 | "GET" LF |
| 30 | bereq.url.path LF |
| 31 | var.canonicalQuery LF |
| 32 | var.canonicalHeaders LF |
| 33 | var.signedHeaders LF |
| 34 | digest.hash_sha256("") |
| 35 | ; |
| 36 | |
| 37 | set var.scope = var.dateStamp "/" var.awsRegion "/s3/aws4_request"; |
| 38 | |
| 39 | set var.stringToSign = "" |
| 40 | "AWS4-HMAC-SHA256" LF |
| 41 | bereq.http.x-amz-date LF |
| 42 | var.scope LF |
| 43 | regsub(digest.hash_sha256(var.canonicalRequest),"^0x", "") |
| 44 | ; |
| 45 | |
| 46 | set var.signature = digest.awsv4_hmac( |
| 47 | var.awsSecretKey, |
| 48 | var.dateStamp, |
| 49 | var.awsRegion, |
| 50 | "s3", |
| 51 | var.stringToSign |
| 52 | ); |
| 53 | |
| 54 | set bereq.http.Authorization = "AWS4-HMAC-SHA256 " |
| 55 | "Credential=${access_key}/" var.scope ", " |
| 56 | "SignedHeaders=" var.signedHeaders ", " |
| 57 | "Signature=" + regsub(var.signature,"^0x", "") |
| 58 | ; |
| 59 | |
| 60 | unset bereq.http.Accept; |
| 61 | unset bereq.http.Accept-Language; |
| 62 | unset bereq.http.User-Agent; |
| 63 | unset bereq.http.Fastly-Client-IP; |
| 64 | } |