BREAKING: Request presigning

[ianbotsf]

An upcoming release of the AWS SDK for Kotlin changes the method signatures for presigning requests. This change simplifies presigning in the simplest cases and adds new capabilities for advanced presigning use cases but affects all existing presigning code.

Note: If you do not presign AWS SDK API requests then this change should not affect you.

Release date

This feature will ship with the v.0.26.0-beta release planned for 5/25/2023.

What's changing

Functions for presigning requests were previously extension methods on the request objects (e.g., GetObjectRequest.presign). They accepted either a service client config object (e.g., S3Client.Config) or a service-specific presigning config object (e.g., S3PresignConfig) to pass parameters necessary for presigning. These methods were found to be cumbersome and require additional resource handling or complex codegen.

They are being replaced with extension methods on service clients (e.g., S3Client.presignGetObject) which eliminates the need to pass in service-level config as a parameter. There are two overloads: one that takes a duration as a required parameter and another which takes an AwsSigningConfig builder to control more advanced signing configuration.

How to migrate

Migration steps depend on use case:

Presigning via service client config

Previously, service client config could be used to presign requests like this:

val clientConfig = S3Client.Config {
    // region cannot be auto-detected when building config
    region = "us-west-2"
}

val unsignedRequest = GetObjectRequest {
    bucket = "foo"
    key = "bar"
}

val presignedRequest = unsignedRequest.presign(clientConfig, 24.hours)

After this change, presigning will be invoked like this:

val s3 = S3Client.fromEnvironment() // region is auto-detected

val unsignedRequest = GetObjectRequest {
    bucket = "foo"
    key = "bar"
}

val presignedRequest = s3.presignGetObject(unsignedRequest, 24.hours)

Presigning via presign config

Previously, a more advanced set of presigning options could be configured like this:

val unsignedRequest = GetObjectRequest {
    bucket = "foo"
    key = "bar"
}

val presignConfig = S3PresignConfig {
    // credentials provider cannot be auto-detected when building config
    credentialsProvider = DefaultChainCredentialsProvider()

    // endpoint provider must be wrapped to return a "contextualized" endpoint
    endpointProvider = { sc ->
        val params = EndpointParameters {
            region = sc.region
            bucket = getReq.bucket
        }
        val ep = MyCustomEndpointProvider().resolveEndpoint(params)
        SigningContextualizedEndpoint(ep, sc)
    }

    // region cannot be auto-detected when building config
    region = "us-west-2"

    signer = CrtAwsSigner
}

val presignedRequest = unsignedRequest.presign(presignConfig, 24.hours)

After this change, most of this configuration will be read from the service client instead. The signer instance itself can be passed as an optional parameter to the presign request:

val s3 = S3Client.fromEnvironment { // region and credentials auto detected
    // endpoint provider does not have to be wrapped
    endpointProvider = MyCustomEndpointProvider()
}

val unsignedRequest = GetObjectRequest {
    bucket = "foo"
    key = "bar"
}

val presignedRequest = s3.presignGetObject(unsignedRequest, signer = CrtAwsSigner) {
    expiresAfter = 24.hours
}

Additional resources

If you have any questions concerning this change, please feel free to engage with us in this discussion. If you encounter a bug with these changes, please file an issue.