feat: implement aws authentication for the MiTM proxy #1195
feat: implement aws authentication for the MiTM proxy #1195intentionally-left-nil wants to merge 2 commits into
Conversation
PR Review SummarySize
Affected crates
Blast radius — ContainedThis PR touches: source code Updated automatically on each push to this PR. |
|
Note that this is built on top of #1192, so the diff will be a bit more manageable once that is merged. There's a somewhat related bug where |
intentionally-left-nil
changed the title
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements AWS SigV4 signing support for nono-proxy, enabling the proxy to intercept AWS requests, strip dummy credentials, and re-sign them using resolved AWS credentials. Key additions include AWS endpoint parsing, route state management with provider caching, and request signing integration within the TLS interception pipeline. The review feedback highlights a few critical improvement opportunities: using aws_config::from_env() instead of ProfileFileCredentialsProvider directly to leverage automatic caching and advanced profile features (like SSO), and normalizing the Host header to prevent duplicate headers and signature mismatches. Minor cleanups regarding unused imports and duplicate variable definitions were also suggested.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
intentionally-left-nil
force-pushed
the
aws-proxy-impl
branch
from
2befcb8 to
26cbfc3
Compare
|
Once rebased on top of the other 2 pr's (refactor + not needing credential field for custom creds) we can get this tested and review :) |
Now that the config is piped through, we can take a request, determine that aws credentials should be applied, determine the correct parameters (region, service), and then apply the signing to the body Streaming-based signing is not implemented Signed-off-by: Anil Kulkarni <anil@terminal.space>
intentionally-left-nil
force-pushed
the
aws-proxy-impl
branch
from
02b85a0 to
9e305fd
Compare
…points.rs Also use from_env() to create the profile in all cases, just specifying the profile name Signed-off-by: Anil Kulkarni <anil@terminal.space>
2 participants
Linked Issue
Closes #1189
Summary
Now that the config is piped through, we can take a request, determine that aws credentials should be applied, determine the correct parameters (region, service), and then apply the signing to the body
This works by hooking up the aws_routes config to the underlying aws (smithy) providers. Then, when a route comes in, we can strip out the old headers and attach the new ones
Test Plan
profile:
Debug logs:
command:
RUST_LOG=nono_proxy=debug cargo run -p nono-cli -- run --profile qa-profiles/04-aws-bedrock.json -- opencode run "say hi"Checklist
CHANGELOG.mdif needed