RE: Signing AWS Requests with Signature Version 4

Thank you so much!
I've looked at this code for so long, I didn't even see the difference in the date.
I'd bang my head against the wall, but I'd damage the wall.

-----Original Message-----
From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Hiebert, Chris
Sent: Monday, July 11, 2022 2:47 PM
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx>
Subject: RE: Signing AWS Requests with Signature Version 4

From the sample at this link you will need to pay attention to the date being used.

https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html

HMAC(HMAC(HMAC(HMAC("AWS4" + kSecret,"20150830"),"us-east-1"),"iam"),"aws4_request")

And they even called out in the text:
Note that the date used in the hashing process is in the format YYYYMMDD (for example, 20150830), and does not include the time.


If you change the date to '20150830' and run it you should see the output at the end matches.
I used '20120215' because that was on the examples page.

C4AFB1CC5771D871763A393E44B703571B55CC28424D1A5E86DA6ED3C154A4B9

In the sample below I used the values from:
https://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html

Given the following test input:

key = 'wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY'
dateStamp = '20120215'
regionName = 'us-east-1'
serviceName = 'iam'





---BTW - If I hover over one of the *HEX fields in RDi, it blows up debug. The program advances to the end and debug disconnects from the SEP.

Looks like you should enter a PMR for that.

I've never tried to debug the code in RDi.
I used CCSID(*HEX) so that I know the system won't attempt any data conversions.


Chris Hiebert
Senior Programmer/Analyst
Disclaimer: Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Greg Wilburn
Sent: Monday, July 11, 2022 11:44 AM
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx>
Subject: RE: Signing AWS Requests with Signature Version 4


Chris,



Thanks a bunch for this! However, I copied it into a new source member, compiled and ran it.



It doesn't produce the same key as in the AWS example.

AWS Example Value:

c4afb1cc5771d871763a393e44b703571b55cc28424d1a5e86da6ed3c154a4b9

OutString:

F4780E2D9F65FA895F9C67B32CE1BAF0B0D8A43505A000A1A9E090D414DB404D



Either I'm doing something wrong, or something is not quite right yet.



BTW - If I hover over one of the *HEX fields in RDi, it blows up debug. The program advances to the end and debug disconnects from the SEP.



Greg