Documentation

aws.internal.sign_request

SigV4-signs `req` and returns it with the signature headers applied (`authorization`, `x-amz-date`, and `x-amz-security-token` for session credentials). Raises if no credentials or no region can be resolved.

Reference version

Signature

function aws.internal.sign_request(
req: baml.http.Request,
) -> baml.http.Request throws baml.errors.AccessError | baml.errors.Io

SigV4-signs req and returns it with the signature headers applied (authorization, x-amz-date, and x-amz-security-token for session credentials). Raises if no credentials or no region can be resolved.

The signature covers the request's method, URL, headers, and body, so this MUST be the last mutation of the request — a header or body change made afterwards invalidates it and the call is rejected with a 403.

Credentials come from opts.access_key_id + opts.secret_access_key (+ optional opts.session_token) when both halves are present, else from the AWS provider chain: environment, the shared config/credentials files (static keys, credential_process, SSO cache), the container endpoint, then EC2 IMDS.

Source:<builtin>/aws/ns_internal/auth.bamlbytes 2070–2366