Salesforce to Amazon Integration Using Signature Version 4: Part 2

The string to sign will include meta information like algorithm, date, credential scope and the digest that was calculated in step 1. It is calculated as shown below:

For calculating the signature, you need to derive the signing key from AWS secret access key. For deriving the Signing key, you need to create a series of hash-based message authentication codes (HMACs) using HmacSHA256AH algorithm for date, region, service. You can derive the signing key as given in the code snippet below:

The sign function used for creating the HMACs is as shown below:

After creating the signature as a digest, convert it into a hexadecimal representation using EncodingUtil.convertToHex function. The final signature, after conversion to hex will look something like this:

B. Creating a Sign Request

After the signature has been calculated, you need to add it to the query string. Query string will contain the action, the action parameters, and the signing information. This request is known as pre-signed URL and it is calculated as:

The following example shows what a request might look like when all the request parameters, including the signing information, are included in query string parameters.

Before I sign off…

While integrating Amazon with Salesforce using signature version 4, you need to bear the following in mind:

1. Date information should be an eight-digit string representing the year (YYYY), month (MM), and day (DD) of the request (e.g., 20120228)
2. Region information should be a lowercase alphanumeric string
3. Service name information should be a lowercase alphanumeric string
4. A special termination string: aws4_request

There! You are now ready to conquer the world, what with both Salesforce and Amazon data at your disposal at a single location, and why not, you have it covered A to Z after all.

Reference: http://docs.aws.amazon.com/general/latest/gr/sigv4_changes.html