HERON (GEK TERNA Group)

Cross-Cloud Document Delivery (Azure ↔ AWS)

Summary

An authenticated Azure Function letting Azure-hosted workflows deliver documents securely into a partner platform’s AWS S3 bucket, with AWS Signature Version 4 implemented from first principles. The SigV4 implementation covers canonical request construction, credential scoping, and chained HMAC-SHA256 key derivation, with an injectable clock that keeps signatures deterministic under test.

Architecture

An authenticated caller posts an encoded document to an Azure Function, which validates and decodes it, optionally normalizes CSV content, signs the upload request using a signing key derived through a chained key derivation, sends it to a partner platform S3 bucket, and returns the storage response status to the caller.
A single signed cross cloud upload, with the request signature built in process.
  • Signing is a pure function with no input or output of its own, and the current time enters through a keyword only parameter that defaults to the real clock. Tests pin the timestamp and then recompute the entire expected signature independently before comparing, which makes the suite a real signature regression test rather than a smoke test.
  • The payload is hashed in full and the same digest is reused both as the content hash header and as the trailer of the canonical request, rather than declaring the payload unsigned. That binds the body to the signature, so a modified body fails verification at the storage service.
  • CSV normalization strips the byte order mark and forces line endings before the payload is hashed, and the before and after digests are logged only when the content actually changed. The stated purpose is to stop encoding churn from producing spurious new object versions downstream.
  • The content type header is sent but deliberately excluded from the signed header set. That is valid under the signing specification and makes the signature immune to an intermediary rewriting the content type in transit.

Highlights

  • Hand-built SigV4: canonical request construction, credential scoping, chained HMAC-SHA256 key derivation, with an injectable clock making signatures deterministic under test.
  • Byte-level CSV normalization with before/after content hashing, an audit trail of exactly when and how the service modified a file in transit.
  • Tolerant-but-strict payload handling: padding-tolerant base64 with validation enabled, distinct rejection paths before any cryptographic work.

Technologies

  • Python
  • Azure Functions
  • AWS S3
  • HMAC/SigV4
All projectsView ResumeGet in touch