Simple AWS client v4 library for the ESP8266. This implements the workflow at https://docs.aws.amazon.com/apigateway/api-reference/signing-requests/.

• TimeLib
• CryptoSuite

Suppose you wanted to do a signed POST to an AWS gateway at https://ivsxai2qus.execute-api.us-east-1.amazonaws.com/

const char *host = "ivsxai2qus";
const char *service = "execute-api";
const char *key = "YOUR_AWS_IAM_KEY";
const char *host = "YOUR_AWS_IAM_SECRET";
const char *uri = "/YOUR_POST_URI"; //The URI will include the stage name if you are not using a custom domain name.
const char *payload = "{\"key\":true}";

ESPAWSClient aws = ESPAWSClient(service, key, secret, host);
aws.setInsecure(); // Arduino ESP 2.5.0 now needs this
AWSResponse resp = aws.doPost(uri, payload);
if (resp.status != 200) {
    Serial.printf("Error: %s", resp.body.c_str());
    Serial.println();
}

If you have configured a custom domain for your AWS endpoint, you can specify it with the setCustomFQDN method.

ESPAWSClient aws = ESPAWSClient(service, key, secret, host);
aws.setCustomFQDN("api.domain.com");

You can force SSL fingerprint verification by using the setFingerprint method.

static const char aws_fp[] PROGMEM = "E5 9A 86..."
ESPAWSClient aws = ESPAWSClient(service, key, secret, host);
aws.setFingerprint(aws_fp);

The ESPAWSClient class inherits from the WiFiClientSecure class, so any methods there can be called as well.

ESPAWSClient aws = ESPAWSClient(service, key, secret, host);
aws.setCACert(...);

You must have the proper system time set on your device. The library uses the gettimeofday internally to get the time. The AWS signed requests are only valid for a certain amount of time, so if AWS will reject your signatures if your time is wrong. Note that many Arduino NTP libraries do not call settimeofday to set the system time. See the example sketch for a full example with NTP.

The ESP8266 typically only has 80K of RAM total. AWS uses somewhat large certs and TLS 1.2. Just doing the connection requires around 20K of available HEAP. More if you add in certificate validation. If you're adding this to an existing Arduino program, check you're not running out of RAM.

Arduino switched from AxTLS to BearSSL With release 2.5.0. That changed the behavior such that it no longer connects without server verification. The library has been updated to work with 2.5.0, and may not work with prior versions. Likewise, code using it will need to be updated. At the very least, to include a call to setInsecure() to mimic previous behavior of not checking.

See the examples directory in the source to get started.