title: Validate AWS SIGv4 signature in Lambda
body: <p>We have a serverless backend which is protected by IAM in API Gateway. We have another in-house authentication solution and we want to support both Authentication mechanisms in our service. I was planning to write a Custom Authorizer with authentication chain supporting multiple Authentication.</p>
  
  <p>However, I couldn't find any way to validate AWS Sigv4 signature on backend. I found AWS docs on how to sign a request or calculate Sigv4 signature ([1], [2], [3] and [4]), however all these docs are from client perspective in which client will have access to ACCESS_KEY_ID, SECRET_ACCESS_KEY and SESSION_TOKEN. When custom authorizer lambda will receive the request it'll have only ACCESS_KEY_ID (in Authorization header) and SESSION_TOKEN (as additional header). So re-calculating signature on backend is not possible. How can I validate the signature at the backend to authenticate?</p>
  
  <p>This post might be a duplicate of <a href="https://stackoverflow.com/questions/40347917/how-to-verify-aws-sigv4-signing">How to verify AWS SigV4 signing</a> which is still unanswered. <a href="https://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html#sig-v4-examples-get-auth-header" rel="nofollow noreferrer">Solution suggested</a> in this question still need SECRET_ACCESS_KEY.</p>
  
  <p>[1] <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html</a><br>
  [2] <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-examples-using-sdks.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-examples-using-sdks.html</a><br>
  [3] <a href="https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html</a><br>
  [4] <a href="https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html</a>  </p>