syntax = "proto3";

package envoy.config.filter.http.aws_request_signing.v2alpha;

import "udpa/annotations/migrate.proto";
import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.config.filter.http.aws_request_signing.v2alpha";
option java_outer_classname = "AwsRequestSigningProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/filter/http/aws_request_signing/v2alpha";
option (udpa.annotations.file_migrate).move_to_package =
    "envoy.extensions.filters.http.aws_request_signing.v3";
option (udpa.annotations.file_status).package_version_status = FROZEN;

// [#protodoc-title: AwsRequestSigning]
// AwsRequestSigning :ref:`configuration overview <config_http_filters_aws_request_signing>`.
// [#extension: envoy.filters.http.aws_request_signing]

// Top level configuration for the AWS request signing filter.
message AwsRequestSigning {
  // The `service namespace
  // <https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-aws-service-namespaces>`_
  // of the HTTP endpoint.
  //
  // Example: s3
  string service_name = 1 [(validate.rules).string = {min_bytes: 1}];

  // The `region <https://docs.aws.amazon.com/general/latest/gr/rande.html>`_ hosting the HTTP
  // endpoint.
  //
  // Example: us-west-2
  string region = 2 [(validate.rules).string = {min_bytes: 1}];

  // Indicates that before signing headers, the host header will be swapped with
  // this value. If not set or empty, the original host header value
  // will be used and no rewrite will happen.
  //
  // Note: this rewrite affects both signing and host header forwarding. However, this
  // option shouldn't be used with
  // :ref:`HCM host rewrite <envoy_api_field_route.RouteAction.host_rewrite>` given that the
  // value set here would be used for signing whereas the value set in the HCM would be used
  // for host header forwarding which is not the desired outcome.
  string host_rewrite = 3;
}
