{"record":{"id":"8616d0cb15cc3295","repo":"JuliusBrussee/caveman","slug":"bedrock-could-not-build-signing-request-w","errorCode":null,"errorMessage":"bedrock: could not build signing request: %w","messagePattern":"bedrock: could not build signing request: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/providers/bedrock/signing.go","lineNumber":106,"sourceCode":"\t// (SignatureDoesNotMatch). Fall back to a self-resolve only if the caller passed\n\t// nil (no forward URL available).\n\tif upstream == nil {\n\t\tupstream, err = a.ResolveUpstreamURL(ctx, req, providers.RouteContext{})\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\tif credential.Scheme == \"sigv4\" && !matchesInboundSigningIdentity(req, upstream, creds) {\n\t\treturn nil, ErrSigV4Configuration\n\t}\n\n\t// Build a synthetic request carrying the upstream host/path/query and the\n\t// to-be-signed headers, sign it, then merge the signed headers into out. This\n\t// keeps the signing surface (host, path, query, x-amz-*) identical to what the\n\t// proxy actually sends upstream.\n\ttoSign, err := http.NewRequestWithContext(ctx, req.Method, upstream.String(), nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"bedrock: could not build signing request: %w\", err)\n\t}\n\ttoSign.Header = out.Clone()\n\n\tsigningService := runtimeService\n\tif mantle {\n\t\tsigningService = mantleService\n\t}\n\tpayloadHash, err := requestPayloadHash(ctx, req)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tsigner := awssig.Signer{Region: signingRegion(req, upstream), Service: signingService}\n\tif err := signer.Sign(toSign, creds, payloadHash, time.Now()); err != nil {\n\t\t// The error from Sign never contains the secret (see awssig docs); still,\n\t\t// return a generic mapping error rather than the raw text.\n\t\treturn nil, fmt.Errorf(\"bedrock: request signing failed\")\n\t}\n","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/proxy/providers/bedrock/signing.go#L88-L124","documentation":"Before SigV4 signing, the proxy builds a synthetic http.Request carrying the upstream URL with http.NewRequestWithContext. If that construction fails (invalid method or unparseable upstream URL), the error is wrapped and returned. This indicates the proxy could not even assemble the request it intends to sign — an internal/proxy configuration problem, not an AWS rejection.","triggerScenarios":"http.NewRequestWithContext fails inside SanitizeAndMapHeaders, e.g. the resolved upstream URL fails url.Parse (bad scheme/host characters) or req.Method is an invalid HTTP method token.","commonSituations":"Misconfigured upstream base URL for the Bedrock provider (typos, stray spaces, missing scheme, control characters injected from env vars); a rewrite middleware producing a malformed path/query; custom or lowercase-with-spaces HTTP method set by an earlier handler.","solutions":["Inspect the upstream URL built for the Bedrock provider and verify it is a valid absolute http(s) URL (scheme, host, no stray spaces/control chars)","Check that req.Method is a valid HTTP method token (GET/POST/...) and was not corrupted upstream","Log the wrapped inner error (%w) to see whether url.Parse or the method was the culprit and fix the provider/route configuration accordingly"],"exampleFix":"// before\nupstream := \"bedrock-runtime.\" + region + \".amazonaws com/completions\"\n// after\nupstream := \"https://bedrock-runtime.\" + region + \".amazonaws.com/completions\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(upstreamURL)\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n\treturn fmt.Errorf(\"invalid upstream URL %q: %w\", upstreamURL, err)\n}\nif !validMethod(req.Method) { return fmt.Errorf(\"invalid method %q\", req.Method) }","typeGuard":null,"tryCatchPattern":"if err := sanitizeAndMap(); err != nil {\n\tvar buildErr *url.Error\n\tif errors.As(err, &buildErr) { log.Printf(\"bad upstream URL: %v\", buildErr) }\n}","preventionTips":["Validate the upstream base URL at provider configuration time","Never interpolate raw env values into URLs without trimming","Use standard HTTP method constants"],"tags":["bedrock","sigv4","url"],"backgroundTag":"invalid-url-format","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}