AWS SigV4 signer

# Sign outgoing requests with AWS Signature Version 4, via the
# `loadr-plugin-aws-sigv4` native SERVICE plugin (auth & signers role).
#
# Unlike a data-source service (which does its work once at start), this signer
# is invoked per-request through a request `sign:` hook: loadr hands it the
# request to sign (method + url [+ headers/body]) scoped to a `region` +
# `service`, and it returns the `Authorization` + `X-Amz-Date` +
# `X-Amz-Content-Sha256` headers (plus `X-Amz-Security-Token` for temporary
# credentials) to stamp on the request just before it goes out. It is pure Rust
# (sha2 + hmac) — no AWS SDK, no OpenSSL — and does NO network or disk I/O of its
# own: it only transforms request headers.
#
# Credentials are NEVER put in the plan. The signer reads them from the standard
# AWS environment chain (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY /
# AWS_SESSION_TOKEN), so supply them through `aws-vault exec` at run time.
#
# Build + install the plugin, then run:
#   cargo build -p loadr-plugin-aws-sigv4 --release
#   mkdir -p dist && cp plugins/loadr-plugin-aws-sigv4/plugin.toml dist/ \
#     && cp target/release/libloadr_plugin_aws_sigv4.so dist/
#   loadr plugin install dist
#   aws-vault exec my-profile -- loadr run examples/plugins/aws-sigv4.yaml
#
# Or point the plan's `plugins:` entry at the built artifact directly (below).
name: aws-sigv4
description: SigV4-sign S3 (and other AWS) requests with a per-request signer hook

plugins:
  # Resolve `aws-sigv4` by name from the plugins dir (after `loadr plugin
  # install`). To run straight from a build tree instead, set:
  #   path: target/release/libloadr_plugin_aws_sigv4.so
  - name: aws-sigv4

scenarios:
  s3_reads:
    executor: constant-vus
    vus: 20
    duration: 5m
    flow:
      - request:
          name: get object
          method: GET
          url: https://my-bucket.s3.eu-west-2.amazonaws.com/reports/latest.json
          sign:
            type: plugin            # sign via a service plugin
            service: aws-sigv4      # the signer that stamps the request
            config:
              region: eu-west-2     # SigV4 region scope
              service: s3           # SigV4 service scope (must match the host)
          checks:
            - { type: status, equals: 200 }
            - { type: duration, name: object read is fast, max: 400ms }

      # The same signer works against any SigV4 service — swap `service: s3` for
      # `execute-api` to hit a signed API Gateway endpoint. A request with no
      # `sign:` block goes out untouched.
      - request:
          name: call signed api
          method: POST
          url: https://abc123.execute-api.eu-west-2.amazonaws.com/prod/things
          headers: { Content-Type: application/json }
          body: '{"name":"widget"}'
          sign:
            type: plugin
            service: aws-sigv4
            config:
              region: eu-west-2
              service: execute-api
          checks:
            - { type: status, equals: 201 }

thresholds:
  checks: [ "rate>0.99" ]
  # One increment per request signed — fail the run if nothing was actually
  # signed (i.e. the `sign:` hook was not wired to the requests you expected).
  sigv4_signatures: [ "count>0" ]
  http_req_duration: [ "p(95)<400ms" ]