feat(sandbox): proxy-side AWS SigV4 credential signing for CONNECT tunnels (#1638)

Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Co-authored-by: Russell Bryant <russell.bryant@gmail.com>

Author: jhjaggars

Cargo.lock

@@ -90,6 +90,39 @@ and returned access tokens must be bearer-compatible before they are cached or
 injected. Token response lifetimes are capped and cached with an expiry margin
 unless a profile supplies an explicit cache TTL override.
 
+For AWS endpoints that require request-level signing, the proxy supports SigV4
+re-signing. When `credential_signing: sigv4` is set on an L7 endpoint, the proxy
+strips the client's placeholder-based AWS auth headers, re-signs with real
+credentials from the provider, and forwards the request upstream. The signing
+mode is auto-detected from the client SDK's `x-amz-content-sha256` header:
+
+- **Signed body** (hex hash): buffers the request body (up to 10 MiB), computes
+  its SHA-256, and includes the hash in the signature. Used by Bedrock and most
+  AWS services.
+- **Streaming unsigned** (`STREAMING-UNSIGNED-PAYLOAD-TRAILER`): signs headers
+  only and streams the body through without buffering. Used by S3 uploads with
+  `aws-chunked` encoding.
+- **Unsigned payload** (`UNSIGNED-PAYLOAD`): signs headers only with no body
+  hash. Used by S3 over HTTPS for non-chunked requests.
+
+Chunk-signed streaming modes (`STREAMING-AWS4-HMAC-SHA256-PAYLOAD` and other
+`STREAMING-*` variants) are rejected — the proxy cannot reproduce per-chunk
+signatures. Use `sigv4:no_body` for those clients.
+
+Two explicit overrides are available: `credential_signing: sigv4:body` (always
+buffer and hash) and `sigv4:no_body` (always unsigned). The `Expect:
+100-continue` header is handled within the SigV4 path so clients like boto3
+transmit the body before the proxy forwards to upstream.
+
+The AWS region is extracted from the endpoint hostname. For non-standard
+endpoints (VPC endpoints, custom proxies), set `signing_region` in the policy
+endpoint to provide an explicit override. The proxy rejects requests when
+neither hostname extraction nor `signing_region` yields a region.
+
+`credential_signing` and `request_body_credential_rewrite` are mutually
+exclusive on the same endpoint. The policy validator rejects policies that
+set both.
+
 ## Connect and Logs
 
 The supervisor runs an SSH server on a Unix socket inside the sandbox. The

architecture/sandbox.md

@@ -138,6 +138,12 @@ struct NetworkEndpointDef {
     graphql_persisted_queries: BTreeMap<String, GraphqlOperationDef>,
     #[serde(default, skip_serializing_if = "is_zero_u32")]
     graphql_max_body_bytes: u32,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    credential_signing: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    signing_service: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    signing_region: String,
 }
 
 // Signature dictated by serde's `skip_serializing_if`, which requires `&T`.
@@ -350,6 +356,9 @@ fn to_proto(raw: PolicyFile) -> SandboxPolicy {
                                 })
                                 .collect(),
                             graphql_max_body_bytes: e.graphql_max_body_bytes,
+                            credential_signing: e.credential_signing,
+                            signing_service: e.signing_service,
+                            signing_region: e.signing_region,
                         }
                     })
                     .collect(),
@@ -515,6 +524,9 @@ fn from_proto(policy: &SandboxPolicy) -> PolicyFile {
                                 })
                                 .collect(),
                             graphql_max_body_bytes: e.graphql_max_body_bytes,
+                            credential_signing: e.credential_signing.clone(),
+                            signing_service: e.signing_service.clone(),
+                            signing_region: e.signing_region.clone(),
                         }
                     })
                     .collect(),
@@ -697,6 +709,16 @@ pub enum PolicyViolation {
     TooManyPaths { count: usize },
     /// A network endpoint uses a TLD wildcard (e.g. `*.com`).
     TldWildcard { policy_name: String, host: String },
+    /// `credential_signing` is set but `signing_service` is missing.
+    MissingSigningService { policy_name: String, host: String },
+    /// `credential_signing` has an unrecognized value.
+    UnknownCredentialSigning {
+        policy_name: String,
+        host: String,
+        value: String,
+    },
+    /// `credential_signing` and `request_body_credential_rewrite` are both set.
+    CredentialSigningWithBodyRewrite { policy_name: String, host: String },
 }
 
 impl fmt::Display for PolicyViolation {
@@ -733,6 +755,31 @@ impl fmt::Display for PolicyViolation {
                      use subdomain wildcards like '*.example.com' instead"
                 )
             }
+            Self::MissingSigningService { policy_name, host } => {
+                write!(
+                    f,
+                    "network policy '{policy_name}': endpoint '{host}' has credential_signing \
+                     set but signing_service is empty"
+                )
+            }
+            Self::UnknownCredentialSigning {
+                policy_name,
+                host,
+                value,
+            } => {
+                write!(
+                    f,
+                    "network policy '{policy_name}': endpoint '{host}' has unrecognized \
+                     credential_signing value '{value}' (expected sigv4, sigv4:body, or sigv4:no_body)"
+                )
+            }
+            Self::CredentialSigningWithBodyRewrite { policy_name, host } => {
+                write!(
+                    f,
+                    "network policy '{policy_name}': endpoint '{host}' has both credential_signing \
+                     and request_body_credential_rewrite set; these options are mutually exclusive"
+                )
+            }
         }
     }
 }
@@ -837,6 +884,30 @@ pub fn validate_sandbox_policy(
                     });
                 }
             }
+            if !ep.credential_signing.is_empty()
+                && !matches!(
+                    ep.credential_signing.as_str(),
+                    "sigv4" | "sigv4:body" | "sigv4:no_body"
+                )
+            {
+                violations.push(PolicyViolation::UnknownCredentialSigning {
+                    policy_name: name.clone(),
+                    host: ep.host.clone(),
+                    value: ep.credential_signing.clone(),
+                });
+            }
+            if !ep.credential_signing.is_empty() && ep.signing_service.is_empty() {
+                violations.push(PolicyViolation::MissingSigningService {
+                    policy_name: name.clone(),
+                    host: ep.host.clone(),
+                });
+            }
+            if !ep.credential_signing.is_empty() && ep.request_body_credential_rewrite {
+                violations.push(PolicyViolation::CredentialSigningWithBodyRewrite {
+                    policy_name: name.clone(),
+                    host: ep.host.clone(),
+                });
+            }
         }
     }
 
@@ -1380,6 +1451,167 @@ network_policies:
         assert!(validate_sandbox_policy(&policy).is_ok());
     }
 
+    #[test]
+    fn validate_rejects_credential_signing_without_signing_service() {
+        let mut policy = restrictive_default_policy();
+        policy.network_policies.insert(
+            "aws".into(),
+            NetworkPolicyRule {
+                name: "bedrock".into(),
+                endpoints: vec![NetworkEndpoint {
+                    host: "bedrock-runtime.us-east-1.amazonaws.com".into(),
+                    port: 443,
+                    credential_signing: "sigv4".into(),
+                    signing_service: String::new(),
+                    ..Default::default()
+                }],
+                ..Default::default()
+            },
+        );
+        let violations = validate_sandbox_policy(&policy).unwrap_err();
+        assert!(
+            violations
+                .iter()
+                .any(|v| matches!(v, PolicyViolation::MissingSigningService { .. }))
+        );
+    }
+
+    #[test]
+    fn validate_accepts_credential_signing_with_signing_service() {
+        let mut policy = restrictive_default_policy();
+        policy.network_policies.insert(
+            "aws".into(),
+            NetworkPolicyRule {
+                name: "bedrock".into(),
+                endpoints: vec![NetworkEndpoint {
+                    host: "bedrock-runtime.us-east-1.amazonaws.com".into(),
+                    port: 443,
+                    credential_signing: "sigv4".into(),
+                    signing_service: "bedrock".into(),
+                    ..Default::default()
+                }],
+                ..Default::default()
+            },
+        );
+        assert!(validate_sandbox_policy(&policy).is_ok());
+    }
+
+    #[test]
+    fn validate_accepts_sigv4_body_with_signing_service() {
+        let mut policy = restrictive_default_policy();
+        policy.network_policies.insert(
+            "aws".into(),
+            NetworkPolicyRule {
+                name: "bedrock".into(),
+                endpoints: vec![NetworkEndpoint {
+                    host: "bedrock-runtime.us-east-1.amazonaws.com".into(),
+                    port: 443,
+                    credential_signing: "sigv4:body".into(),
+                    signing_service: "bedrock".into(),
+                    ..Default::default()
+                }],
+                ..Default::default()
+            },
+        );
+        assert!(validate_sandbox_policy(&policy).is_ok());
+    }
+
+    #[test]
+    fn validate_accepts_sigv4_no_body_with_signing_service() {
+        let mut policy = restrictive_default_policy();
+        policy.network_policies.insert(
+            "aws".into(),
+            NetworkPolicyRule {
+                name: "s3".into(),
+                endpoints: vec![NetworkEndpoint {
+                    host: "s3.us-east-1.amazonaws.com".into(),
+                    port: 443,
+                    credential_signing: "sigv4:no_body".into(),
+                    signing_service: "s3".into(),
+                    ..Default::default()
+                }],
+                ..Default::default()
+            },
+        );
+        assert!(validate_sandbox_policy(&policy).is_ok());
+    }
+
+    #[test]
+    fn validate_rejects_sigv4_no_body_without_signing_service() {
+        let mut policy = restrictive_default_policy();
+        policy.network_policies.insert(
+            "aws".into(),
+            NetworkPolicyRule {
+                name: "s3".into(),
+                endpoints: vec![NetworkEndpoint {
+                    host: "s3.us-east-1.amazonaws.com".into(),
+                    port: 443,
+                    credential_signing: "sigv4:no_body".into(),
+                    signing_service: String::new(),
+                    ..Default::default()
+                }],
+                ..Default::default()
+            },
+        );
+        let violations = validate_sandbox_policy(&policy).unwrap_err();
+        assert!(
+            violations
+                .iter()
+                .any(|v| matches!(v, PolicyViolation::MissingSigningService { .. }))
+        );
+    }
+
+    #[test]
+    fn validate_rejects_unknown_credential_signing() {
+        let mut policy = restrictive_default_policy();
+        policy.network_policies.insert(
+            "aws".into(),
+            NetworkPolicyRule {
+                name: "test".into(),
+                endpoints: vec![NetworkEndpoint {
+                    host: "example.amazonaws.com".into(),
+                    port: 443,
+                    credential_signing: "sigv4_typo".into(),
+                    signing_service: "bedrock".into(),
+                    ..Default::default()
+                }],
+                ..Default::default()
+            },
+        );
+        let violations = validate_sandbox_policy(&policy).unwrap_err();
+        assert!(
+            violations
+                .iter()
+                .any(|v| matches!(v, PolicyViolation::UnknownCredentialSigning { .. }))
+        );
+    }
+
+    #[test]
+    fn validate_rejects_credential_signing_with_body_rewrite() {
+        let mut policy = restrictive_default_policy();
+        policy.network_policies.insert(
+            "aws".into(),
+            NetworkPolicyRule {
+                name: "bedrock".into(),
+                endpoints: vec![NetworkEndpoint {
+                    host: "bedrock-runtime.us-east-1.amazonaws.com".into(),
+                    port: 443,
+                    credential_signing: "sigv4".into(),
+                    signing_service: "bedrock".into(),
+                    request_body_credential_rewrite: true,
+                    ..Default::default()
+                }],
+                ..Default::default()
+            },
+        );
+        let violations = validate_sandbox_policy(&policy).unwrap_err();
+        assert!(
+            violations
+                .iter()
+                .any(|v| matches!(v, PolicyViolation::CredentialSigningWithBodyRewrite { .. }))
+        );
+    }
+
     #[test]
     fn normalize_path_collapses_separators() {
         assert_eq!(normalize_path("/usr//lib"), "/usr/lib");

crates/openshell-policy/src/lib.rs

@@ -205,6 +205,12 @@ pub struct EndpointProfile {
     pub graphql_max_body_bytes: u32,
     #[serde(default, skip_serializing_if = "String::is_empty")]
     pub path: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub credential_signing: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub signing_service: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub signing_region: String,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
@@ -775,6 +781,9 @@ fn endpoint_to_proto(endpoint: &EndpointProfile) -> NetworkEndpoint {
             .collect(),
         graphql_max_body_bytes: endpoint.graphql_max_body_bytes,
         path: endpoint.path.clone(),
+        credential_signing: endpoint.credential_signing.clone(),
+        signing_service: endpoint.signing_service.clone(),
+        signing_region: endpoint.signing_region.clone(),
     }
 }
 
@@ -805,6 +814,9 @@ fn endpoint_from_proto(endpoint: &NetworkEndpoint) -> EndpointProfile {
             .collect(),
         graphql_max_body_bytes: endpoint.graphql_max_body_bytes,
         path: endpoint.path.clone(),
+        credential_signing: endpoint.credential_signing.clone(),
+        signing_service: endpoint.signing_service.clone(),
+        signing_region: endpoint.signing_region.clone(),
     }
 }
 

crates/openshell-providers/src/profiles.rs

@@ -17,6 +17,10 @@ openshell-policy = { path = "../openshell-policy" }
 openshell-router = { path = "../openshell-router" }
 
 apollo-parser = { workspace = true }
+aws-sigv4 = { version = "1", features = ["sign-http", "http1"] }
+aws-credential-types = { version = "1", features = ["hardcoded-credentials"] }
+aws-smithy-runtime-api = { version = "1", features = ["client"] }
+http = { workspace = true }
 base64 = { workspace = true }
 bytes = { workspace = true }
 flate2 = "1"