Module aws_lambda 

AWS Lambda serverless-upstream plugin (aws-lambda).

Port of APISIX’s aws-lambda plugin (3.17). Invokes an AWS Lambda function through its function URL (or an API Gateway endpoint) and returns the function’s reply as the gateway response — it replaces the upstream, so the node’s success port should be wired straight to client.in.

Two authorization modes are supported:

• API key (authorization.apikey) — the key is sent as the x-api-key request header, no signing.
• IAM / SigV4 (authorization.iam) — the request is signed with AWS Signature Version 4 (AWS4-HMAC-SHA256). The signing itself is factored into the pure sign_v4 function, unit-tested against the published AWS SigV4 get-vanilla test vector.

On a callout failure the node rejects through its error port with AWS_LAMBDA_CALLOUT_ERROR (a 502/503 depending on the failure kind).

Deviations from APISIX

• Only the minimal header set host, x-amz-date and (when present) x-amz-security-token is covered by the SigV4 signature. AWS permits signing a subset of headers, and the remaining forwarded headers are sent unsigned; APISIX signs every forwarded header.
• aws_service defaults to lambda (APISIX defaults to execute-api).
• ssl_verify defaults to false, matching APISIX’s documented behavior for this plugin.

Structs

AwsLambdaPlugin

Invokes an AWS Lambda function and maps its reply into Context.response.

IamAuth 🔒

IAM credentials driving AWS SigV4 request signing.

SigV4Input 🔒

Inputs to sign_v4. canonical_query is a pre-built, sorted, encoded query string; headers is the exact set of headers to cover by the signature (names in any case, values already trimmed of outer whitespace).

SigV4Output 🔒

Result of a SigV4 signing pass.

Enums

Authorization 🔒

The plugin’s resolved authorization strategy.

Constants

ALGO 🔒

Functions

apply_response 🔒

Copies the FaaS reply into Context.response (status, headers, body).

canonical_query_string 🔒

Builds the SigV4 canonical query string: URI-encode every name and value, then sort the pairs by encoded name and value.

civil_from_days 🔒

Converts a count of days since the unix epoch into (year, month, day) using Howard Hinnant’s civil-date algorithm.

derive_signing_key 🔒

Derives the SigV4 signing key via the HMAC date → region → service chain.

format_amz_date 🔒

Formats a unix timestamp as an AWS amz-date (YYYYMMDDTHHMMSSZ, UTC).

hex 🔒

Lowercase-hex encoding of a byte slice.

hmac_sha256 🔒

HMAC-SHA256 over msg with key.

normalize_path 🔒

Normalizes a request path for the SigV4 canonical URI: an empty path becomes /, and a trailing slash on a non-root path is dropped.

reject 🔒

Builds the AWS_LAMBDA_CALLOUT_ERROR rejection carrying the context.

sha256 🔒

SHA-256 digest of data.

sign_v4 🔒

Computes an AWS Signature Version 4 for the given request.

uri_encode 🔒

Percent-encodes a string per RFC 3986, leaving the SigV4 unreserved set (A-Z a-z 0-9 - _ . ~) intact.