{"version":"2.1.248","anchor":"aws-proxy-request-signing-policies-are-documented-as-fail-cl","canonical_anchor":"aws-proxy-request-signing-policies-are-documented-as-fail-cl","heading":"AWS proxy request-signing policies are documented as fail-closed","tier":"use","area":"Proxy","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/aws-proxy-request-signing-policies-are-documented-as-fail-cl","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### AWS proxy request-signing policies are documented as fail-closed\n\nThree settings control AWS proxy request signing, all defaulting to deny with a 403.\n\n**What**\n\nSettings expose three policies for AWS requests passing through the proxy, covering streaming, presigned and sigv4a requests. Each accepts `deny` or `passthrough`, and `deny` is documented as the default: the request fails closed with a 403. `passthrough` forwards it without re-signing, which the upstream service will reject on signature grounds.\n\n**Evidence**\n\n`` `deny` (default) fails closed with a 403; `passthrough` forwards the request unre-signed (the upstream will reject its signature). ``\n\n- Area: Proxy\n- Names: `deny`, `passthrough`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5"}