---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, Presentation Components, Endpoint authentication, UI components]
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Reference: Amazon Web Services Signature V4
layout: subsection
---

<a id="section_awsV4"></a>
Use the `AWSV4` scheme for REST API endpoints that require Amazon Web Services (AWS) Signature Version 4 authentication.

To use the `AWSV4` authentication scheme, you must:

-   Get the access key ID and secret access key of your AWS service endpoint. Note that the AWS service endpoint contains the region and service codes, which you'll need in the SMD `authType` configuration.
-   Store the AWS credentials in the Workday credential store using the <b>Create AWS Access Key CredStore</b> task on Workday.


## <a id="section_x4r_1nx_m5b"></a>AWS Credentials in the Workday CredStore

In the <b>Create AWS Access Key CredStore</b> task in Workday, configure these fields:

<table><thead><tr><th>Field</th><th>Description</th></tr></thead><tbody><tr><td>App ID</td><td>(Required) The app reference ID with the postfixed account ID. This <b>App ID</b> is the <code>appId</code> in the SMD.</td></tr><tr><td>Access Key ID</td><td>(Required) The AWS access key ID.</td></tr><tr><td>Secret Access Key</td><td>(Required) The AWS secret access key.</td></tr><tr><td>Expiration Time</td><td>If you define an expiration time, Workday checks whether the key has expired in the credential store. If the key has expired, requests using the appId will fail.</td></tr></tbody></table><br/>

For information about AWS access key ID and secret access key, see "Managing access keys for IAM users" in <i>AWS Identity and Access Management</i> documentation.

## <a id="section_dvy_zvr_3pb"></a>SMD authType attributes

In the `authTypes` array in the SMD, add the `AWSV4` authentication scheme.

<table><thead><tr><th>Attribute</th><th>Value</th></tr></thead><tbody><tr><td>id</td><td>A unique ID. Use the <code>id</code> in your PMDs to reference this authentication scheme.</td></tr><tr><td>scheme</td><td><code>AWSV4</code></td></tr><tr><td>accessKeyId</td><td>The AWS access key ID defined on AWS Management Console > Credentials. For information about AWS access keys, see "Managing access keys for IAM users" in <i>AWS Identity and Access Management</i> documentation.</td></tr><tr><td>appId</td><td>Specify the app reference ID with the postfixed account ID. You can see the app reference ID on the <b>Workday Extend App Manager</b> worklet. <p>To enable Presentation Components to retrieve the AWS key from the Workday credential store in encrypted format, the <code>appId</code> must match the <b>App ID</b> in the Workday credential store.</p> <p><b>Note:</b> The <code>appId</code> is case-sensitive.</p></td></tr><tr><td>awsRegion</td><td>The region-code of the AWS service endpoint. Example: <code>us-east-2</code>. For valid values, see "Regional endpoints" in the <i>AWS General Reference</i> documentation.</td></tr><tr><td>awsService</td><td>The service-code of the AWS service endpoint you want to authenticate. Examples: <code>dynamodb</code>, <code>iam</code>, <code>ec2</code>, <code>execute-api</code> (API Gateway). For valid values, see "Service endpoints and quotas" in the <i>AWS General Reference</i> documentation.</td></tr></tbody></table><br/>

SMD Example:

```
"siteAuth": {
    "authTypes": [
      {
        "id": "AWSV4",
        "scheme": "AWSV4",
        "accessKeyId": "ACCESSKEY",
        "appId": "myAWSAppId_ycjtxv",
        "awsRegion": "us-east-2",
        "awsService": "dynamodb"
      },
      {
        "id" : "sso",
        "scheme" : "SSO"
      }
    ]
  },
  
```

<b>Note:</b> The default authentication type is always `SSO`. To override `SSO` with the `AWSV4` authentication type, specify its `id` in the `authType` attribute of the endpoint in the PMD.

## <a id="section_hcl_jjx_m5b"></a>AWS service endpoint in the AMD

Define the AWS service endpoint in the `dataProviders` array in the AMD. Example:

```
"dataProviders": [
    {
      "key": "exampleAWS",
      "value": "https://dynamodb.us-east-2.amazonaws.com"
    }
  ]
```

## <a id="section_b24_mjx_m5b"></a>AWS service endpoint in the PMD

The AWSV4 authentication requires the `Host` header in the PMD endpoint request. To add the `Host` header to an inbound or outbound endpoint, include the `headers` array with a `Host` entry:

```
"headers": [
        {
          "name": "Host",
          "value": "your.awsService.region.amazonaws.com"
        }
]
```

In addition, include any headers required by the AWS service you point to. This PMD example includes the X-Amz-Target and Content-Type headers required by the AWS DynamoDB service.

PMD Example:

```
{
  "endPoints": [
    {
      "baseUrlType": "exampleAWS",
      "name": "viewAWS",
      "authType": "AWSV4",
      "url": "/",
      "headers": [
        {
          "name": "Host",
          "value": "dynamodb.us-east-2.amazonaws.com"
        }, 
        {
          "name": "Content-Type",
          "value": "application/x-amz-json-1.0"
        }, 
        {
          "name": "X-Amz-Target",
          "value": "DynamoDB.Scan "
        }
      ]
    }
  ]
}
```

### Related Information

[Declare Authentication Types in the SMD](/wcp_docs/nyw1530545468565.html)

[Define Endpoint Authentication in the PMD](/wcp_docs/yea1530546235609.html)

[AWS service endpoints in AWS General Reference](https://docs.aws.amazon.com/general/latest/gr/rande.html)

[Managing access keys for IAM users in AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)