AWS Signature V4 and HMAC

AWS Signature V4: HMAC in Practice

AWS Signature Version 4 (SigV4) is one of the most sophisticated real-world applications of HMAC-SHA256. Every AWS API request is authenticated using a multi-step HMAC signing process that ensures request integrity, prevents replay attacks, and scopes credentials to specific services and regions.

The Four-Step Signing Process

Step 1: Create a canonical request

Construct a deterministic string from the request components:

CanonicalRequest = HTTPMethod + '\n' +
    CanonicalURI + '\n' +
    CanonicalQueryString + '\n' +
    CanonicalHeaders + '\n' +
    SignedHeaders + '\n' +
    SHA256(Payload)

Step 2: Create a string to sign

StringToSign = "AWS4-HMAC-SHA256" + '\n' +
    Timestamp + '\n' +
    Scope + '\n' +
    SHA256(CanonicalRequest)

The scope is formatted as YYYYMMDD/region/service/aws4_request.

Step 3: Derive the signing key (HMAC chain)

This is where HMAC is applied repeatedly to derive a scoped signing key:

DateKey    = HMAC_SHA256("AWS4" + SecretAccessKey, DateStamp)
RegionKey  = HMAC_SHA256(DateKey, Region)
ServiceKey = HMAC_SHA256(RegionKey, Service)
SigningKey = HMAC_SHA256(ServiceKey, "aws4_request")

Each HMAC in the chain narrows the scope. A signing key derived for us-east-1/s3 cannot be used for eu-west-1/dynamodb, limiting the blast radius of a compromised derived key.

Step 4: Compute the signature

Signature = HMAC_SHA256(SigningKey, StringToSign)

Why the HMAC Chain?

The chained HMAC derivation serves several purposes:

• Scope limitation: Each derived key works only for a specific date, region, and service
• Key caching: The DateKey changes daily, so you can cache it for all requests within a day
• Blast radius reduction: Even if a derived key leaks, it is useless outside its scope
• No raw secret in computation: The original Secret Access Key is only used in the first HMAC, reducing exposure

Security Properties

AWS SigV4 provides:

• Authentication: Only the holder of the Secret Access Key can produce valid signatures
• Integrity: Any modification to the request invalidates the signature
• Replay protection: The timestamp must be within 15 minutes of the server's clock
• Credential scoping: Signatures are bound to specific regions and services