20121207/us-east-1/redshift/aws4_request
06b6bef4f4f060a5558b60c627cc6c5b5b5a959b9902b5ac2187be80cbac0714
The first line of the string to sign is the algorithm, the second line is the time stamp, the third line is the
credential scope, and the last line is a hash of the canonical request from
Task 1: Create a Canonical
Request (p. 124)
. The service name to use in the credential scope is
redshift
.
For
Task 3: Create a Signature (p. 124)
, the derived key can be represented as:
derived key = HMAC(HMAC(HMAC(HMAC("AWS4" + YourSecretAccessKey,"20121207"),"us-
east-1"),"redshift"),"aws4_request")
The derived key is calculated as series of hash functions. Starting from the inner HMAC statement in the
formula above, you concatenate the phrase "AWS4" with your secret access key and use this as the key
to hash the data "us-east-1". The result of this hash becomes the key for the next hash function.
After you calculate the derived key, you use it in a hash function that accepts two input strings, your string
to sign and the derived key. For example, if you use the secret access key
wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
and the string to sign given earlier, then the calculated
signature is as follows:
9a6b557aa9f38dea83d9215d8f0eae54100877f3e0735d38498d7ae489117920
The final step is to construct the
Authorization
header. For the demonstration access key
AKIAIOSFODNN7EXAMPLE
, the header (with line breaks added for readability) is:
Authorization: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20121207/us-
east-1/redshift/aws4_request,
SignedHeaders=content-type;host;x-amz-date,
Signature=9a6b557aa9f38dea83d9215d8f0eae54100877f3e0735d38498d7ae489117920
API Version 2012-12-01
126
Amazon Redshift Management Guide
Example Signature Calculation
