title: Signing AWS API Gateway Request using Node
body: <p>I've been searching for ways to restrict access to an API made for using a AWS Lambda function written on javascript.</p>
  
  <p>I've found documentation on how to use AWS Signature S4, but I still do not understand it.</p>
  
  <p>According to <a href="http://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html" rel="nofollow noreferrer">creating a signature</a>, after applying the pseudocode I should get the signature to be placed on the header.</p>
  
  <p>I've found the following code that addresses this point:
  <div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>// Example of signature generator
  
  var crypto = require("crypto-js");
  
  function getSignatureKey(Crypto, key, dateStamp, regionName, serviceName) {
      var kDate = Crypto.HmacSHA256(dateStamp, "AWS4" + key);
      var kRegion = Crypto.HmacSHA256(regionName, kDate);
      var kService = Crypto.HmacSHA256(serviceName, kRegion);
      var kSigning = Crypto.HmacSHA256("aws4_request", kService);
      return kSigning;
  }
  
  console.log(getSignatureKey(crypto,'secretkey','date','us-east-2','iam'));</code></pre>
  </div>
  </div>
  </p>
  
  <p>Here comes my first question, I do not know what should be the output of getSignatureKey()? This is because on the documentation it is a very long string, while the output I got was {words:[x,x,x,x,x,x,x,x],sigBytes: 32},where the x are random numbers.</p>
  
  <p>Moreover, after getting the signature and filling the header for the request with the "authorization" field and others, how do I filter unproper requests? Do I have to create a policy for the AWS API so it only allows signed requests? Here I guess I should follow <a href="http://docs.aws.amazon.com/apigateway/api-reference/signing-requests/" rel="nofollow noreferrer">Signing Requests</a>.</p>
  
  <p>Thanks! </p>