by cllunsford

cllunsford / aws-signing-proxy

Golang http proxy to transparently sign requests to AWS endpoints

129 Stars 50 Forks Last release: over 2 years ago (0.2.2) 58 Commits 4 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:


Build Status

aws-signing-proxy is a proxy service, written in go, for automatically signing requests made to AWS endpoints. It leverages the aws-sdk-go library to sign requests to arbitrary URLs in AWS. I wrote it to connect a kibana instance to an AWS Elasticsearch cluster using an IAM role instead of hard-coding IPs in the access policy. Other uses may exist.

Docker image:


export AWS_REGION=
export AWS_PROFILE=  # Optional
./aws-signing-proxy -target [-port 8080] [-service es]



  • -target
    - AWS service to send requests to. Required.
  • -port
    - Port for the proxy to LISTEN on (will forward to whatever port you specify in target), default:
  • -service
    - The AWS service type you are sending to, default:
    . This is required for the signing process.

HTTP Connection Tuning:

  • -flush-interval
    - ReverseProxy FlushInterval, default:
  • -idle-conn-timeout
    - Transport Idle Connection Timeout, default:
  • -dial-timeout
    - Transport Dial Timeout, default:

Credential chain

AWS credentials are looked up in the following order:

  1. Environment variable accessible to the app
  2. The
    config file's default profile
  3. Any IAM instance profile role assigned to the instance.


If you have go installed, you can build and install the binary natively:

go install

The Makefile is used for the production build in travis. It builds the binary in a docker container. After installing docker:

make gobuild   # creates the binary
make dockbuild # creates a docker image with the binary


make build # does both

Notes, Tips

Signature Expired

If you see:

{"message":"Signature expired: 20160415T172935Z is now earlier than 20160415T174424Z (20160415T174924Z - 5 min.)"}

verify that the clock/time is in sync on the proxy host.

Kibana Forbidden index write

For AWS Elasticsearch, the built-in kibana populates the .kibana index. If you see:

ClusterBlockException[blocked by: [FORBIDDEN/8/index write (api)];]

try changing the kibana index setting to use a different index. The marcbachmann/kibana4 docker image allows you to change this easily by setting the

environment variable.


MIT 2018 (c) Chris Lunsford

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.