AWS signature version 4 in Tcl to call CloudFront API - amazon-web-services

Question

I'm trying to use the createInvalidtion API that amazon offers, and I'm a bit confused about the authentication part, I saw this documentation about the AWS signature, but, do I really want to do all of this?! It seems too much for a simple request, also, I'm not sure of what each part should be, specially the canonical request part as the API I want to use is simple one with no much to build.
I'm using a programming language (TCL) with no built-in library for cloudFront, So I'm going to build everything from scratch, appreciate any help or if anyone went through a similar situation.

Answer 1

I saw this documentation about the AWS signature, but, do I really
want to do all of this?!
The AWS signature is built using a chain of HMAC computations, there is not all too much to doing this. Departing from the AWS documentation, this could look like:
set key "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
set dateStamp "20120215"
set regionName "us-east-1"
set serviceName "iam"
proc hmac-sha256 {str hexKey} {
lindex [exec openssl dgst -sha256 -mac hmac -macopt hexkey:$hexKey << [encoding convertto utf-8 $str]] 1
}
proc getSignatureKey {key dateStamp regionName serviceName} {
binary scan [encoding convertto utf-8 "AWS4$key"] H* hexKey
set kDate [hmac-sha256 $dateStamp $hexKey]
puts "kDate = $kDate"
set kRegion [hmac-sha256 $regionName $kDate];
puts "kRegion = $kRegion"
set kService [hmac-sha256 $serviceName $kRegion];
puts "kService = $kService"
set kSigning [hmac-sha256 "aws4_request" $kService]
puts "kSigning = $kSigning"
return $kSigning
}
getSignatureKey $key $dateStamp $regionName $serviceName
This prints out:
kDate = 969fbb94feb542b71ede6f87fe4d5fa29c789342b0f407474670f0c2489e0a0d
kRegion = 69daa0209cd9c5ff5c8ced464a696fd4252e981430b10e3d3fd8e2f197d7a70c
kService = f72cfd46f26bc4643f06a11eabb6c0ba18780c19a8da0c31ace671265e3c87fa
kSigning = f4780e2d9f65fa895f9c67b32ce1baf0b0d8a43505a000a1a9e090d414db404d
Some background:
Calling out to the openssl executable might not be adequate in some situations, you might need to check out for some Tcl built-ins (I am only aware of an Tcl command binding to OpenSSL/LibreSSL in NaviServer and tcllib's sha2 module)
The above implementation passes around the hexdumps of the binary strings (for educational, debugging purposes), you might want to use the binary strings directly.
As for the REST of the task, it boils down to assembling an HTTP request with custom request parameters and XML payload.