/ 
AWS-Signature-V4-0.001
/ AWS::Signature::V4::Credentials

NAME

AWS::Signature::V4::Credentials - The credentials-based variant of AWS Signature V4

VERSION

This module is part of the AWS::Signature::V4 distribution and shares its version.

SYNOPSIS

# you do not create it: AWS::Signature::V4 does, from "credentials"
use AWS::Signature::V4;

my $s = AWS::Signature::V4->new(
   service => 'iam', region => 'us-east-1',
   credentials => {
      access_key_id     => $id,
      secret_access_key => $secret,
      session_token     => $token,    # optional
   },
);

DESCRIPTION

This class implements the traditional variant of the algorithm (AWS4-HMAC-SHA256), where the signature is an HMAC computed with a key derived from the secret access key.

You are not supposed to use this module directly. AWS::Signature::V4 creates an object when it is given the credentials option, using the same keys, and calls the methods below. The class is documented for those who work on the distribution, or want to know how the two variants are kept apart, not as a public interface.

The constructor complains with an Ouch exception (code 400) if the access key or the secret are missing or empty; the session token is optional, and an empty one is like a missing one.

THE INTERFACE OF A VARIANT

AWS::Signature::V4 talks to the variant in use, this class or its sibling, through the same few methods, so that it does not need to know which one it is dealing with. The scope is what appears in the Credential and in the string to sign, like 20150830/us-east-1/iam/aws4_request.

INTERFACE

algorithm

my $name = $variant->algorithm;    # AWS4-HMAC-SHA256

credential_id

my $id = $variant->credential_id;

The access key id.

signature

my $hex = $variant->signature($scope, $string_to_sign);

The hexadecimal HMAC-SHA256 of the string to sign, computed with the signing key for the scope.

signing_key

my $bytes = $variant->signing_key($scope);

The key derived from the secret for the date, region and service in the scope (the raw bytes, not hexadecimal). It is also what signs the chunks of a streaming upload.

can_sign_chunks

True: chunks of streaming uploads can be signed, because there is a derived key.

extra_fields

my @pairs = $variant->extra_fields;

What goes with the request besides the signature, as a list of name => value pairs, named as query parameters (the caller lowercases them to make headers): here the session token, as X-Amz-Security-Token, if there is one.

AUTHOR

Flavio Poletti <flavio@polettix.it>

COPYRIGHT AND LICENSE

Copyright 2026 by Flavio Poletti <flavio@polettix.it>

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.