{"version":"2.1.221","anchor":"sandbox-proxy-re-signs-aws-sigv4-requests-made-with-masked-c","canonical_anchor":"sandbox-proxy-re-signs-aws-sigv4-requests-made-with-masked-c","heading":"Sandbox proxy re-signs AWS SigV4 requests made with masked credentials","tier":"use","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/sandbox-proxy-re-signs-aws-sigv4-requests-made-with-masked-c","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### Sandbox proxy re-signs AWS SigV4 requests made with masked credentials\n\nAWS calls from inside the sandbox now work with masked credentials, since the proxy re-signs them for you.\n\n**What**\n\nWhen AWS credentials are masked inside the sandbox, the MITM proxy now recognises SigV4 requests, resolves the sentinel access key to the real key pair, and re-signs the request before forwarding it.\n\n**Details**\n\n- New AWS key-pair registry (`getAwsPairRegistry`) populated from the configured environment variables.\n- The TLS-terminating proxy receives `planSigv4` and `maxSigv4ResignBodyBytes`, so re-signing is bounded by a body-size limit.\n- Streaming, presigned and sigv4a variants cannot be re-signed and default to deny; setting `credentials.sigv4.<kind>` to `\"passthrough\"` is the escape hatch.\n- A request using a masked credential with no `x-amz-date` header cannot be re-signed and is refused with an explicit message.\n- A warning fires if only one of the access-key\/secret pair is masked.\n- Active only when sandbox `credentials` config is present. Sandbox exec also forwards `gitSafeDirectories`.\n\n**Evidence**\n\n`maxSigv4ResignBodyBytes`, `AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it.`\n\n- Area: Sandbox\n- Names: `credentials.sigv4`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 0\/5"}