Package com.chilkatsoft.chilkat2

Class AuthAws

java.lang.Object
com.chilkatsoft.chilkat2.ChilkatObject
com.chilkatsoft.chilkat2.AuthAws
All Implemented Interfaces:
AutoCloseable
public class AuthAws extends ChilkatObject
<section class="authaws-summary">

Configure AWS request signing for REST calls and temporary pre-signed URLs.

Chilkat.AuthAws holds the AWS authentication settings used by Chilkat.Rest when sending signed AWS requests. It supports AWS Signature Version 4 by default, can optionally use the older Signature Version 2 where applicable, accepts direct credential values or secure secret specifiers, and can generate temporary Signature V4 pre-signed URLs for AWS services.

REST authentication object

Provide AWS signing settings to Chilkat.Rest so outgoing requests are authenticated according to AWS requirements.

Signature Version 4

Sign requests using AWS Signature Version 4, including service, region, credentials, headers, and request payload details.

Credentials and secrets

Use access keys and secret keys directly, or use secret specifiers when credentials should be resolved from a secure credential source.

Region and service targeting

Configure the AWS region and service name so signatures are generated for the correct AWS endpoint.

Temporary credentials

Include session tokens when signing requests with temporary AWS credentials from STS, IAM roles, or similar credential flows.

Pre-signed URLs

Generate temporary Signature V4 pre-signed URLs when a client needs limited-time access without sending AWS credentials.

Common pattern: Create and configure an AuthAws object with the AWS access key, secret key or secret specifier, region, service name, and optional session token, then pass it to Chilkat.Rest before sending the request. Use AuthAws for AWS request signing; use service-specific Chilkat classes or Chilkat.Http/Chilkat.Rest for constructing and sending the actual API request.

For an extended overview, see AuthAws Class Overview.

</section>

Instances hold a native Chilkat object: close them with ChilkatObject.close() (try-with-resources) when done; an unclosed instance is freed when it becomes unreachable.

See Also:
Online reference

  • Constructor Details

    • AuthAws

      public AuthAws()
      Creates a new AuthAws object.

  • Method Details

    • getAccessKey

      public String getAccessKey()
      The AWS access key.
      Returns:
      the value of the AccessKey property

    • setAccessKey

      public void setAccessKey​(String value)
      Sets the AccessKey property; see getAccessKey().
      Parameters:
      value - the new value (not null)

    • getCanonicalizedResourceV2

      public String getCanonicalizedResourceV2()
      If AWS Signature Version V2 is used, then this property must be set. The rules for setting the canonicalized resource for the V2 signature method is described here: Constructing the CanonicalizedResource Element.
      Returns:
      the value of the CanonicalizedResourceV2 property

    • setCanonicalizedResourceV2

      public void setCanonicalizedResourceV2​(String value)
      Sets the CanonicalizedResourceV2 property; see getCanonicalizedResourceV2().
      Parameters:
      value - the new value (not null)

    • getEnableSecrets

      public boolean getEnableSecrets()
      If true a secret specifier of the format "!!part1|part2|.." can be provided instead of the actual value for the AccessKey and SecretKey properties.

      The default value is false.

      Returns:
      the value of the EnableSecrets property

    • setEnableSecrets

      public void setEnableSecrets​(boolean value)
      Sets the EnableSecrets property; see getEnableSecrets().
      Parameters:
      value - the new value

    • getPrecomputedMd5

      public String getPrecomputedMd5()
      This property can optionally be set for AWS requests that have a non-empty request body. This should be the base64 encoding of the 16 bytes of the MD5 hash. The most common need for this is if doing an S3 upload from a stream. (If the pre-computed MD5 is not provided, then Chilkat is forced to stream the entire file into memory so that it can calculate the MD5 for authentication.)

      Note: AWS Signature Version 2 uses the MD5, whereas Signature Version 4 uses SHA256.

      Returns:
      the value of the PrecomputedMd5 property

    • setPrecomputedMd5

      public void setPrecomputedMd5​(String value)
      Sets the PrecomputedMd5 property; see getPrecomputedMd5().
      Parameters:
      value - the new value (not null)

    • getPrecomputedSha256

      public String getPrecomputedSha256()
      This property can optionally be set for AWS requests that have a non-empty request body. This should be the lowercase hex encoding of the 32-bytes of the SHA256 hash. The most common need for this is if doing an S3 upload from a stream. (If the pre-computed SHA-256 is not provided, then Chilkat is forced to stream the entire file into memory so that it can calculate the SHA-256 for authentication.)

      Note: AWS Signature Version 4 uses the SHA256 hash. (AWS Signature Version 2 uses MD5)

      Returns:
      the value of the PrecomputedSha256 property

    • setPrecomputedSha256

      public void setPrecomputedSha256​(String value)
      Sets the PrecomputedSha256 property; see getPrecomputedSha256().
      Parameters:
      value - the new value (not null)

    • getRegion

      public String getRegion()
      The AWS region, such as us-east-1, us-west-2, eu-west-1, eu-central-1, etc. The default is us-east-1. It is only used when the SignatureVersion property is set to 4. This property is unused when the SignatureVersion property is set to 2.
      Returns:
      the value of the Region property

    • setRegion

      public void setRegion​(String value)
      Sets the Region property; see getRegion().
      Parameters:
      value - the new value (not null)

    • getSecretKey

      public String getSecretKey()
      The AWS secret key.
      Returns:
      the value of the SecretKey property

    • setSecretKey

      public void setSecretKey​(String value)
      Sets the SecretKey property; see getSecretKey().
      Parameters:
      value - the new value (not null)

    • getServiceName

      public String getServiceName()
      The AWS service namespace, such as s3, ses, etc. See http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-aws-service-namespaces

      This property is unused when the SignatureVersion property is set to 2.

      Returns:
      the value of the ServiceName property

    • setServiceName

      public void setServiceName​(String value)
      Sets the ServiceName property; see getServiceName().
      Parameters:
      value - the new value (not null)

    • getSignatureVersion

      public int getSignatureVersion()
      The AWS Signature Version to be used in authentication. The default value is 4. This can optionally be set to the value 2 to use the older V2 signature version.
      Returns:
      the value of the SignatureVersion property

    • setSignatureVersion

      public void setSignatureVersion​(int value)
      Sets the SignatureVersion property; see getSignatureVersion().
      Parameters:
      value - the new value

    • genPresignedUrl

      public String genPresignedUrl​(String httpVerb, boolean useHttps, String domain, String path, int numSecondsValid, String awsService)
      Generates a temporary pre-signed URL for an Amazon AWS service using AWS Signature V4. Requires that the SecretKey, AccessKey, and Region properties be set to valid values prior to calling this method.

      The URL that is generated has this format: 

      https://<domain>/<path>
 ?X-Amz-Algorithm=AWS4-HMAC-SHA256
 &X-Amz-Credential=<AccessKey>/<currentDate>/<Region>/<awsService>/aws4_request
 &X-Amz-Date=<currentDateTime>
 &X-Amz-Expires=<numSecondsValid>
 &X-Amz-SignedHeaders=host
 &X-Amz-Signature=<signature-value>

      The httpVerb is the HTTP verb such as GET, PUT, POST, DELETE, etc. The awsService is a string naming the AWS service, such as s3, execute-api, etc. If useHttps is true, then the returned URL begins with https://, otherwise it begins with http://.

      Note: It is generally not feasible to use pre-signed URLs for POST operations for any AWS service except for S3. See AWS Pre-Signed URLs for POST Operations (non-S3)

      Parameters:
      httpVerb - the httpVerb argument (not null)
      useHttps - the useHttps argument
      domain - the domain argument (not null)
      path - the path argument (not null)
      numSecondsValid - the numSecondsValid argument
      awsService - the awsService argument (not null)
      Returns:
      the result (never null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why