Menü
Amazon Web Services
Allgemeine Referenz (Version 1.0)

Beispiele für den vollständigen Signierprozess in Version 4 (Python)

In diesem Abschnitt werden Beispielprogramme vorgestellt, die in Python geschrieben wurden, um zu zeigen, wie Sie mit Signature Version 4 in AWS arbeiten. Wir haben diese Beispielprogramme bewusst einfach gehalten (mit nur wenigen Python-spezifischen Funktionen), um den Gesamtprozess der Signierung von AWS-Anforderungen leichter verständlich zu machen.

Wenn Sie mit diesen Beispielprogrammen arbeiten möchten, benötigen Sie Folgendes:

  • Python 2.x muss auf Ihrem Computer installiert sein (siehe Python-Website). Diese Programme wurden mit Python 2.7 getestet.

  • Die Python-Bibliothek mit Anforderungen, die im Beispielskript verwendet wird, um Webanforderungen zu versenden. Eine praktische Methode zum Installieren von Python-Paketen ist der Einsatz von pip, das Pakete von der Python-Paketindexseite abruft. Sie können dann requests installieren, indem Sie in der Befehlszeile pip install requests ausführen.

  • Einen Zugriffsschlüssel (Zugriffsschlüssel-ID und geheimer Zugriffsschlüssel) in Umgebungsvariablen namens AWS_ACCESS_KEY_ID und AWS_SECRET_ACCESS_KEY. Alternativ können Sie diese Werte in einer Datei mit Anmeldeinformationen speichern und sie aus dieser Datei lesen. Als bewährte Methode empfehlen wir, Anmeldeinformationen nicht im Code einzubetten. Weitere Informationen finden Sie unter Bewährte Methoden für die Verwaltung von AWS-Zugriffsschlüsseln in Allgemeine Amazon Web Services-Referenz.

Anmerkung

Die folgenden Beispiele verwenden UTF-8, um die kanonische Anforderung und die zu signierende Zeichenfolge zu kodieren, Signature Version 4 verlangt aber nicht die Verwendung einer bestimmten Zeichenkodierung. Bei einigen AWS-Services ist jedoch möglicherweise eine spezielle Kodierung erforderlich. Weitere Informationen finden Sie in der Dokumentation zu dem jeweiligen Service.

Verwenden von GET mit einem Authorization-Header (Python)

Das folgende Beispiel zeigt, wie Sie eine Anforderung mit der Amazon EC2-Abfrage-API erstellen. Die Anforderung versendet eine GET-Anforderung und übergibt Authentifizierungsinformationen an AWS über den Authorization-Header.

Copy
# AWS Version 4 signing example # EC2 API (DescribeRegions) # See: http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html # This version makes a GET request and passes the signature # in the Authorization header. import sys, os, base64, datetime, hashlib, hmac import requests # pip install requests # ************* REQUEST VALUES ************* method = 'GET' service = 'ec2' host = 'ec2.amazonaws.com' region = 'us-east-1' endpoint = 'https://ec2.amazonaws.com' request_parameters = 'Action=DescribeRegions&Version=2013-10-15' # Key derivation functions. See: # http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python def sign(key, msg): return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest() def getSignatureKey(key, dateStamp, regionName, serviceName): kDate = sign(('AWS4' + key).encode('utf-8'), dateStamp) kRegion = sign(kDate, regionName) kService = sign(kRegion, serviceName) kSigning = sign(kService, 'aws4_request') return kSigning # Read AWS access key from env. variables or configuration file. Best practice is NOT # to embed credentials in code. access_key = os.environ.get('AWS_ACCESS_KEY_ID') secret_key = os.environ.get('AWS_SECRET_ACCESS_KEY') if access_key is None or secret_key is None: print 'No access key is available.' sys.exit() # Create a date for headers and the credential string t = datetime.datetime.utcnow() amzdate = t.strftime('%Y%m%dT%H%M%SZ') datestamp = t.strftime('%Y%m%d') # Date w/o time, used in credential scope # ************* TASK 1: CREATE A CANONICAL REQUEST ************* # http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html # Step 1 is to define the verb (GET, POST, etc.)--already done. # Step 2: Create canonical URI--the part of the URI from domain to query # string (use '/' if no path) canonical_uri = '/' # Step 3: Create the canonical query string. In this example (a GET request), # request parameters are in the query string. Query string values must # be URL-encoded (space=%20). The parameters must be sorted by name. # For this example, the query string is pre-formatted in the request_parameters variable. canonical_querystring = request_parameters # Step 4: Create the canonical headers and signed headers. Header names # must be trimmed and lowercase, and sorted in code point order from # low to high. Note that there is a trailing \n. canonical_headers = 'host:' + host + '\n' + 'x-amz-date:' + amzdate + '\n' # Step 5: Create the list of signed headers. This lists the headers # in the canonical_headers list, delimited with ";" and in alpha order. # Note: The request can include any headers; canonical_headers and # signed_headers lists those that you want to be included in the # hash of the request. "Host" and "x-amz-date" are always required. signed_headers = 'host;x-amz-date' # Step 6: Create payload hash (hash of the request body content). For GET # requests, the payload is an empty string (""). payload_hash = hashlib.sha256('').hexdigest() # Step 7: Combine elements to create create canonical request canonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hash # ************* TASK 2: CREATE THE STRING TO SIGN************* # Match the algorithm to the hashing algorithm you use, either SHA-1 or # SHA-256 (recommended) algorithm = 'AWS4-HMAC-SHA256' credential_scope = datestamp + '/' + region + '/' + service + '/' + 'aws4_request' string_to_sign = algorithm + '\n' + amzdate + '\n' + credential_scope + '\n' + hashlib.sha256(canonical_request).hexdigest() # ************* TASK 3: CALCULATE THE SIGNATURE ************* # Create the signing key using the function defined above. signing_key = getSignatureKey(secret_key, datestamp, region, service) # Sign the string_to_sign using the signing_key signature = hmac.new(signing_key, (string_to_sign).encode('utf-8'), hashlib.sha256).hexdigest() # ************* TASK 4: ADD SIGNING INFORMATION TO THE REQUEST ************* # The signing information can be either in a query string value or in # a header named Authorization. This code shows how to use a header. # Create authorization header and add to request headers authorization_header = algorithm + ' ' + 'Credential=' + access_key + '/' + credential_scope + ', ' + 'SignedHeaders=' + signed_headers + ', ' + 'Signature=' + signature # The request can include any headers, but MUST include "host", "x-amz-date", # and (for this scenario) "Authorization". "host" and "x-amz-date" must # be included in the canonical_headers and signed_headers, as noted # earlier. Order here is not significant. # Python note: The 'host' header is added automatically by the Python 'requests' library. headers = {'x-amz-date':amzdate, 'Authorization':authorization_header} # ************* SEND THE REQUEST ************* request_url = endpoint + '?' + canonical_querystring print '\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++' print 'Request URL = ' + request_url r = requests.get(request_url, headers=headers) print '\nRESPONSE++++++++++++++++++++++++++++++++++++' print 'Response code: %d\n' % r.status_code print r.text

Mit POST (Python)

Das folgende Beispiel zeigt, wie Sie eine Anforderung mit der Amazon DynamoDB-Abfrage-API erstellen. Die Anforderung versendet eine POST-Anforderung und übergibt Werte an AWS im Text der Anforderung. Die Authentifizierungsdaten werden über den Authorization-Abfrageheader weitergegeben.

Copy
# AWS Version 4 signing example # DynamoDB API (CreateTable) # See: http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html # This version makes a POST request and passes request parameters # in the body (payload) of the request. Auth information is passed in # an Authorization header. import sys, os, base64, datetime, hashlib, hmac import requests # pip install requests # ************* REQUEST VALUES ************* method = 'POST' service = 'dynamodb' host = 'dynamodb.us-west-2.amazonaws.com' region = 'us-west-2' endpoint = 'https://dynamodb.us-west-2.amazonaws.com/' # POST requests use a content type header. For DynamoDB, # the content is JSON. content_type = 'application/x-amz-json-1.0' # DynamoDB requires an x-amz-target header that has this format: # DynamoDB_<API version>.<operationName> amz_target = 'DynamoDB_20120810.CreateTable' # Request parameters for CreateTable--passed in a JSON block. request_parameters = '{' request_parameters += '"KeySchema": [{"KeyType": "HASH","AttributeName": "Id"}],' request_parameters += '"TableName": "TestTable","AttributeDefinitions": [{"AttributeName": "Id","AttributeType": "S"}],' request_parameters += '"ProvisionedThroughput": {"WriteCapacityUnits": 5,"ReadCapacityUnits": 5}' request_parameters += '}' # Key derivation functions. See: # http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python def sign(key, msg): return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest() def getSignatureKey(key, date_stamp, regionName, serviceName): kDate = sign(('AWS4' + key).encode('utf-8'), date_stamp) kRegion = sign(kDate, regionName) kService = sign(kRegion, serviceName) kSigning = sign(kService, 'aws4_request') return kSigning # Read AWS access key from env. variables or configuration file. Best practice is NOT # to embed credentials in code. access_key = os.environ.get('AWS_ACCESS_KEY_ID') secret_key = os.environ.get('AWS_SECRET_ACCESS_KEY') if access_key is None or secret_key is None: print 'No access key is available.' sys.exit() # Create a date for headers and the credential string t = datetime.datetime.utcnow() amz_date = t.strftime('%Y%m%dT%H%M%SZ') date_stamp = t.strftime('%Y%m%d') # Date w/o time, used in credential scope # ************* TASK 1: CREATE A CANONICAL REQUEST ************* # http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html # Step 1 is to define the verb (GET, POST, etc.)--already done. # Step 2: Create canonical URI--the part of the URI from domain to query # string (use '/' if no path) canonical_uri = '/' ## Step 3: Create the canonical query string. In this example, request # parameters are passed in the body of the request and the query string # is blank. canonical_querystring = '' # Step 4: Create the canonical headers. Header names must be trimmed # and lowercase, and sorted in code point order from low to high. # Note that there is a trailing \n. canonical_headers = 'content-type:' + content_type + '\n' + 'host:' + host + '\n' + 'x-amz-date:' + amz_date + '\n' + 'x-amz-target:' + amz_target + '\n' # Step 5: Create the list of signed headers. This lists the headers # in the canonical_headers list, delimited with ";" and in alpha order. # Note: The request can include any headers; canonical_headers and # signed_headers include those that you want to be included in the # hash of the request. "Host" and "x-amz-date" are always required. # For DynamoDB, content-type and x-amz-target are also required. signed_headers = 'content-type;host;x-amz-date;x-amz-target' # Step 6: Create payload hash. In this example, the payload (body of # the request) contains the request parameters. payload_hash = hashlib.sha256(request_parameters).hexdigest() # Step 7: Combine elements to create create canonical request canonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hash # ************* TASK 2: CREATE THE STRING TO SIGN************* # Match the algorithm to the hashing algorithm you use, either SHA-1 or # SHA-256 (recommended) algorithm = 'AWS4-HMAC-SHA256' credential_scope = date_stamp + '/' + region + '/' + service + '/' + 'aws4_request' string_to_sign = algorithm + '\n' + amz_date + '\n' + credential_scope + '\n' + hashlib.sha256(canonical_request).hexdigest() # ************* TASK 3: CALCULATE THE SIGNATURE ************* # Create the signing key using the function defined above. signing_key = getSignatureKey(secret_key, date_stamp, region, service) # Sign the string_to_sign using the signing_key signature = hmac.new(signing_key, (string_to_sign).encode('utf-8'), hashlib.sha256).hexdigest() # ************* TASK 4: ADD SIGNING INFORMATION TO THE REQUEST ************* # Put the signature information in a header named Authorization. authorization_header = algorithm + ' ' + 'Credential=' + access_key + '/' + credential_scope + ', ' + 'SignedHeaders=' + signed_headers + ', ' + 'Signature=' + signature # For DynamoDB, the request can include any headers, but MUST include "host", "x-amz-date", # "x-amz-target", "content-type", and "Authorization". Except for the authorization # header, the headers must be included in the canonical_headers and signed_headers values, as # noted earlier. Order here is not significant. # # Python note: The 'host' header is added automatically by the Python 'requests' library. headers = {'Content-Type':content_type, 'X-Amz-Date':amz_date, 'X-Amz-Target':amz_target, 'Authorization':authorization_header} # ************* SEND THE REQUEST ************* print '\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++' print 'Request URL = ' + endpoint r = requests.post(endpoint, data=request_parameters, headers=headers) print '\nRESPONSE++++++++++++++++++++++++++++++++++++' print 'Response code: %d\n' % r.status_code print r.text

Verwenden von GET mit Authentifizierungsinformationen in der Abfragezeichenfolge (Python)

Das folgende Beispiel zeigt, wie Sie eine Anforderung mit der IAM-Abfrage-API erstellen. Die Anforderung versendet eine GET-Anforderung und übergibt Parameter und Signierinformationen über die Abfragezeichenfolge.

Copy
# AWS Version 4 signing example # IAM API (CreateUser) # See: http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html # This version makes a GET request and passes request parameters # and authorization information in the query string import sys, os, base64, datetime, hashlib, hmac, urllib import requests # pip install requests # ************* REQUEST VALUES ************* method = 'GET' service = 'iam' host = 'iam.amazonaws.com' region = 'us-east-1' endpoint = 'https://iam.amazonaws.com' # Key derivation functions. See: # http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python def sign(key, msg): return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest() def getSignatureKey(key, dateStamp, regionName, serviceName): kDate = sign(('AWS4' + key).encode('utf-8'), dateStamp) kRegion = sign(kDate, regionName) kService = sign(kRegion, serviceName) kSigning = sign(kService, 'aws4_request') return kSigning # Read AWS access key from env. variables or configuration file. Best practice is NOT # to embed credentials in code. access_key = os.environ.get('AWS_ACCESS_KEY_ID') secret_key = os.environ.get('AWS_SECRET_ACCESS_KEY') if access_key is None or secret_key is None: print 'No access key is available.' sys.exit() # Create a date for headers and the credential string t = datetime.datetime.utcnow() amz_date = t.strftime('%Y%m%dT%H%M%SZ') # Format date as YYYYMMDD'T'HHMMSS'Z' datestamp = t.strftime('%Y%m%d') # Date w/o time, used in credential scope # ************* TASK 1: CREATE A CANONICAL REQUEST ************* # http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html # Because almost all information is being passed in the query string, # the order of these steps is slightly different than examples that # use an authorization header. # Step 1: Define the verb (GET, POST, etc.)--already done. # Step 2: Create canonical URI--the part of the URI from domain to query # string (use '/' if no path) canonical_uri = '/' # Step 3: Create the canonical headers and signed headers. Header names # must be trimmed and lowercase, and sorted in code point order from # low to high. Note trailing \n in canonical_headers. # signed_headers is the list of headers that are being included # as part of the signing process. For requests that use query strings, # only "host" is included in the signed headers. canonical_headers = 'host:' + host + '\n' signed_headers = 'host' # Match the algorithm to the hashing algorithm you use, either SHA-1 or # SHA-256 (recommended) algorithm = 'AWS4-HMAC-SHA256' credential_scope = datestamp + '/' + region + '/' + service + '/' + 'aws4_request' # Step 4: Create the canonical query string. In this example, request # parameters are in the query string. Query string values must # be URL-encoded (space=%20). The parameters must be sorted by name. canonical_querystring = 'Action=CreateUser&UserName=NewUser&Version=2010-05-08' canonical_querystring += '&X-Amz-Algorithm=AWS4-HMAC-SHA256' canonical_querystring += '&X-Amz-Credential=' + urllib.quote_plus(access_key + '/' + credential_scope) canonical_querystring += '&X-Amz-Date=' + amz_date canonical_querystring += '&X-Amz-Expires=30' canonical_querystring += '&X-Amz-SignedHeaders=' + signed_headers # Step 5: Create payload hash. For GET requests, the payload is an # empty string (""). payload_hash = hashlib.sha256('').hexdigest() # Step 6: Combine elements to create create canonical request canonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hash # ************* TASK 2: CREATE THE STRING TO SIGN************* string_to_sign = algorithm + '\n' + amz_date + '\n' + credential_scope + '\n' + hashlib.sha256(canonical_request).hexdigest() # ************* TASK 3: CALCULATE THE SIGNATURE ************* # Create the signing key signing_key = getSignatureKey(secret_key, datestamp, region, service) # Sign the string_to_sign using the signing_key signature = hmac.new(signing_key, (string_to_sign).encode("utf-8"), hashlib.sha256).hexdigest() # ************* TASK 4: ADD SIGNING INFORMATION TO THE REQUEST ************* # The auth information can be either in a query string # value or in a header named Authorization. This code shows how to put # everything into a query string. canonical_querystring += '&X-Amz-Signature=' + signature # ************* SEND THE REQUEST ************* # The 'host' header is added automatically by the Python 'request' lib. But it # must exist as a header in the request. request_url = endpoint + "?" + canonical_querystring print '\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++' print 'Request URL = ' + request_url r = requests.get(request_url) print '\nRESPONSE++++++++++++++++++++++++++++++++++++' print 'Response code: %d\n' % r.status_code print r.text