AWS Signature using HTTP Action

[Pullox]

Trying to use Amazon SP-API to get some data from Amazon Seller Central into Power Automate but I'm stuck on the step where you need to generate temporary credentials using AWS STS I manage to do it in Postman following this guide but cannot seem to create the authorization in Power Automate using the HTTP Action. I've found only the suggestions in this post but seems too complicated to create python web app in azure and then invoke but will do it if no other solution is possible. https://powerusers.microsoft.com/t5/Building-Flows/Connect-to-Amazon-S3/td-p/156106

Here is how the authorization looks in Postman:

I cannot figure out how to recreate this AWS authorization in the HTTP action and adding the access key, secret and session token manually defeats the purpose of automating it.

Thanks in advance for all your help, suggestions and/or criticism. Any hints will be highly appreciated.

Sincerley,

Pullox

[Pullox]

Wanted to share an update on my progress with this.

I found an encodian connector called "Create HMAC" reference here. Which I believe might help solve the issue with signature, from the AWS documentation here it seems that I need to do 4 HMAC calculations but I cannot figure out which part keep getting wrong.

Here is a part of my flow if it helps:

I keep getting this error from the STS HTTP request which I understand as I'm doing some wrong regarding the signature.

<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>SignatureDoesNotMatch</Code>
    <Message>The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.</Message>
  </Error>
  <RequestId>0c3cd747-ffa2-4beb-b909-38fae55c846d</RequestId>
</ErrorResponse>

[Pullox]

Hello,

I'm still super stuck with this issue so sharing my progress hoping that someone can help out. 🙂

Here is summary of the signing steps and my recreation of it in Power Automate:

To create a signed request, complete the following:

• Task 1: Create a canonical request for Signature Version 4

  Arrange the contents of your request (host, action, headers, etc.) into a standard (canonical) format. The canonical request is one of the inputs used to create a string to sign.

• Task 2: Create a string to sign for Signature Version 4

  Create a string to sign with the canonical request and extra information such as the algorithm, request date, credential scope, and the digest (hash) of the canonical request.

• Task 3: Calculate the signature for AWS Signature Version 4

  Derive a signing key by performing a succession of keyed hash operations (HMAC operations) on the request date, Region, and service, with your AWS secret access key as the key for the initial hashing operation. After you derive the signing key, you then calculate the signature by performing a keyed hash operation on the string to sign. Use the derived signing key as the hash key for this operation.

• Task 4: Add the signature to the HTTP request

  After you calculate the signature, add it to an HTTP header or to the query string of the request.

Only thing that comes to my mind is the fact that I cannot seem to output the hashes from Task 3 in binary as Power Automate doesn't show binary even if you use the expression base64ToBinary it shows a json representation of a binary output..

{
 "$contenct-type": "application/octet=stream",
 "$conctent": "ASDdsaASDQWesdsdgHdfgfDsdffdsfDS524DF"
}

Apologies for the long post and thanks for your help in advance!

Sicnerely,

Pullox

[TheCalebG]

Bummer that no one has jumped in here on this yet. Amazon's API documentation is cryptic! I really appreciate your snapshots. I was having a hard time figuring out the passing of a signature to the requests in Postman. 

I want to automate inventory management from our internal ERP database and expand on reporting with PowerBI. 

Did you get any further on this @Pullox ??

[Pullox]

@TheCalebG , we did get further but ended up using Amazon Web Services (AWS) SDK for Python to call the Amazon Simple Queue Service (Amazon SQS) aka Boto3, this function was added to azure cloud which then completes the following steps:

1. Creates a canonical request
2. Creates String to sign
3. Calculates the signature
4. Adds the signature to the HTTP request
5. Sends the HTTP request

Hope this helps, we are currently in the process of implementing this to a Power Automate flow, I'll gladly share the results once it is completed.

[ctpmthh]

@Pullox , Thanks you share your development !

You replaced this flow ( where you creating request, calculates signature... ) with function in Azure ?

Thanks !

[MJ646]

@Pullox Would you be able to share more direction on how you got this sorted out. 

Any help would be appreciated.

[Anonymous]

@Pullox Could you share how the final solution turned out? I'm having the same difficulty generating this signature.

[annie23]

AWS Signature using HTTP Action makes it easy to sign actions taken by an AWS instance or subscription. It provides a secure way to sign and manage Amazon Web Services actions.

[Pullox]

Hello @annie23, 

Thanks for jumping into the topic, can you please specify how you deal with the authentication as it was a challenge for me. Thanks in advance!

[Anonymous]

Could you send an example of how this authentication was performed?

[annie23]

To use the AWS Signature Version 4 authentication process with HTTP actions, you will need to do the following:
Create a canonical request:
Begin by creating a canonical request for the desired HTTP action. The canonical request should include the HTTP method, URI, query string parameters, headers, and the payload if the action includes a payload.
Create a string to sign:
Next, create a string to sign by concatenating various information, including the algorithm used, the requested date, the credential scope, and the hashed canonical request.
Calculate the signature:
Use the string to sign and your AWS secret key to calculate the signature for the request.
Add the signature to the request:
Finally, add the calculated signature, access key, and other required information to the request headers.
This process can be complex, so it is often helpful to use a library or pre-built tool to handle the authentication process for you.

[ChrisGCollext]

@Pullox did you ever come to build this in Power Automate?

If not, would you mind sharing how to implement the Azure service to handle the AWS signature generation? Thanks so much.