| 1 | # VCL snippet to authenticate Fastly<->S3 requests. |
| 2 | # |
| 3 | # https://docs.fastly.com/en/guides/amazon-s3#using-an-amazon-s3-private-bucket |
| 4 | |
| 5 | declare local var.canonicalHeaders STRING; |
| 6 | declare local var.signedHeaders STRING; |
| 7 | declare local var.canonicalRequest STRING; |
| 8 | declare local var.canonicalQuery STRING; |
| 9 | declare local var.stringToSign STRING; |
| 10 | declare local var.dateStamp STRING; |
| 11 | declare local var.signature STRING; |
| 12 | declare local var.scope STRING; |
| 13 | |
| 14 | if (req.method == "GET" && !req.backend.is_shield) { |
| 15 | set bereq.http.x-amz-content-sha256 = digest.hash_sha256(""); |
| 16 | set bereq.http.x-amz-date = strftime({"%Y%m%dT%H%M%SZ"}, now); |
| 17 | set bereq.http.x-amz-request-payer = "requester"; |
| 18 | set bereq.http.host = "${backend_domain}"; |
| 19 | set bereq.url = querystring.remove(bereq.url); |
| 20 | set bereq.url = regsuball(urlencode(urldecode(bereq.url.path)), {"%2F"}, "/"); |
| 21 | set var.dateStamp = strftime({"%Y%m%d"}, now); |
| 22 | set var.canonicalHeaders = "" |
| 23 | "host:" bereq.http.host LF |
| 24 | "x-amz-content-sha256:" bereq.http.x-amz-content-sha256 LF |
| 25 | "x-amz-date:" bereq.http.x-amz-date LF |
| 26 | "x-amz-request-payer:" bereq.http.x-amz-request-payer LF |
| 27 | ; |
| 28 | set var.canonicalQuery = ""; |
| 29 | set var.signedHeaders = "host;x-amz-content-sha256;x-amz-date;x-amz-request-payer"; |
| 30 | set var.canonicalRequest = "" |
| 31 | "GET" LF |
| 32 | bereq.url.path LF |
| 33 | var.canonicalQuery LF |
| 34 | var.canonicalHeaders LF |
| 35 | var.signedHeaders LF |
| 36 | digest.hash_sha256("") |
| 37 | ; |
| 38 | |
| 39 | set var.scope = var.dateStamp "/${aws_region}/s3/aws4_request"; |
| 40 | |
| 41 | set var.stringToSign = "" |
| 42 | "AWS4-HMAC-SHA256" LF |
| 43 | bereq.http.x-amz-date LF |
| 44 | var.scope LF |
| 45 | regsub(digest.hash_sha256(var.canonicalRequest),"^0x", "") |
| 46 | ; |
| 47 | |
| 48 | set var.signature = digest.awsv4_hmac( |
| 49 | "${secret_key}", |
| 50 | var.dateStamp, |
| 51 | "${aws_region}", |
| 52 | "s3", |
| 53 | var.stringToSign |
| 54 | ); |
| 55 | |
| 56 | set bereq.http.Authorization = "AWS4-HMAC-SHA256 " |
| 57 | "Credential=${access_key}/" var.scope ", " |
| 58 | "SignedHeaders=" var.signedHeaders ", " |
| 59 | "Signature=" + regsub(var.signature,"^0x", "") |
| 60 | ; |
| 61 | unset bereq.http.Accept; |
| 62 | unset bereq.http.Accept-Language; |
| 63 | unset bereq.http.User-Agent; |
| 64 | unset bereq.http.Fastly-Client-IP; |
| 65 | } |