AWS Request Signing plugin

Partner Plugin: This plugin is developed, tested, and maintained by a third-party contributor.

This plugin allows for secure communication with AWS Lambdas. It signs requests with AWS SIGV4 and temporary credentials obtained from sts.amazonaws.com using an OAuth token. This eliminates the need for an AWS API Gateway and simplifies the use of Lambdas as upstreams in Kong.

However, in order to use this plugin, there is an AWS setup required. Specifically, you will need to add your token issuer to the “Identity Providers” in your AWS account, this way the plugin can request temporary credentials.

For more information on the required AWS setup, visit the plugin repo.

Once this is done, you can use the plugin to communicate with your Lambda HTTPS endpoint.

Configuration Reference

This plugin is compatible with DB-less mode.

Example plugin configuration

Enable on a service

Enable on a route

Enable on a consumer

Enable globally

The following examples provide some typical configurations for enabling the aws-request-signing plugin on a service.

Admin API

Kubernetes

Declarative (YAML)

Make the following request:

curl -X POST http://localhost:8001/services/SERVICE_NAME|SERVICE_ID/plugins \
    --data "name=aws-request-signing"  \
    --data "config.aws_assume_role_arn=arn:aws:iam::123456789012:role/example-role" \
    --data "config.aws_assume_role_name=example-role" \
    --data "config.aws_region=us-east-1" \
    --data "config.aws_service=lambda" \
    --data "config.override_target_host=example.com" \
    --data "config.override_target_port=443" \
    --data "config.override_target_protocol=https"

Replace SERVICE_NAME|SERVICE_ID with the id or name of the service that this plugin configuration will target.

First, create a KongPlugin resource:

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: aws-request-signing-example
config: 
  aws_assume_role_arn: arn:aws:iam::123456789012:role/example-role
  aws_assume_role_name: example-role
  aws_region: us-east-1
  aws_service: lambda
  override_target_host: example.com
  override_target_port: 443
  override_target_protocol: https
plugin: aws-request-signing

Next, apply the KongPlugin resource to a service by annotating the service as follows:

apiVersion: v1
kind: Service
metadata:
  name: SERVICE_NAME|SERVICE_ID
  labels:
    app: SERVICE_NAME|SERVICE_ID
  annotations:
    konghq.com/plugins: aws-request-signing-example
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: SERVICE_NAME|SERVICE_ID
  selector:
    app: SERVICE_NAME|SERVICE_ID

Replace SERVICE_NAME|SERVICE_ID with the id or name of the service that this plugin configuration will target.

Note: The KongPlugin resource only needs to be defined once and can be applied to any service, consumer, or route in the namespace. If you want the plugin to be available cluster-wide, create the resource as a KongClusterPlugin instead of KongPlugin.

Add this section to your declarative configuration file:

plugins:
- name: aws-request-signing
  service: SERVICE_NAME|SERVICE_ID
  config: 
    aws_assume_role_arn: arn:aws:iam::123456789012:role/example-role
    aws_assume_role_name: example-role
    aws_region: us-east-1
    aws_service: lambda
    override_target_host: example.com
    override_target_port: 443
    override_target_protocol: https

Replace SERVICE_NAME|SERVICE_ID with the id or name of the service that this plugin configuration will target.

The following examples provide some typical configurations for enabling the aws-request-signing plugin on a route.

Admin API

Kubernetes

Declarative (YAML)

Make the following request:

curl -X POST http://localhost:8001/routes/ROUTE_NAME|ROUTE_ID/plugins \
  --data "name=aws-request-signing"  \
    --data "config.aws_assume_role_arn=arn:aws:iam::123456789012:role/example-role" \
    --data "config.aws_assume_role_name=example-role" \
    --data "config.aws_region=us-east-1" \
    --data "config.aws_service=lambda" \
    --data "config.override_target_host=example.com" \
    --data "config.override_target_port=443" \
    --data "config.override_target_protocol=https"

Replace ROUTE_NAME|ROUTE_ID with the id or name of the route that this plugin configuration will target.

First, create a KongPlugin resource:

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: aws-request-signing-example
config: 
  aws_assume_role_arn: arn:aws:iam::123456789012:role/example-role
  aws_assume_role_name: example-role
  aws_region: us-east-1
  aws_service: lambda
  override_target_host: example.com
  override_target_port: 443
  override_target_protocol: https
plugin: aws-request-signing

Then, apply it to an ingress (route or routes) by annotating the ingress as follows:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ROUTE_NAME|ROUTE_ID
  annotations:
    kubernetes.io/ingress.class: kong
    konghq.com/plugins: aws-request-signing-example
spec:
  rules:
  - host: examplehostname.com
    http:
      paths:
      - path: /bar
        backend:
          service:
            name: echo
            port:
              number: 80

Replace ROUTE_NAME|ROUTE_ID with the id or name of the route that this plugin configuration will target.

Note: The KongPlugin resource only needs to be defined once and can be applied to any service, consumer, or route in the namespace. If you want the plugin to be available cluster-wide, create the resource as a KongClusterPlugin instead of KongPlugin.

Add this section to your declarative configuration file:

plugins:
- name: aws-request-signing
  route: ROUTE_NAME
  config: 
    aws_assume_role_arn: arn:aws:iam::123456789012:role/example-role
    aws_assume_role_name: example-role
    aws_region: us-east-1
    aws_service: lambda
    override_target_host: example.com
    override_target_port: 443
    override_target_protocol: https

Replace ROUTE_NAME|ROUTE_ID with the id or name of the route that this plugin configuration will target.

The following examples provide some typical configurations for enabling the aws-request-signing plugin on a consumer.

Admin API

Kubernetes

Declarative (YAML)

Make the following request:

curl -X POST http://localhost:8001/consumers/CONSUMER_NAME|CONSUMER_ID/plugins \
  --data "name=aws-request-signing"  \
    --data "config.aws_assume_role_arn=arn:aws:iam::123456789012:role/example-role" \
    --data "config.aws_assume_role_name=example-role" \
    --data "config.aws_region=us-east-1" \
    --data "config.aws_service=lambda" \
    --data "config.override_target_host=example.com" \
    --data "config.override_target_port=443" \
    --data "config.override_target_protocol=https"

Replace CONSUMER_NAME|CONSUMER_ID with the id or name of the consumer that this plugin configuration will target.

You can combine consumer.id, service.id, or route.id in the same request, to further narrow the scope of the plugin.

First, create a KongPlugin resource:

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: aws-request-signing-example
config: 
  aws_assume_role_arn: arn:aws:iam::123456789012:role/example-role
  aws_assume_role_name: example-role
  aws_region: us-east-1
  aws_service: lambda
  override_target_host: example.com
  override_target_port: 443
  override_target_protocol: https
plugin: aws-request-signing

Then, apply it to a consumer by annotating the KongConsumer resource as follows:

apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: CONSUMER_NAME|CONSUMER_ID
  annotations:
    konghq.com/plugins: aws-request-signing-example
    kubernetes.io/ingress.class: kong

Replace CONSUMER_NAME|CONSUMER_ID with the id or name of the consumer that this plugin configuration will target.

Note: The KongPlugin resource only needs to be defined once and can be applied to any service, consumer, or route in the namespace. If you want the plugin to be available cluster-wide, create the resource as a KongClusterPlugin instead of KongPlugin.

Add this section to your declarative configuration file:

plugins:
- name: aws-request-signing
  consumer: CONSUMER_NAME|CONSUMER_ID
  config: 
    aws_assume_role_arn: arn:aws:iam::123456789012:role/example-role
    aws_assume_role_name: example-role
    aws_region: us-east-1
    aws_service: lambda
    override_target_host: example.com
    override_target_port: 443
    override_target_protocol: https

Replace CONSUMER_NAME|CONSUMER_ID with the id or name of the consumer that this plugin configuration will target.

A plugin which is not associated to any service, route, or consumer is considered global, and will be run on every request. Read the Plugin Reference and the Plugin Precedence sections for more information.

The following examples provide some typical configurations for enabling the aws-request-signing plugin globally.

Admin API

Kubernetes

Declarative (YAML)

Make the following request:

curl -X POST http://localhost:8001/plugins/ \
  --data "name=aws-request-signing"  \
    --data "config.aws_assume_role_arn=arn:aws:iam::123456789012:role/example-role" \
    --data "config.aws_assume_role_name=example-role" \
    --data "config.aws_region=us-east-1" \
    --data "config.aws_service=lambda" \
    --data "config.override_target_host=example.com" \
    --data "config.override_target_port=443" \
    --data "config.override_target_protocol=https"

Create a KongClusterPlugin resource and label it as global:

apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: <global-aws-request-signing>
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: \"true\"
config: 
  aws_assume_role_arn: arn:aws:iam::123456789012:role/example-role
  aws_assume_role_name: example-role
  aws_region: us-east-1
  aws_service: lambda
  override_target_host: example.com
  override_target_port: 443
  override_target_protocol: https
plugin: aws-request-signing

Add a plugins entry in the declarative configuration file:

plugins:
- name: aws-request-signing
  config: 
    aws_assume_role_arn: arn:aws:iam::123456789012:role/example-role
    aws_assume_role_name: example-role
    aws_region: us-east-1
    aws_service: lambda
    override_target_host: example.com
    override_target_port: 443
    override_target_protocol: https

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

Form Parameter Description

Form Parameter	Description
`name` required Type: string	The name of the plugin, in this case `aws-request-signing`.
`instance_name` optional Type: string	An optional custom name to identify an instance of the plugin, for example `aws-request-signing_my-service`. Useful when running the same plugin in multiple contexts, for example, on multiple services.
`service.name` or `service.id` optional Type: string	The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level `/plugins` endpoint. Not required if using `/services/SERVICE_NAME\|SERVICE_ID/plugins`.
`route.name` or `route.id` optional Type: string	The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level `/plugins` endpoint. Not required if using `/routes/ROUTE_NAME\|ROUTE_ID/plugins`.
`consumer.name` or `consumer.id` optional Type: string	The name or ID of the consumer the plugin targets. Set one of these parameters if adding the plugin to a consumer through the top-level `/plugins` endpoint. Not required if using `/consumers/CONSUMER_NAME\|CONSUMER_ID/plugins`.
`enabled` optional Type: boolean Default value: `true`	Whether this plugin will be applied.
`config.aws_assume_role_arn` required Type: string	The ARN of the AWS IAM Role to assume before making the request to the AWS service. If keyring database encryption is enabled, this value will be encrypted.
`config.aws_assume_role_name` required Type: string	The name of the AWS IAM Role to assume before making the request to the AWS service. If keyring database encryption is enabled, this value will be encrypted.
`config.aws_region` required Type: string	The AWS region in which the service is located.
`config.aws_service` required Type: string	The name of the AWS service to be called.
`config.override_target_host` optional Type: string	An optional hostname or IP to use instead of the one specified in the service’s endpoint.
`config.override_target_port` optional Type: number	An optional port to use instead of the one specified in the service’s endpoint.
`config.override_target_protocol` optional Type: string	An optional protocol to use instead of the one specified in the service’s endpoint.

name

required

Type: string

The name of the plugin, in this case aws-request-signing.

instance_name

optional

Type: string

An optional custom name to identify an instance of the plugin, for example aws-request-signing_my-service.

Useful when running the same plugin in multiple contexts, for example, on multiple services.

service.name or service.id

optional

Type: string

The name or ID of the service the plugin targets.

Set one of these parameters if adding the plugin to a service through the top-level /plugins endpoint.

Not required if using /services/SERVICE_NAME|SERVICE_ID/plugins.

route.name or route.id

optional

Type: string

The name or ID of the route the plugin targets.

Set one of these parameters if adding the plugin to a route through the top-level /plugins endpoint.

Not required if using /routes/ROUTE_NAME|ROUTE_ID/plugins.

consumer.name or consumer.id

optional

Type: string

The name or ID of the consumer the plugin targets.

Set one of these parameters if adding the plugin to a consumer through the top-level /plugins endpoint.

Not required if using /consumers/CONSUMER_NAME|CONSUMER_ID/plugins.

enabled

optional

Type: boolean

Default value: true

Whether this plugin will be applied.

config.aws_assume_role_arn

required

Type: string

The ARN of the AWS IAM Role to assume before making the request to the AWS service.

If keyring database encryption is enabled, this value will be encrypted.

config.aws_assume_role_name

required

Type: string

The name of the AWS IAM Role to assume before making the request to the AWS service.

If keyring database encryption is enabled, this value will be encrypted.

config.aws_region

required

Type: string

The AWS region in which the service is located.

config.aws_service

required

Type: string

The name of the AWS service to be called.

config.override_target_host

optional

Type: string

An optional hostname or IP to use instead of the one specified in the service’s endpoint.

config.override_target_port

optional

Type: number

An optional port to use instead of the one specified in the service’s endpoint.

config.override_target_protocol

optional

Type: string

An optional protocol to use instead of the one specified in the service’s endpoint.

About this Plugin
Made by	The LEGO Group
Categories	Serverless
DB-less compatible?	Yes
Compatible protocols	`http` `https`
Support	github.com
Source	Code License (Apache-2.0 (modified))
Version Compatibility
Kong Enterprise Kong Gateway (OSS)