requests-aws-iam-auth 0.2.0

Description:

requestsawsiamauth 0.2.0

Requests AWS IAM Auth
An AWS IAM authentication package for Requests. Supported services: API Gateway v1. This is intended for use in production environments at the 1.0 release.
Example
API Gateway v1
import requests
import requests_aws_iam_auth

# Provide AWS creds and config per Boto3 specs: https://tknk.io/ri3v
auth = requests_aws_iam_auth.ApiGateway()

requests.get("https://p7xw90rcx4.execute-api.us-east-1.amazonaws.com/s/", auth=auth)

Developer Information
Dependencies
Botocore
Headers
authorization, and x-amz-content-sha256 are directly modified in the signing protocal and will be set.
Expect for authorization, connection, expect, user-agent, x-amz-content-sha256, x-amz-security-token and x-amzn-trace-id all user set headers are signed.
If the user does not specify host it is derived and signed.
If the method is not GET, HEAD, or OPTIONS, has a payload, and the user does not provide a content-length header it is derived and signed.
If there's a Date header, we set the date header. Otherwise, we set the X-Amz-Date header.
The underlying http.client will derive an unsigned accept-encoding header if not user specified.
If using STS x-amz-security-token will be set by this library.
Payload
The payload is always signed using SHA 256.
Protocols
HTTP and HTTPS 1.1 are supported.
Python
Latest three minor versions of python will be supported.
Contributor Notes
This library uses botocore for signing.
Requests uses urllib3 which uses http.client.
Botocore relies on http.client deriving the host when absent. Botocore replacates this deravation and signs with it but does not append the header to the sent request. This has the potential for a mismatch error. There is a TODO in botocore to set the host header in the request.
Maintainers
Core
Mateus Amin and Benton Drew
API Gateway v1
Mateus Amin and Benton Drew
Some Other Service
????
References

https://docs.python.org/3/library/http.client.html#module-http.client
https://hg.python.org/cpython/file/3.2/Lib/http/client.py
https://github.com/urllib3/urllib3/blob/063d888bc247eb6bd7aedcd32412bbb53c3c6ffb/src/urllib3/connection.py#L195
https://github.com/psf/requests/blob/7b565d886c852609a849e79e4ad8f3f8fa8d8c23/requests/adapters.py#L166

TODO

Add testing of three most recent python versions. Use docker not tox. No reason to bloat the stack.
Add fuzzing?
Add CI build. Keep it portable and deterministic.
Support AWS API Gateway v2 if it adds IAM Auth as a feature. Same for HTTP2.
Add Requests v3 support.
connection header. The connection header is set to blank between post auth and the server signing (inclusive). Could be a AWS, Requests, urllib3, botocore, or http.client. Have ruled out botocore. Can rule out the urllib3 and http.client by reading the sent request on the wire. As a temporary workaround we do not sign it.