Changes in Signature Version 4
Signature Version 4 is the current AWS signing protocol. It includes several changes from the previous Signature Version 2:
-
To sign your message, you use a signing key that is derived from your secret access key rather than using the secret access key itself. For more information about deriving keys, see Task 3: Calculate the Signature for AWS Signature Version 4.
-
You derive your signing key from the credential scope, which means that you don't need to include the key itself in the request. Credential scope is represented by a slash-separated string of dimensions in the following order:
-
Date information as an eight-digit string representing the year (YYYY), month (MM), and day (DD) of the request (for example,
20150830). For more information about handling dates, see Handling Dates in Signature Version 4. -
Region information as a lowercase alphanumeric string. Use the region name that is part of the service's endpoint. For services with a globally unique endpoint such as IAM, use
us-east-1. -
Service name information as a lowercase alphanumeric string (for example,
iam). Use the service name that is part of the service's endpoint. For example, the IAM endpoint is https://iam.amazonaws.com, so you use the stringiamas part of theCredentialparameter. -
A special termination string:
aws4_request.
-
-
You use the credential scope in each signing task:
-
If you add signing information to the query string, include the credential scope as part of the
X-Amz-Credentialparameter when you create the canonical request in Task 1: Create a Canonical Request for Signature Version 4. -
You must include the credential scope as part of your string to sign in Task 2: Create a String to Sign for Signature Version 4.
-
Finally, you use the date, region, and service name components of the credential scope to derive your signing key in Task 3: Calculate the Signature for AWS Signature Version 4.
-
