Calculating the HMAC-SHA Signature for Amazon SWF

Signing Process

1. Create a canonical form of the HTTP request headers. The canonical form of the HTTP header includes the following.

   • host

   • Any header element starting with x-amz-

   For more information about the included headers, see HTTP Header Contents.

   1. For each header name-value pair, convert the header name to lowercase (not the header value).

   2. Build a map of header name to comma separated header values as prescribed by RFC 2616, section 4.2.

      x-amz-example: value1
      x-amz-example: value2  =>  x-amz-example:value1,value2

   3. For each header name-value pair, convert the name-value pair into a string in the format headerName:headerValue. Trim any whitespace from the beginning and end of both headerName and headerValue, with no space on each side of the colon.

      x-amz-example1:value1,value2
      x-amz-example2:value3

   4. Insert a new line (U+000A) after each converted string, including the last string.

   5. Sort the collection of converted strings by header name, alphabetically.

2. Create a string-to-sign value that includes the following.

   • Line 1: The HTTP method (POST), followed by a newline.

   • Line 2: The request URI (/), followed by a newline.

   • Line 3: An empty string. Typically, a query string goes here, but Amazon SWF doesn't use a query string. Follow with a newline

   • Line 4–n: The string representing that canonicalized request headers you computed in step 1, followed by a newline. This newline will create a blank line between the headers and the body of the HTTP request per RFC 2616.

   • The request body. Do not follow the request body with a newline.

3. Compute the SHA256 or SHA1 digest of the string-to-sign value. Use the same SHA method throughout the process.

4. Compute and Base64 encode the HMAC-SHA using either a SHA256 or a SHA1 digest (depending on which one you've chosen to use) of the resulting value from the previous step using the temporary secret access key you received from the AWS Security Token Service using the GetSessionToken API. For more information about using temporary security credentials with Amazon SWF and other Amazon Web Services, go to the Identity and Access Management documentation.

   Note

   Amazon SWF expects an equal sign (=) at the end of the Base64 encoded HMAC-SHA value. If your Base64 encoding routine doesn't include appending an equal sign, append one to the end.

5. Put the resulting value as the value for the Signature name in the x-amzn-authorization header of the HTTP request to Amazon SWF.

6. Amazon SWF verifies the request and performs the specified operation.