[leandrodamascena]

Issue number:
closes #8817

Summary

Changes

SigV4 request signing in the Auth utility, following the design Powertools for TypeScript shipped in its signer package (RFC aws-powertools/powertools-lambda-typescript#4972). This is the oldest open feature request we had, #2493 from 2023, and it builds on what @stephenbawks did in #2435: botocore does the signing, we do the ergonomics.

• SigV4Signer(service, region=None, credentials=None, session=None). Region and credentials come from the Lambda environment by default, no provider chain on the cold start path; session= opts into botocore's chain, credentials= takes explicit ones.
• sign(method, url, headers=None, body=None) returns a SignedRequest with method, url, headers and body. No network call. requests_auth() and httpx_auth() return auth= objects for those clients, duck-typed, neither library is imported.
• service="s3" switches to botocore's S3SigV4Auth, so object keys with spaces or + sign correctly and x-amz-content-sha256 is added.
• The query string is re-encoded the way SigV4 canonicalises it before signing, and the client helpers send that URL. Without this, requests encoding a space as + gets a 403 from the service; I hit exactly that against a real Function URL during review, see below.
• SigV4aSigner(service, region_set="*") for multi-region signatures, through botocore's CRT signers. awscrt is not in the Lambda runtime, so it ships as the auth-sigv4a extra and the class raises SignerConfigError with the install hint when it is missing.
• SignerConfigError (an AuthError, reason signer_misconfigured) at construction for a missing region, missing credentials, empty service or missing awscrt. Messages never carry credential material.
• Lazy loading as the rest of Auth: importing the signer loads neither pyjwt nor cryptography.
• Docs page "Request signing" under Auth, six examples, API reference, feature table and install table rows, agent skill reference. Two nox sessions: signer with only botocore, and with the auth-sigv4a extra.

User experience

from aws_lambda_powertools.utilities.auth import SigV4Signer

api = SigV4Signer(service="execute-api")
requests.post(url, json=payload, auth=api.requests_auth())      # signed on the way out
signed = api.sign("GET", url)                                    # or sign only, send with anything

Verification

• tests/functional/auth: 520 passed. Signatures are checked against botocore's own SigV4Auth/S3SigV4Auth output on a frozen clock, plus repeated query keys, +/&/unicode/blank values, str/bytes/empty bodies, explicit and session credentials, region precedence, requests and httpx end to end with a mock transport, streaming bodies rejected, lazy imports in a clean interpreter.
• nox test_with_signer_required_packages (botocore only): 14 passed. nox test_with_sigv4a_required_packages: 17 passed, SigV4a produces AWS4-ECDSA-P256-SHA256 with the X-Amz-Region-Set header.
• Real services, us-east-1: a Lambda Function URL with AWS_IAM auth and an S3 object with key reports/2026 11/summary+v2.csv. Unsigned: 403. Signed through requests, httpx and sign() + urllib3: 200, including repeated query keys, spaces, &, +, unicode and blank values. Wrong service: 403. S3 object fetched with service="s3": 200 and the right content; unsigned 403. Resources deleted afterwards.
• ruff, mypy, xenon clean. Written with an AI assistant; I ran everything above myself.

Follow-up once merged: close #2493 and #2713 pointing here.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.20%. Comparing base (085707f) to head (189e949).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #8820      +/-   ##
===========================================
+ Coverage    97.17%   97.20%   +0.02%     
===========================================
  Files          323      327       +4     
  Lines        16629    16759     +130     
  Branches      1510     1523      +13     
===========================================
+ Hits         16160    16290     +130     
  Misses         328      328              
  Partials       141      141              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud