go-aws-auth

Go-AWS-Auth is a comprehensive, lightweight library for signing requests to Amazon Web Services.

It's easy to use: simply build your HTTP request and call awsauth.Sign(req) before sending your request over the wire.

Full GoDoc Documentation

Supported signing mechanisms

For more info about AWS authentication, see the comprehensive docs at AWS.

Install

Go get it:

$ go get github.com/smartystreets/go-aws-auth

Then import it:

import "github.com/smartystreets/awsauth"

Using your AWS Credentials

The library looks for credentials in this order:

Hard-code: You can manually wire the credentials into awsauth.Keys for testing or spike code:

awsauth.Keys = &awsauth.Credentials{
	AccessKeyID: "Access Key ID", 
	SecretAccessKey: "Secret Access Key",
	SecurityToken: "Security Token",	// STS (optional)
}

Environment variables: Set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables with your credentials. The library will automatically detect and use them. Optionally, you may also set the AWS_SECURITY_TOKEN environment variable if you are using temporary credentials from STS.
IAM Role: If running on EC2 and the credentials are neither hard-coded nor in the environment, go-aws-auth will detect the first IAM role assigned to the current EC2 instance and use those credentials.

Be especially careful with option 1 if the code is committed to source control.

Signing requests

Once your credentials are set up, just make the request, have it signed, and perform the request as usual.

url := "https://iam.amazonaws.com/?Action=ListRoles&Version=2010-05-08"
client := &http.Client{}

req, err := http.NewRequest("GET", url, nil)

awsauth.Sign(req)	// Automatically chooses the best signing mechanism for the service

resp, err := client.Do(req)

Contributing