ai.internal._aws_sign_request

(internal) SigV4-signs `request` for `service` and returns it with the signature headers applied (`authorization`, `x-amz-date`, and `x-amz-security-token` for session credentials).

Reference version

Signature

function ai.internal._aws_sign_request(

request: baml.http.Request,

service: string,

region: string | null,

profile: string | null,

access_key_id: string | null,

secret_access_key: string | null,

session_token: string | null

) -> baml.http.Request throws baml.errors.Io | baml.errors.AccessError

(internal) SigV4-signs request for service and returns it with the signature headers applied (authorization, x-amz-date, and x-amz-security-token for session credentials).

The signature covers the request's method, URL, headers, and body, so this must be the LAST mutation of the request — anything added afterwards invalidates it.

Credentials come from access_key_id + secret_access_key (+ optional session_token) when both halves are present, else from the AWS provider chain: environment, shared config/credentials files (static keys, credential_process, SSO cache), the container endpoint, then EC2 IMDS.

Source:<builtin>/ai/ns_internal/auth.bamlbytes 3200–3508