## What changed
- Expose `aws_sigv4` actions in version 2 MITM permissions configuration and the config schema, rejecting multiple signing actions per hook.
- Give local managed commands placeholder AWS credentials for the selected signing pair, and mask configured credentials in environment values and protected shell snapshots.
- Set `AWS_CA_BUNDLE` to the managed proxy CA bundle when unset, and require `features.credential_masking` for local AWS signing hooks.
- Validate placeholders against every configured signing pair to prevent overlap with real credentials.
## Testing
Extend configuration, signing, and TLS forwarding tests to cover action resolution, invalid signing configuration, credential masking, CA trust, snapshot protection, and exclusion of local AWS defaults from remote environments.
GitOrigin-RevId: 81dfdea30ebde74829882b38891ea41e9737058a
## Why
The network proxy previously required AWS signing requests to have an empty body or use `UNSIGNED-PAYLOAD`, preventing signing of nonempty payloads.
## What changed
- Buffer and hash request bodies before signing, then forward the original bytes.
- Add `max_body_bytes` with an 8 MiB default and a 16 MiB maximum, plus a 30-second body read timeout.
- Limit concurrent buffering to eight requests with a five-second capacity wait. Retain reservations while forwarded body data remains alive.
- Reject trailers and mismatched content lengths for buffered payloads while preserving streaming for explicitly unsigned payloads.
## Testing
Add coverage for payload hashing and forwarding, body limits and timeouts, fragmented body collection, and buffer reservation lifetimes. Extend signing tests for S3 path and query canonicalization, header replacement, and secret exclusion from trace logs.
GitOrigin-RevId: 48c18442fa90ae3efb1a4a99a168d07e1be2c496
## Why
Allow workloads to make AWS requests with placeholder credentials while keeping real AWS credentials in the trusted proxy process.
## What changed
- Add an `aws_sigv4` hook action with a placeholder access key ID, region, service, HTTPS port, and credential sources from proxy environment variables or files.
- Re-sign matching requests after network and hook authorization and header transformations, using the configured credentials and optional session token.
- Support empty payloads and explicitly unsigned payloads, including streaming unsigned S3 uploads. Reject selected requests with incompatible credential scopes, presigned URLs, unsupported streaming signatures, or ambiguous framing through the hook denial path.
- Mark generated credential headers as sensitive and suppress signing SDK trace events that could expose credentials.
## Testing
Add tests for the published AWS IAM signature vector, unsigned S3 uploads with a session token, and rejection of invalid transport, credential scopes, signing inputs, and unsupported bodies.
GitOrigin-RevId: ab4fbbc00ba40a5bb309add521fea6ee2ff6e79e
viyatb-oai