Require AWS SDK in C

[prashah-confluent]

Describe the feature

Currently, the AWS SDK is available in languages like ruby, python, java etc. However, we need AWS SDK in C so that it can be easily hooked into our C based project.

Use Case

We have a project which is in pure C. With the limitation of not having AWS SDK in C requires additional effort and maintenance on our end to integrate the AWS SDK C++ via extern calls.

Having a AWS SDK in pure C will help benefit our integration.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

[sbiscigl]

We dont have any current plans to create a C SDK. However the aws c common runtime provides a lot of building blocks that can be used for easier interaction with AWS services such as signers and credentials providers.

[prashah-confluent]

We just want to use GetWebIdentityToken API to get JWT. Will that be possible through aws c common runtime considering the entire credential chain provider flow?

Can you please share an example of consuming GetWebIdentityToken API if that is possible with aws c common runtime

[sbiscigl]

the GetWebIdentityToken operation is not part of the credentials provider flow, AssumeRoleWithWebIdentity is. When you say you want to get the JWT what is the use case, what are you using the JWT for? subsequent aws calls using assume role with web identity?

you could use the crt http client + credentials provider + signer to create a signed request for the GetWebIdentityToken API

[prashah-confluent]

We have an application running on AWS that needs an AWS‑signed JWT to authenticate to an external OIDC‑compatible service that we operate. The JWT returned by GetWebIdentityToken is used directly as the bearer token to that service (validated via AWS’s issuer + JWKS), not for subsequent AWS API calls or AssumeRoleWithWebIdentity.

Currently, C++ STS SDK has that support. Is it possible to achieve the same using aws c common runtime? If yes, can you share a small example?

Lets say we go with the suggested approach of using crt http client + credentials provider + signer to create a signed request for the GetWebIdentityToken API, we would still end up on missing key behaviors like

1. Retry + backoff
2. HTTP config defaults
3. Error parsing & classification.

Is this understanding correct?

[sbiscigl]

An example of calling CRT to call S3 List buckets would look like

CMakeLists.txt

cmake_minimum_required(VERSION 3.24)
project(crt_usage C)
set(CMAKE_C_STANDARD 11)
include(FetchContent)
set(IN_SOURCE_BUILD ON CACHE BOOL "" FORCE)
set(BUILD_TESTING OFF CACHE BOOL "" FORCE)

# aws-c-common must be available first — its cmake/ dir has shared modules
FetchContent_Declare(aws-c-common GIT_REPOSITORY https://github.com/awslabs/aws-c-common.git GIT_TAG main)
FetchContent_MakeAvailable(aws-c-common)
list(APPEND CMAKE_MODULE_PATH "${aws-c-common_SOURCE_DIR}/cmake")

FetchContent_Declare(aws-c-sdkutils GIT_REPOSITORY https://github.com/awslabs/aws-c-sdkutils.git GIT_TAG main)
FetchContent_Declare(aws-c-cal GIT_REPOSITORY https://github.com/awslabs/aws-c-cal.git GIT_TAG main)
FetchContent_Declare(aws-c-compression GIT_REPOSITORY https://github.com/awslabs/aws-c-compression.git GIT_TAG main)
FetchContent_Declare(aws-c-io GIT_REPOSITORY https://github.com/awslabs/aws-c-io.git GIT_TAG main)
FetchContent_Declare(aws-c-http GIT_REPOSITORY https://github.com/awslabs/aws-c-http.git GIT_TAG main)
FetchContent_Declare(aws-c-auth GIT_REPOSITORY https://github.com/awslabs/aws-c-auth.git GIT_TAG main)
FetchContent_MakeAvailable(aws-c-sdkutils aws-c-cal aws-c-compression aws-c-io aws-c-http aws-c-auth)

add_executable(crt_usage main.c)
target_link_libraries(crt_usage PRIVATE aws-c-auth aws-c-http aws-c-io aws-c-common)

main.c

#include <aws/auth/credentials.h>
#include <aws/auth/signable.h>
#include <aws/auth/signing.h>
#include <aws/auth/signing_config.h>
#include <aws/auth/signing_result.h>
#include <aws/common/condition_variable.h>
#include <aws/common/mutex.h>
#include <aws/http/connection.h>
#include <aws/http/request_response.h>
#include <aws/io/channel_bootstrap.h>
#include <aws/io/event_loop.h>
#include <aws/io/host_resolver.h>
#include <aws/io/socket.h>
#include <aws/io/tls_channel_handler.h>
#include <stdio.h>

struct ctx {
    struct aws_allocator *alloc;
    struct aws_mutex lock;
    struct aws_condition_variable cv;
    bool done;
    int error;
    const struct aws_credentials *creds;
    struct aws_http_connection *conn;
    struct aws_http_message *request;
    int status;
    struct aws_byte_buf body;
};

static bool s_done(void *ud) { return ((struct ctx *)ud)->done; }

static void s_wait(struct ctx *c) {
    aws_mutex_lock(&c->lock);
    aws_condition_variable_wait_pred(&c->cv, &c->lock, s_done, c);
    aws_mutex_unlock(&c->lock);
}

static void s_signal(struct ctx *c) {
    aws_mutex_lock(&c->lock);
    c->done = true;
    aws_condition_variable_notify_all(&c->cv);
    aws_mutex_unlock(&c->lock);
}

static void s_on_creds(struct aws_credentials *creds, int err, void *ud) {
    struct ctx *c = ud;
    if (creds) { aws_credentials_acquire(creds); c->creds = creds; }
    c->error = err;
    s_signal(c);
}

static void s_on_sign(struct aws_signing_result *result, int err, void *ud) {
    struct ctx *c = ud;
    if (!err) aws_apply_signing_result_to_http_request(c->request, c->alloc, result);
    c->error = err;
    s_signal(c);
}

static void s_on_setup(struct aws_http_connection *conn, int err, void *ud) {
    struct ctx *c = ud;
    c->conn = conn; c->error = err;
    s_signal(c);
}

static void s_on_shutdown(struct aws_http_connection *conn, int err, void *ud) {
    (void)conn; (void)err; (void)ud;
}

static int s_on_headers(struct aws_http_stream *stream, enum aws_http_header_block b,
    const struct aws_http_header *h, size_t n, void *ud) {
    (void)b; (void)h; (void)n;
    aws_http_stream_get_incoming_response_status(stream, &((struct ctx *)ud)->status);
    return AWS_OP_SUCCESS;
}

static int s_on_body(struct aws_http_stream *stream, const struct aws_byte_cursor *data, void *ud) {
    (void)stream;
    aws_byte_buf_append_dynamic(&((struct ctx *)ud)->body, data);
    return AWS_OP_SUCCESS;
}

static void s_on_complete(struct aws_http_stream *stream, int err, void *ud) {
    (void)stream;
    struct ctx *c = ud; c->error = err;
    s_signal(c);
}

int main(void) {
    struct aws_allocator *a = aws_default_allocator();
    aws_auth_library_init(a);

    struct ctx c = { .alloc = a, .lock = AWS_MUTEX_INIT, .cv = AWS_CONDITION_VARIABLE_INIT };
    aws_byte_buf_init(&c.body, a, 4096);
    struct aws_byte_cursor host = aws_byte_cursor_from_c_str("s3.amazonaws.com");

    /* IO stack */
    struct aws_event_loop_group *elg = aws_event_loop_group_new_default(a, 1, NULL);
    struct aws_host_resolver *resolver = aws_host_resolver_new_default(a,
        &(struct aws_host_resolver_default_options){ .max_entries = 8, .el_group = elg });
    struct aws_client_bootstrap *bootstrap = aws_client_bootstrap_new(a,
        &(struct aws_client_bootstrap_options){ .event_loop_group = elg, .host_resolver = resolver });
    struct aws_tls_ctx_options tls_opts;
    aws_tls_ctx_options_init_default_client(&tls_opts, a);
    struct aws_tls_ctx *tls = aws_tls_client_ctx_new(a, &tls_opts);
    struct aws_tls_connection_options tls_conn;
    aws_tls_connection_options_init_from_ctx(&tls_conn, tls);
    aws_tls_connection_options_set_server_name(&tls_conn, a, &host);

    /* 1. Get credentials */
    struct aws_credentials_provider *cred_provider = aws_credentials_provider_new_chain_default(a,
        &(struct aws_credentials_provider_chain_default_options){ .bootstrap = bootstrap, .tls_ctx = tls });
    aws_credentials_provider_get_credentials(cred_provider, s_on_creds, &c);
    s_wait(&c);
    if (!c.creds) { fprintf(stderr, "creds failed: %s\n", aws_error_name(c.error)); return 1; }

    /* 2. Build & sign request */
    c.request = aws_http_message_new_request(a);
    aws_http_message_set_request_method(c.request, aws_byte_cursor_from_c_str("GET"));
    aws_http_message_set_request_path(c.request, aws_byte_cursor_from_c_str("/"));
    aws_http_message_add_header(c.request,
        (struct aws_http_header){ .name = aws_byte_cursor_from_c_str("Host"), .value = host });

    struct aws_signing_config_aws sign_cfg = {
        .config_type = AWS_SIGNING_CONFIG_AWS,
        .algorithm = AWS_SIGNING_ALGORITHM_V4,
        .signature_type = AWS_ST_HTTP_REQUEST_HEADERS,
        .region = aws_byte_cursor_from_c_str("us-east-1"),
        .service = aws_byte_cursor_from_c_str("s3"),
        .signed_body_header = AWS_SBHT_X_AMZ_CONTENT_SHA256,
        .signed_body_value = g_aws_signed_body_value_empty_sha256,
        .credentials = c.creds,
    };
    aws_date_time_init_now(&sign_cfg.date);

    c.done = false;
    struct aws_signable *signable = aws_signable_new_http_request(a, c.request);
    aws_sign_request_aws(a, signable, (void *)&sign_cfg, s_on_sign, &c);
    s_wait(&c);
    aws_signable_destroy(signable);
    if (c.error) { fprintf(stderr, "sign failed: %s\n", aws_error_name(c.error)); return 1; }

    /* 3. Connect */
    struct aws_socket_options sock = { .type = AWS_SOCKET_STREAM, .connect_timeout_ms = 5000 };
    struct aws_http_client_connection_options conn_opts = AWS_HTTP_CLIENT_CONNECTION_OPTIONS_INIT;
    conn_opts.allocator = a;
    conn_opts.bootstrap = bootstrap;
    conn_opts.host_name = host;
    conn_opts.port = 443;
    conn_opts.socket_options = &sock;
    conn_opts.tls_options = &tls_conn;
    conn_opts.user_data = &c;
    conn_opts.on_setup = s_on_setup;
    conn_opts.on_shutdown = s_on_shutdown;

    c.done = false;
    aws_http_client_connect(&conn_opts);
    s_wait(&c);
    if (!c.conn) { fprintf(stderr, "connect failed: %s\n", aws_error_name(c.error)); return 1; }

    /* 4. Send request */
    c.done = false;
    struct aws_http_stream *stream = aws_http_connection_make_request(c.conn,
        &(struct aws_http_make_request_options){
            .self_size = sizeof(struct aws_http_make_request_options),
            .request = c.request,
            .user_data = &c,
            .on_response_headers = s_on_headers,
            .on_response_body = s_on_body,
            .on_complete = s_on_complete,
        });
    aws_http_stream_activate(stream);
    s_wait(&c);

    printf("HTTP %d\n%.*s\n", c.status, (int)c.body.len, (char *)c.body.buffer);

    /* Cleanup */
    aws_http_stream_release(stream);
    aws_http_connection_release(c.conn);
    aws_http_message_release(c.request);
    aws_credentials_release(c.creds);
    aws_credentials_provider_release(cred_provider);
    aws_tls_connection_options_clean_up(&tls_conn);
    aws_tls_ctx_release(tls);
    aws_tls_ctx_options_clean_up(&tls_opts);
    aws_client_bootstrap_release(bootstrap);
    aws_host_resolver_release(resolver);
    aws_event_loop_group_release(elg);
    aws_byte_buf_clean_up(&c.body);
    aws_thread_join_all_managed();
    aws_auth_library_clean_up();
    return 0;
}

For your specific STS request, you will have to update this to match your request.

we would still end up on missing key behaviors like
Retry + backoff
HTTP config defaults
Error parsing & classification.

yes you would have to code those on your own. please reach out to the https://github.com/awslabs/aws-c-common project i you have any questions about that. but we at the current time do not plan on extending this to a C SDK.