Authenticate CloudMonitor API Requests with HMAC-SHA1 - CloudMonitor - Alibaba Cloud - Cloud Monitor

CloudMonitor supports only HMAC-SHA1, a signature algorithm that combines a hash-based message authentication code (HMAC) with the SHA-1 hash function. This topic describes how to construct the signature string of an HTTP request and how to calculate the request signature from that string.

Prerequisites

Prepare an Alibaba Cloud AccessKey pair.

When you generate a signature for an HTTP request, you must use an AccessKey pair that consists of an AccessKey ID and an AccessKey secret.

Note

You can use an existing AccessKey pair or create a new AccessKey pair. Ensure that the AccessKey pair is in the active state.

Step 1: Generate the signature string

The signature string (SignString) of an HTTP request is generated from the method, header, and body information of the HTTP request. Concatenate the parts in the following order:

SignString = VERB + "\n"
             + CONTENT-MD5 + "\n"
             + CONTENT-TYPE + "\n"
             + DATE + "\n"
             + CanonicalizedHeaders + "\n"
             + CanonicalizedResource

In the preceding formula, \n indicates the line break escape character, and + indicates the string concatenation operation. The following table describes the other parts of the signature string.

Name	Description	Example
VERB	The method name of the HTTP request.	PUT, GET, POST
CONTENT-MD5	The MD5 value of the body of the HTTP request. > Note: The MD5 value must be a string of uppercase letters and digits.	0B9BE351E56C90FED853B32524253E8B
CONTENT-TYPE	The type of the body of the HTTP request.	application/json
DATE	The standard timestamp header in the HTTP request. > Note: The timestamp must follow the RFC 1123 format and use Greenwich Mean Time (GMT).	Mon, 3 Jan 2010 08:33:47 GMT
CanonicalizedHeaders	The string that is constructed from the custom headers prefixed with `x-cms` and `x-acs` in the HTTP request.	x-cms-api-version:0.1.0, x-cms-signature
CanonicalizedResource	The string that is constructed from the requested resource.	/event/custom/upload

Construct the CanonicalizedHeaders and CanonicalizedResource parts of the signature string as described in the following sections.

CanonicalizedHeaders

To construct CanonicalizedHeaders, perform the following operations in order:

Convert the names of all HTTP request headers prefixed with x-cms and x-acs to lowercase letters.
Sort all custom CMS and ACS request headers in ascending lexicographical order.
Remove the spaces on both sides of the separator between a request header and its content.
Join all request headers and their content with the \n separator to form the final CanonicalizedHeaders.

CanonicalizedResource

To construct CanonicalizedResource, perform the following operations in order:

Set CanonicalizedResource to an empty string ("").
Add the URI that you want to access to CanonicalizedResource. Example: /event/custom/upload.
If the request contains a query string (QUERY_STRING), append ? and the query string to the end of the CanonicalizedResource string.
QUERY_STRING is the string that consists of the request parameters in the URI sorted in lexicographical order. In this string, each parameter name and its value are separated by =. The parameter names and values are sorted in ascending lexicographical order, and the resulting pairs are concatenated with &. The formula is as follows:

QUERY_STRING = "KEY1=VALUE1" + "&" + "KEY2=VALUE2"

Step 2: Generate the signature

Calculate the signature (Signature) of the request from the signature string by using the following formula:

Signature=base16(hmac-sha1(UTF8-Encoding-Of(SignString), AccessKeySecret))

The following example shows a signature calculation:

SignString="POST" + "\n"
+"0B9BE351E56C90FED853B32524253E8B" + "\n"
+"application/json" + "\n"
+"Tue, 11 Dec 2018 21:05:51 +0800" + "\n"
+"x-cms-api-version:1.0" + "\n"
+"x-cms-ip:127.0.0.1" + "\n"
+"x-cms-signature:hmac-sha1" + "\n"
+"/metric/custom/upload"
accesskey="testkey"
accessSecret="testsecret" // The signature key.

The calculation returns the following signature:

1DC19ED63F755ACDE203614C8A1157EB1097E922