Signing requests with AWS SDK in Lambda functions

Hi Arpad.
Yes, I managed to work this out.
It seems that the combination of using Lambda + Neptune DB + openCypher is not tight yet. I think I was probably the first to try to stich all these together in real life scenario. I am also in contact with the AWS Neptune team to fix some issues.

To begin with, one cannot pass openCypher queries PARAMETERS as part of an object through Lambda to the Neptune DB. Only a single query string to be passed is supported. AS a result, I needed to inject all values into the query string on my app side, before sending out the request.

Also, the same query string, if passed to the Neptune DB and to the signerv4 - fails with the signature calculation mismatch error. This defies the whole idea of the signer :).
What I ended up doing, is manipulating the request query string for the signer to satisfy its needs, while passing a slightly different query string to the DB to satisfy its needs.

Consider the below Lambda code I now have working.
The ocQuery variable is receiving the query string from the request,
As you can see, it is passed on as part of the API_URL as a query string to the Neptune endpoint call.
Now, according to the signature v4 documentation, the exact same string must be also included in the signer payload, as these are checked to match by the signer! This should be a core feature of the signer service – matching the signed payload with the querystring passed!.
However, as you can see, I an not passing ocQuery to the signer, but rather another variable: signatureQuery, that is constructed after decoding some special characters I have to decode in the request if I want the Neptune reader to parse correctly.

`import axios from 'axios';
import { SignatureV4 } from '@aws-sdk/signature-v4';
import { Sha256 } from '@aws-crypto/sha256-js';

const {
AWS_ACCESS_KEY_ID,
AWS_SECRET_ACCESS_KEY,
AWS_SESSION_TOKEN,
CALL_SIGNATURE,
NEPTUNE_DB_ENDPOINT_dev,
NEPTUNE_DB_ENDPOINT_tst,
NEPTUNE_DB_ENDPOINT_prd
} = process.env;

const sigv4 = new SignatureV4({
service: 'neptune-db',
region: 'us-east-1',
credentials: {
accessKeyId: AWS_ACCESS_KEY_ID,
secretAccessKey: AWS_SECRET_ACCESS_KEY,
sessionToken: AWS_SESSION_TOKEN,
},
sha256: Sha256,
});

const validateSignature = async (requestSignature) => {
//Lambda call permission validator
if (requestSignature!=CALL_SIGNATURE) {
throw new Error('Function call signature does not match');
}
};

const decodeQuery = async (queryText) => {
//Decodes some chars in the raw query text for Lambda to process properly
let result = queryText.replace(/%7B/g, "{");
result = result.replace(/%7D/g, "}");
result = result.replace(/%3D/g, "=");
result = result.replace(/%60/g, "`");
result = result.replace(/%2B/g, "+");
return result;
};

const getNeptuneDbEndpoint = (alias) => {
switch(alias) {
case 'prd':
return NEPTUNE_DB_ENDPOINT_prd;
case 'tst':
return NEPTUNE_DB_ENDPOINT_tst;
case 'dev':
return NEPTUNE_DB_ENDPOINT_dev;
default:
return '';
}
};

export const handler = async (event, context) => {

// retrieve signature and payload
const requestSignature = event.headers.SignatureHeader;
const functionAlias = event.headers.functionAlias;
//const requestSignature = event.body.SignatureHeader;
console.log('event received: ', event);
console.log('functionAlias: ' + functionAlias);

try {
await validateSignature(requestSignature); // throws if invalid signature
} catch (error) {
console.error(error);
return {
statusCode: 400,
body: Function permission error: ${error},
};
}

const requestPayload = event.body; //Passed openCypher query string
console.log('requestPayload: ', requestPayload);
const signatureQuery = await decodeQuery(requestPayload);

const ocQuery = requestPayload;
const dbEndpoint = getNeptuneDbEndpoint(functionAlias);
const API_URL = https:// + dbEndpoint + ":8182/openCypher?query=" + ocQuery;
const apiUrl = new URL(API_URL);

const signed = await sigv4.sign({
method: 'GET',
hostname: apiUrl.host,
path: apiUrl.pathname,
protocol: apiUrl.protocol,
query: {
query: signatureQuery
},
headers: {
'Content-Type': 'application/json',
host: apiUrl.hostname,
}
});

try {
const result = await axios({
...signed,
url: API_URL,
});

console.log('Successfully received result: ', JSON.stringify(result.data));
return {
  statusCode: 200,
  body: result.data
};

} catch (error) {
console.log('An error occurred', error);

throw error;

}
};
`