Req plugin for AWS Signature V4 authentication.

This module provides seamless integration between ex_aws_auth and the Req HTTP client library. It automatically signs requests with AWS Signature V4 without requiring manual header manipulation.

Usage

# Load credentials from environment
creds = AWSAuth.Credentials.from_env()

# Attach to a Req request
Req.new(url: url, method: :post, body: body)
|> AWSAuth.Req.attach(credentials: creds, service: "bedrock")
|> Req.request()

# Or create a reusable client
client =
  Req.new(base_url: "https://bedrock-runtime.us-east-1.amazonaws.com")
  |> AWSAuth.Req.attach(credentials: creds, service: "bedrock")

# Make multiple requests
Req.post!(client, url: "/model/my-model/invoke", json: params)

Options

• :credentials - (required) AWSAuth.Credentials struct or keyword list/map with:

  • :access_key_id - AWS Access Key ID
  • :secret_access_key - AWS Secret Access Key
  • :session_token - AWS Session Token (optional)
  • :region - AWS region (optional, fallback when URL has no region)

• :service - (required) AWS service name (e.g., "s3", "bedrock", "lambda")

• :region - AWS region (optional; overrides URL and credentials region)

• :unsigned_headers - List of header names to exclude from signing (optional)

• :uri_escape_path - Override URI path escaping (optional)

• :apply_checksum_header - Include x-amz-content-sha256 header (optional, default: true)

• :payload - Force :unsigned or :streaming_events payload mode (optional)

• :auth_scheme - Authentication scheme (:sigv4 or :s3express_session; when :s3express_session, emits x-amz-s3session-token instead of x-amz-security-token, optional, default: :sigv4)

How it Works

The plugin adds a request step that:

1. Resolves the signing region (explicit :region > URL > credentials.region > "us-east-1")
2. Signs the request using AWS Signature V4
3. Tracks generated headers (authorization, x-amz-date, x-amz-content-sha256, x-amz-security-token, and host when not caller-supplied) so retries and trusted redirects re-sign cleanly
4. Strips generated signing headers on untrusted cross-origin redirects unless redirect_trusted: true is set on the request

Attach this plugin after any custom plugin that changes the request URL, body, or headers. Request steps appended after AWS signing may make the signature stale.