Articles in this section

aws4 helper

Tom Santiago
Updated

The aws4 helper generates an AWS Signature Version 4 string for authenticating API requests to Amazon Web Services. Pass your AWS credentials and service details, then include the returned signature in the Authorization header of your HTTP request.

Note: Use triple braces ({{{ }}}) with this helper to prevent Celigo from encoding the signature string.

Syntax

{{{aws4 accessKey secretKey sessionToken region serviceName}}}

accessKey -- Your AWS access key (e.g. "AKIA..."). Required. Store this in connection.http.encrypted to avoid exposing it in plain text.

secretKey -- Your AWS secret key. Required. Store this in connection.http.encrypted.

sessionToken -- A temporary session token for short-lived credentials. Optional. Pass null or "" if your environment doesn't use session tokens.

region -- The AWS region for the request (e.g. "us-east-1", "us-west-2"). Optional. Pass "" to infer from the request URL, though explicitly specifying the region is recommended to avoid signature mismatches.

serviceName -- The AWS service name (e.g. "execute-api", "s3"). Optional. Pass "" to infer from the request URL, though explicitly specifying the service is recommended.

Examples

Sign a request with hard-coded credentials

{{{aws4 "AKIAxxxxxxxx" "xxxxxxxxxxxxxx" null "us-east-1" "execute-api"}}}

Generates a signature for the execute-api service in the us-east-1 region. Use hard-coded credentials for testing only -- store credentials in encrypted connection fields for production flows.

Sign a request using encrypted connection fields

{{{aws4 connection.http.encrypted.accessKey
        connection.http.encrypted.secretKey
        null
        "us-west-2"
        "s3"}}}

References credentials stored securely in the connection object. This is the recommended approach for production flows. This example signs requests for S3 in us-west-2.

Sign a request with a session token

{{{aws4 connection.http.encrypted.accessKey
        connection.http.encrypted.secretKey
        connection.http.encrypted.sessionToken
        "us-east-1"
        "execute-api"}}}

Pass a session token when your AWS environment uses temporary credentials (e.g. via AWS STS).

Usage notes

  • Always use triple braces ({{{ }}}). Double braces will encode the signature and cause authentication failures.
  • Always specify region and serviceName explicitly. Relying on inferred values can produce mismatches with AWS.
  • Store accessKey, secretKey, and sessionToken in connection.http.encrypted fields to keep credentials out of plain text.
  • Some AWS services require an X-Amz-Date header in addition to the Authorization header. Use the timestamp helper to generate it in the correct format:
"X-Amz-Date": "{{{timestamp "YYYYMMDDTHHmmss" "Etc/GMT-0"}}}Z"