blob: be2584cfd2e01dc1f326e589015d72d2d49a45b8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
#!/bin/bash
### route53.sh
### For use in LEDE / OpenWRT DDNS scenarios
###
### Requires: curl, openssl-util
set -euo pipefail
IFS=$'\n\t'
ENDPOINT="route53.amazonaws.com"
RECORD_TTL=300
RECORD_NAME=""
RECORD_TYPE="A"
RECORD_VALUE="1.2.3.4"
HOSTED_ZONE_ID=""
PATH="/2013-04-01/hostedzone/${HOSTED_ZONE_ID}/rrset/"
AWS_ACCESS_KEY_ID=''
AWS_SECRET_ACCESS_KEY=''
AWS_REGION='us-east-1'
AWS_SERVICE='route53domains'
request_body="
<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<ChangeResourceRecordSetsRequest xmlns=\"https://route53.amazonaws.com/doc/2013-04-01/\">
<ChangeBatch>
<Changes>
<Change>
<Action>UPSERT</Action>
<ResourceRecordSet>
<Name>${RECORD_NAME}</Name>
<Type>${RECORD_TYPE}</Type>
<TTL>${RECORD_TTL}</TTL>
<ResourceRecords>
<ResourceRecord>
<Value>${RECORD_VALUE}</Value>
</ResourceRecord>
</ResourceRecords>
</ResourceRecordSet>
</Change>
</Changes>
</ChangeBatch>
</ChangeResourceRecordSetsRequest>
"
fulldate=$(date -Iseconds)
signed_headers="host;z-amx-date"
canonical_request="POST\n${PATH}\n\nhost:route53.amazon.com\nx-amz-date:${fulldate}\n\n${signed_headers}\n$(hash $request_body)"
hash() {
msg=$1
echo -n $msg | openssl dgst -sha256 | sed 's/^.* //'
}
sign() {
key=$1
msg=$2
echo -n $msg | openssl dgst -sha256 -hmac $key | sed 's/^.* //'
}
getSignatureKey() {
# usage: getSignatureKey date region service
date_key=$(sign AWS4${AWS_SECRET_ACCESS_KEY_ID} $(date +%Y%m%d))
region_key=$(sign $date_key $AWS_REGION)
service_key=$(sign $region_key $AWS_SERVICE)
signing_key=$(sign $service_key aws4_request)
echo -n $signing_key
}
credential="{fulldate}\n${date}/${AWS_REGION}/${AWS_SERVICE}/aws4_request"
sigmsg="AWS4-HMAC-SHA256\n${credential}\n$(hash $(echo -e canonical_request))"
sigkey=$(getSignatureKey)
signature=$(sign sigkey sigmsg)
authorization="AWS4-HMAC-SHA256 Credential=${AWS_ACCESS_KEY_ID}/${credential},SignedHeaders=${signed_headers},Signature=${signature}"
curl \
-X "POST" \
-H "host:route53.amazonaws.com" \
-H "x-amz-date:${fulldate}" \
-H "authorization:${authorization}}" \
--data $request_body
"https://${ENDPOINT}${PATH}"
|
