An nginx module that proxies requests to authenticated AWS services like S3 using Amazon's V4 authentication API.
ngx_aws_auth is an nginx module that proxies HTTP requests to authenticated AWS services, primarily Amazon S3, using Amazon's V4 authentication API. It enables nginx servers to securely forward requests to S3 buckets by signing them with AWS credentials, eliminating the need to expose secret keys directly. The module solves the problem of securely accessing private S3 resources through a reverse proxy while maintaining AWS authentication standards.
DevOps engineers, system administrators, and developers who manage nginx servers and need to proxy requests to AWS S3 or other authenticated AWS services securely. It is particularly useful for those building internal tools, content delivery networks, or APIs that rely on S3 as a backend.
Developers choose ngx_aws_auth because it provides a secure, nginx-native solution for AWS authentication without modifying application code. Its use of scoped signing keys enhances security over traditional secret key storage, and its lightweight integration with nginx's configuration system offers flexibility and ease of deployment compared to custom proxy implementations.
nginx module to proxy to authenticated AWS services
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses scoped signing keys with one-week validity, avoiding storage of AWS secret keys on nginx servers, as emphasized in the security considerations.
Provides native directives like aws_sign and aws_access_key, enabling straightforward configuration within nginx without modifying application code, as shown in the usage examples.
Supports custom S3 endpoints such as s3.cn-north-1.amazonaws.com.cn, allowing deployments across different AWS regions, demonstrated in the configuration snippets.
Includes a Python script to generate signing keys, facilitating integration with tools like SaltStack or Puppet for automated key rotation, as detailed in the documentation.
Only supports GET and HEAD requests, as admitted in the known limitations, making it unsuitable for S3 uploads, deletions, or other write operations.
Requires constant refreshing of signing keys every week and manual HUP signals to nginx, adding operational complexity compared to simpler auth solutions.
Exclusively works with nginx, locking users into this web server and offering no support for alternative proxies or serverless architectures.