Implement basic support for rest.sigv4_enabled for the Iceberg REST catalog

Cargo.toml

@@ -54,9 +54,11 @@ async-trait = "0.1.86"
 async-std = "1.12"
 aws-config = "1"
 aws-sdk-glue = "1.39"
+aws-sigv4 = { version = "1.3.0", features = ["sign-http"] }
+aws-credential-types = "1.2.2"
 bimap = "0.6"
 bitvec = "1.0.1"
-bytes = "1.6"
+bytes = "1.10"
 chrono = "0.4.38"
 ctor = "0.2.8"
 datafusion = "45"
@@ -86,16 +88,17 @@ port_scanner = "0.1.5"
 rand = "0.8.5"
 regex = "1.10.5"
 reqwest = { version = "0.12.2", default-features = false, features = ["json"] }
+reqwest-middleware = { version = "0.4.0", features = ["json"] }
 rust_decimal = "1.31"
-serde = { version = "1.0.204", features = ["rc"] }
+serde = { version = "1.0.210", features = ["rc"] }
 serde_bytes = "0.11.15"
-serde_derive = "1.0.204"
+serde_derive = "1.0.210"
 serde_json = "1.0.138"
 serde_repr = "0.1.16"
 serde_with = "3.4"
 tempfile = "3.18"
 thrift = "0.17.0"  
-tokio = { version = "1.36", default-features = false }
+tokio = { version = "1.40", default-features = false }
 typed-builder = "0.20"
 url = "2.5.4"
 urlencoding = "2"

crates/catalog/rest/Cargo.toml

@@ -30,13 +30,18 @@ keywords = ["iceberg", "rest", "catalog"]
 
 [dependencies]
 # async-trait = { workspace = true }
+anyhow = { workspace = true }
 async-trait = { workspace = true }
+aws-config = { workspace = true, optional = true }
+aws-credential-types = { workspace = true, optional = true }
+aws-sigv4 = { workspace = true, optional = true }
 chrono = { workspace = true }
 http = "1.1.0"
 iceberg = { workspace = true }
 itertools = { workspace = true }
 log = { workspace = true }
 reqwest = { workspace = true }
+reqwest-middleware = { workspace = true }
 serde = { workspace = true }
 serde_derive = { workspace = true }
 serde_json = { workspace = true }
@@ -50,3 +55,7 @@ iceberg_test_utils = { path = "../../test_utils", features = ["tests"] }
 mockito = { workspace = true }
 port_scanner = { workspace = true }
 tokio = { workspace = true }
+wiremock = "0.6"
+
+[features]
+sigv4 = ["aws-config", "aws-sigv4", "aws-credential-types"]

crates/catalog/rest/src/catalog.rs

@@ -61,6 +61,11 @@ pub struct RestCatalogConfig {
 }
 
 impl RestCatalogConfig {
+    /// Returns the base URL for the REST catalog API
+    pub fn base_url(&self) -> String {
+        [&self.uri, PATH_V1].join("/")
+    }
+
     fn url_prefixed(&self, parts: &[&str]) -> String {
         [&self.uri, PATH_V1]
             .into_iter()
@@ -215,6 +220,35 @@ impl RestCatalogConfig {
     }
 }
 
+#[cfg(feature = "sigv4")]
+impl RestCatalogConfig {
+    pub(crate) fn sigv4_enabled(&self) -> bool {
+        self.props
+            .get("rest.sigv4-enabled")
+            .map_or(false, |v| v == "true")
+    }
+
+    pub(crate) fn signing_region(&self) -> Option<String> {
+        self.props.get("rest.signing-region").cloned()
+    }
+
+    pub(crate) fn signing_name(&self) -> Option<String> {
+        self.props.get("rest.signing-name").cloned()
+    }
+
+    pub(crate) fn access_key_id(&self) -> Option<String> {
+        self.props.get("rest.access-key-id").cloned()
+    }
+
+    pub(crate) fn secret_access_key(&self) -> Option<String> {
+        self.props.get("rest.secret-access-key").cloned()
+    }
+
+    pub(crate) fn session_token(&self) -> Option<String> {
+        self.props.get("rest.session-token").cloned()
+    }
+}
+
 #[derive(Debug)]
 struct RestContext {
     client: HttpClient,

crates/catalog/rest/src/client.rs

@@ -22,14 +22,15 @@ use std::sync::Mutex;
 use http::StatusCode;
 use iceberg::{Error, ErrorKind, Result};
 use reqwest::header::HeaderMap;
-use reqwest::{Client, IntoUrl, Method, Request, RequestBuilder, Response};
+use reqwest::{Client, IntoUrl, Method, Request, Response};
+use reqwest_middleware::{ClientBuilder, ClientWithMiddleware, RequestBuilder};
 use serde::de::DeserializeOwned;
 
 use crate::types::{ErrorResponse, TokenResponse};
 use crate::RestCatalogConfig;
 
 pub(crate) struct HttpClient {
-    client: Client,
+    client: ClientWithMiddleware,
 
     /// The token to be used for authentication.
     ///
@@ -56,9 +57,34 @@ impl Debug for HttpClient {
 
 impl HttpClient {
     /// Create a new http client.
+    #[allow(unused_mut)]
     pub fn new(cfg: &RestCatalogConfig) -> Result<Self> {
+        let mut client_builder = ClientBuilder::new(Client::new());
+
+        #[cfg(feature = "sigv4")]
+        if cfg.sigv4_enabled() {
+            let mut sigv4_middleware = crate::middleware::sigv4::SigV4Middleware::new(
+                &cfg.base_url(),
+                cfg.signing_name().as_deref().unwrap_or("glue"),
+                cfg.signing_region().as_deref(),
+            );
+
+            if let (Some(access_key_id), Some(secret_access_key)) =
+                (cfg.access_key_id(), cfg.secret_access_key())
+            {
+                sigv4_middleware = sigv4_middleware.with_credentials(
+                    access_key_id,
+                    secret_access_key,
+                    cfg.session_token(),
+                );
+            }
+
+            client_builder = client_builder.with(sigv4_middleware);
+        }
+
         Ok(HttpClient {
-            client: Client::new(),
+            client: client_builder.build(),
+
             token: Mutex::new(cfg.token()),
             token_endpoint: cfg.get_token_endpoint(),
             credential: cfg.credential(),

crates/catalog/rest/src/lib.rs

@@ -21,6 +21,7 @@
 
 mod catalog;
 mod client;
+mod middleware;
 mod types;
 
 pub use catalog::*;