.NET Core客户端如何实现AWS签名授权调用Elasticsearch

不要通过设置全局环境变量的方式传递凭证，该方式会污染进程全局配置，推荐通过自定义HTTP请求管道注入签名逻辑的方式实现，步骤如下：

前置依赖 #

需要在项目中引入两个NuGet包：

• Elastic.Clients.Elasticsearch（官方v8版本.NET客户端）
• AWSSDK.Core（AWS官方SDK，用于读取本地凭证、生成SigV4签名）

实现代码 #

1. 读取本地AWS Profile凭证 #

直接读取C:\Users\username\.aws\credentials下的my.profile配置，不需要写入环境变量：

// 初始化AWS凭证链，自动加载默认路径下的credentials文件
var credentialChain = new CredentialProfileStoreChain();
if (!credentialChain.TryGetProfile("my.profile", out CredentialProfile? profile) || profile.Options == null)
{
    throw new InvalidOperationException("未找到my.profile配置或配置内容无效");
}

// 构造会话凭证对象
AWSCredentials sessionCredentials = new SessionAWSCredentials(
    profile.Options.AccessKey,
    profile.Options.SecretKey,
    profile.Options.Token
);
string awsRegion = profile.Region.SystemName;
const string esServiceName = "es"; // AWS Elasticsearch/OpenSearch 服务对应的签名标识

2. 实现自动签名的HTTP消息处理器 #

在请求发出前自动为所有ES请求添加AWS SigV4签名头：

public class AwsSigV4MessageHandler : DelegatingHandler
{
    private readonly AWSCredentials _awsCredentials;
    private readonly string _region;
    private readonly string _serviceName;
    private readonly AWS4Signer _signer = new AWS4Signer();

    public AwsSigV4MessageHandler(AWSCredentials awsCredentials, string region, string serviceName, HttpMessageHandler innerHandler) 
        : base(innerHandler)
    {
        _awsCredentials = awsCredentials;
        _region = region;
        _serviceName = serviceName;
    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        // 获取当前有效凭证（如果后续集成凭证自动刷新逻辑，这里会自动拉取最新密钥）
        var immutableCreds = await _awsCredentials.GetCredentialsAsync().ConfigureAwait(false);
        
        // 构造签名兼容的请求包装
        var requestWrapper = new HttpRequestMessageWrapper(request);
        // 生成签名
        _signer.Sign(requestWrapper, immutableCreds, _region, _serviceName);

        // 将签名生成的头写入原始请求
        foreach (var header in requestWrapper.Headers)
        {
            request.Headers.TryAddWithoutValidation(header.Key, header.Value);
        }

        return await base.SendAsync(request, cancellationToken).ConfigureAwait(false);
    }
}

3. 实现自定义HttpClient工厂注入Elasticsearch客户端 #

// 自定义HTTP客户端工厂，将签名处理器注入请求管道
public class AwsSigV4HttpClientFactory : IHttpClientFactory
{
    private readonly AWSCredentials _credentials;
    private readonly string _region;
    private readonly string _serviceName;

    public AwsSigV4HttpClientFactory(AWSCredentials credentials, string region, string serviceName)
    {
        _credentials = credentials;
        _region = region;
        _serviceName = serviceName;
    }

    public HttpClient CreateClient(string name)
    {
        var baseHandler = new HttpClientHandler();
        var signingHandler = new AwsSigV4MessageHandler(_credentials, _region, _serviceName, baseHandler);
        return new HttpClient(signingHandler);
    }
}

4. 初始化Elasticsearch客户端 #

var esEndpoint = new Uri("替换为你的AWS Elasticsearch/OpenSearch访问端点");
var clientSettings = new ElasticsearchClientSettings(esEndpoint)
    .HttpClientFactory(new AwsSigV4HttpClientFactory(sessionCredentials, awsRegion, esServiceName));

var esClient = new ElasticsearchClient(clientSettings);

// 直接使用客户端发起查询即可，所有请求会自动携带签名头
var searchResult = await esClient.SearchAsync<YourIndexDoc>(s => s
    .Index("你的索引名")
    .Query(q => q.MatchAll())
);

注意事项 #

• 如果使用的是AWS OpenSearch Serverless服务，需要将签名服务名从es替换为aoss，否则会出现签名校验失败
• 签名时传入的区域必须和ES实例部署的AWS区域完全一致，否则会返回403签名错误
• 如果后续需要实现凭证自动刷新（比如Okta凭证过期后自动重新获取），只需要自定义继承AWSCredentials基类的凭证提供者，重写GetCredentialsAsync方法实现刷新逻辑即可，签名和客户端初始化代码不需要改动
• 不需要手动设置任何AWS相关环境变量，所有凭证仅在当前客户端请求链路内生效，不会影响进程内其他组件

内容的提问来源于stack exchange，提问作者Yordan Dimov