SigV4 (AWS Signature Version 4)

AWS Signature Version 4 (SigV4) is the authentication protocol used for every AWS API request. It signs requests with the caller's access key and secret key, proving identity without transmitting the secret key over the network.

How It Works

1. Create a canonical request (method, URI, query string, headers, payload hash)
2. Create a string to sign (algorithm, date, credential scope, canonical request hash)
3. Calculate the signature using HMAC-SHA256 with a derived signing key
4. Add the signature to the Authorization header

Security Implications

• Any code with access to AWS credentials can make authenticated API calls
• The LiteLLM malware implemented full SigV4 signing to dump Secrets Manager and SSM Parameter Store
• Temporary credentials from IMDS include a session token that must also be included
• SigV4 requests include a timestamp, so replayed requests expire quickly