{"id":13775819,"url":"https://github.com/cllunsford/aws-signing-proxy","last_synced_at":"2026-01-18T02:42:40.500Z","repository":{"id":52241039,"uuid":"49501867","full_name":"cllunsford/aws-signing-proxy","owner":"cllunsford","description":"Golang http proxy to transparently sign requests to AWS endpoints","archived":false,"fork":false,"pushed_at":"2024-01-16T10:53:02.000Z","size":36,"stargazers_count":147,"open_issues_count":9,"forks_count":52,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-05-11T08:35:48.819Z","etag":null,"topics":["aws-elasticsearch","signed-requests"],"latest_commit_sha":null,"homepage":"https://hub.docker.com/r/cllunsford/aws-signing-proxy/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cllunsford.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2016-01-12T13:31:15.000Z","updated_at":"2025-01-03T21:51:19.000Z","dependencies_parsed_at":"2024-04-24T06:08:11.175Z","dependency_job_id":null,"html_url":"https://github.com/cllunsford/aws-signing-proxy","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/cllunsford/aws-signing-proxy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cllunsford%2Faws-signing-proxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cllunsford%2Faws-signing-proxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cllunsford%2Faws-signing-proxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cllunsford%2Faws-signing-proxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cllunsford","download_url":"https://codeload.github.com/cllunsford/aws-signing-proxy/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cllunsford%2Faws-signing-proxy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28486938,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T22:54:02.790Z","status":"ssl_error","status_checked_at":"2026-01-16T22:50:10.344Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-elasticsearch","signed-requests"],"created_at":"2024-08-03T17:01:51.220Z","updated_at":"2026-01-16T22:55:43.487Z","avatar_url":"https://github.com/cllunsford.png","language":"Go","funding_links":[],"categories":["\u003ca id=\"d03d494700077f6a65092985c06bf8e8\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"b6f25145e99ea944cbb528a24afaa0be\"\u003e\u003c/a\u003eHTTP\u0026\u0026HTTPS"],"readme":"aws-signing-proxy\n=================\n[![Build Status](https://travis-ci.org/cllunsford/aws-signing-proxy.svg?branch=master)](https://travis-ci.org/cllunsford/aws-signing-proxy)\n\naws-signing-proxy is a proxy service, written in go, for automatically signing requests made to AWS endpoints.  It leverages the aws-sdk-go library to sign requests to arbitrary URLs in AWS.  I wrote it to connect a kibana instance to an AWS Elasticsearch cluster using an IAM role instead of hard-coding IPs in the access policy.  Other uses may exist.\n\nDocker image: https://hub.docker.com/r/cllunsford/aws-signing-proxy/\n\n## Usage\n\n```\nexport AWS_ACCESS_KEY_ID=\u003cxxx\u003e\nexport AWS_SECRET_ACCESS_KEY=\u003cxxx\u003e\nexport AWS_REGION=\u003cxxx\u003e\nexport AWS_PROFILE=\u003cxxx\u003e  # Optional\n./aws-signing-proxy -target https://search-my-cluster.us-west-2.es.amazonaws.com [-port 8080] [-service es]\n```\n\nFlags\n\nGeneral:\n\n * `-target` - AWS service to send requests to.  Required.\n * `-port` - Port for the proxy to LISTEN on (will forward to whatever port you specify in target), default: `8080`.\n * `-service` - The AWS service type you are sending to, default: `es`.  This is required for the signing process.\n\nHTTP Connection Tuning:\n\n * `-flush-interval` - [ReverseProxy](https://golang.org/pkg/net/http/httputil/#ReverseProxy) FlushInterval, default: `0`\n * `-idle-conn-timeout` - [Transport](https://golang.org/pkg/net/http/#Transport) Idle Connection Timeout, default: `90s`\n * `-dial-timeout` - [Transport](https://golang.org/pkg/net/http/#Transport) Dial Timeout, default: `30s`\n\n### Credential chain\n\nAWS credentials are looked up in the following order:\n\n 1. Environment variable accessible to the app\n 2. The `~/.aws/credentials` config file's default profile\n 3. Any [IAM instance profile role](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html) assigned to the instance.\n\n## Building\n\nIf you have go installed, you can build and install the binary natively:\n\n```\ngo install\n```\n\nThe Makefile is used for the production build in travis.  It builds the binary in a [docker](https://docs.docker.com/install/) container. After installing docker:\n\n```\nmake gobuild   # creates the binary\nmake dockbuild # creates a docker image with the binary\n\nor\n\nmake build     # does both\n```\n\n## Notes, Tips\n\n### Signature Expired\n\nIf you see:\n\n`{\"message\":\"Signature expired: 20160415T172935Z is now earlier than 20160415T174424Z (20160415T174924Z - 5 min.)\"}`\n\nverify that the clock/time is in sync on the proxy host.\n\n### Kibana Forbidden index write\n\nFor AWS Elasticsearch, the built-in kibana populates the .kibana index.  If you see:\n\n`ClusterBlockException[blocked by: [FORBIDDEN/8/index write (api)];]`\n\ntry changing the kibana index setting to use a different index.  The [marcbachmann/kibana4](https://github.com/marcbachmann/dockerfile-kibana4) docker image allows you to change this easily by setting the ```KIBANA_INDEX``` environment variable.\n\n## License\n\nMIT 2018 (c) Chris Lunsford\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcllunsford%2Faws-signing-proxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcllunsford%2Faws-signing-proxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcllunsford%2Faws-signing-proxy/lists"}