菜单
开源 RSS

SignatureV4

注意

在某些情况下,使用此库的操作可能会影响性能并扭曲您的测试结果。

为确保结果准确,请考虑在 setupteardown 生命周期函数中执行这些操作。这些函数在测试运行之前和之后执行,不会影响测试结果。

使用 SignatureV4,您可以向 AWS 服务发起已认证的 HTTP 请求。具体来说,它允许您使用 Signature V4 算法对 AWS 服务的请求进行签名和预签名。sign 操作生成包含授权信息存储在请求头中的签名请求。presign 操作生成包含授权信息存储在查询字符串参数中的预签名请求。

SignatureV4 包含在专用的 jslib signature.js 包以及包含所有服务客户端的 aws.js 包中。

实例化一个新的 SignatureV4 需要一个选项对象参数,包含以下属性:

属性类型描述
servicestring用于签名或预签名请求的 AWS 区域。如 Amazon AWS 文档所述。
regionstring用于签名或预签名请求的 AWS 服务。如 Amazon AWS 文档所述。
credentials一个对象,包含 accessKeyIdsecretAccessKey 和可选的 sessionToken 属性用于签名或预签名请求的 AWS 凭据。
uriEscapePathboolean计算规范请求字符串时是否对请求 URI 路径进行 URI 转义。截至 2017 年末,除了 Amazon S3 之外,所有 AWS 服务都要求这样做
applyChecksumboolean是否计算请求体的校验和并将其作为请求头(签名时)或查询字符串参数(预签名时)包含在内。截至 2017 年末,AWS Glacier 和 Amazon S3 要求这样做,而其他所有 AWS 服务则可选。

方法

方法描述
sign()使用 AWS signature v4 算法对经过身份验证的 HTTP 请求进行签名
presign()使用 AWS signature v4 算法生成已认证的预签名 URL

抛出

SignatureV4 方法在失败时抛出错误。

Error条件
InvalidSignatureError当提供了无效凭据时。

示例

JavaScript
import http from 'k6/http';

import {
  AWSConfig,
  Endpoint,
  SignatureV4,
} from 'https://jslib.k6.io/aws/0.13.0/signature.js';

const awsConfig = new AWSConfig({
  region: __ENV.AWS_REGION,
  accessKeyId: __ENV.AWS_ACCESS_KEY_ID,
  secretAccessKey: __ENV.AWS_SECRET_ACCESS_KEY,
  sessionToken: __ENV.AWS_SESSION_TOKEN,
});

export default function () {
  /**
   * In order to be able to sign an HTTP request's,
   * we need to instantiate a SignatureV4 object.
   */
  const signer = new SignatureV4({
    service: 's3',
    region: awsConfig.region,
    credentials: {
      accessKeyId: awsConfig.accessKeyId,
      secretAccessKey: awsConfig.secretAccessKey,
      sessionToken: awsConfig.sessionToken,
    },

    /**
     * Whether the URI should be escaped or not.
     */
    uriEscapePath: false,

    /**
     * Whether or not the body's hash should be calculated and included
     * in the request.
     */
    applyChecksum: true,
  });

  /**
   * The sign operation will return a new HTTP request with the
   * AWS signature v4 protocol headers added. It returns an Object
   * implementing the SignedHTTPRequest interface, holding a `url` and a `headers`
   * properties, ready to use in the context of k6's http call.
   */
  const signedRequest = signer.sign(
    /**
     * HTTP request description
     */
    {
      /**
       * The HTTP method we will use in the request.
       */
      method: 'GET',

      /**
       * The endpoint of the service we will be making the request to.
       *
       * The endpoint is instantiated from a URL string, of the format: `{scheme}://{hostname}[:{port}]`
       */
      endpoint: new Endpoint('https://s3.us-east-1.amazonaws.com'),

      /**
       * The path of the request.
       */
      path: '/my-bucket/bonjour.txt',

      /**
       * The query parameters to include in the request.
       */
      query: {
        'abc': '123',
        'easy as': ['do', 're', 'mi'],
      },

      /**
       * The headers we will be sending in the request.
       */
      headers: {},

      /**
       * The body of the request.
       */
      body: null,
    },

    /**
     * (optional) Signature operation options allows to override the
     * SignatureV4's options in the context of this specific request.
     */
    {
      /**
       * The date and time to be used as signature metadata. This value should be
       * a Date object, a unix (epoch) timestamp, or a string that can be
       * understood by the JavaScript `Date` constructor.If not supplied, the
       * value returned by `new Date()` will be used.
       */
      signingDate: new Date(),

      /**
       * The service signing name. It will override the service name of the signer
       * in current invocation
       */
      signingService: 's3',

      /**
       * The region name to sign the request. It will override the signing region of the
       * signer in current invocation
       */
      signingRegion: 'us-east-1',
    }
  );

  http.get(signedRequest.url, { headers: signedRequest.headers });
}