Skip to content

AWS Signed Request – calling an AWS API with Signature Version 4

The command "AWS Signed Request" sends an HTTP request to an Amazon Web Services API and signs it with AWS Signature Version 4, the scheme AWS services expect instead of a token. This page is for administrators who connect nexxcite with an API Gateway, Lambda, S3 or another AWS service.

1. At a glance
Purpose Call an AWS API with a signed request and receive the answer in variables
Typical use Call an API Gateway endpoint protected by IAM; invoke a Lambda function; read from S3
Where in the editor Toolbar menu "Communication" → "AWS Signed Request"
Needs a user interface No
Related HTTP Request

The command works like HTTP Request, with the signature added. Use HTTP Request for every API that is not signed the AWS way.

2. Settings

"Display Name", "Description" and "Execution Condition" are on the tab "General" (see Actions).

Tab "Request Settings"

Setting Meaning Default / Required
"Method" Expression for the HTTP method, for example GET or POST Empty: GET
"Url" Expression for the absolute http or https address, for example https://a1b2c3.execute-api.eu-central-1.amazonaws.com/prod/orders. A query string belongs here – it is part of the signature. Required
"Body" Expression for the request body. It is part of the signature; it is not sent with GET and HEAD. Empty
"Ignore Certificate Errors" Accepts an invalid TLS certificate Off

Tab "AWS Signature"

Setting Meaning Default / Required
"Region" Expression for the AWS region, for example eu-central-1. A wrong region is refused even when the address is right. Required
"Service Name" Expression for the short service name AWS uses in the endpoint, for example execute-api (API Gateway), lambda, s3, sns Required
"Access Key Id" Expression for the access key ID Required
"Secret Access Key" Expression for the secret access key Required
"Session Token" Expression for the session token of temporary credentials (AWS STS, an assumed role). Empty for a long-lived access key. Empty

Tab "Request Headers"

The plus button adds a header with "Name" and "Value", both expressions. The headers are signed with the request. Do not set Authorization, Host or X-Amz-Date – the signature writes them. Set the Content-Type here when the service expects one; nothing is sent by default.

Tab "Response"

Setting Meaning
"Response Headers Variable" Headers of the answer as a JSON array of objects with name and values
"Response Code Variable" HTTP status code as a number
"Response Body Variable" Body of the answer as text. Without it, the body is discarded.
"Has Error Variable" true when the request was not sent or did not get an answer, otherwise false
"Error Variable" The reason; empty on success

All response variables are optional.

3. Behaviour

  1. The expressions are evaluated.
  2. If "Url", "Region", "Service Name", "Access Key Id" or "Secret Access Key" is empty, or the address is not an absolute http/https address, the request is not sent: "Has Error Variable" is set to true, "Error Variable" names the missing value (for example "No region configured") and the command is skipped.
  3. The request is signed with the current time and sent.
  4. Redirects are not followed. The signature is only valid for the original address; a redirect arrives as its status code (for example 301 or 307).
  5. Every answer – including 403 – is written into the response variables and "Has Error Variable" is set to false. AWS answers a signature it does not accept with 403 and the reason in the body.
  6. If the request fails without an answer, "Has Error Variable" is true and "Error Variable" holds the reason. In this case status, headers and body variables are not changed.
  7. The action continues in every case.

The signature contains the time of the server. If the clock of the application server is wrong by more than a few minutes, AWS refuses the request.

4. Examples

Call an API Gateway endpoint protected by IAM.

  • "Method" POST
  • "Url" https://a1b2c3.execute-api.eu-central-1.amazonaws.com/prod/orders
  • "Body" the order as JSON; header Content-Type = application/json
  • "Region" eu-central-1, "Service Name" execute-api
  • "Access Key Id" and "Secret Access Key" from two global values
  • "Response Code Variable" Status, "Response Body Variable" Answer, "Has Error Variable" Failed

A following Switch treats Failed = true and Status other than 200 as errors.

5. Limitations

  • Only Signature Version 4 with access keys; the command cannot obtain temporary credentials itself.
  • Redirects are not followed.
  • The body is text; binary uploads are not supported.
  • The access keys are expressions of the action or of global values and are stored readable. Use an IAM user or role that may do only what nexxcite needs (see API access and credentials).