--- title: "Set Up Kong API Gateway for AWS" slug: "fortanix-key-insight-set-up-kong-api-gateway" updated: 2026-06-16T13:16:58Z published: 2026-06-16T13:16:58Z canonical: "support.fortanix.com/fortanix-key-insight-set-up-kong-api-gateway" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Set Up Kong API Gateway for AWS ## 1.0 Introduction This article describes how to configure the **Kong API Gateway** with **Auth0** for authentication using the **Client Credentials grant** and a **custom Kong plugin for Amazon Web Services (AWS) request signing** to enable secure communication required for onboarding an AWS connection in Fortanix Key Insight. Configuring the Kong API Gateway involves the following steps: 1. Set up the AWS-Sigv4-Proxy 2. Create a Kong service 3. Create a Kong route 4. Configure the JWT Route plugin 5. Configure the Request Transformer Service plugin 6. Create a Kong consumer 7. Register the Auth0 public key as a JWT credential in the consumer 8. Verify the setup ## 2.0 Prerequisites Before you begin the setup, ensure the following requirements are met: - Auth0 Configuration *For more information on retrieving the Auth0 credentials, refer to* [*Auth0 Configuration for Client Credentials Authentication*](/v1/docs/fortanix-key-insight-auth0-configuration-for-client-credentials-authentication)*.* - An Auth0 tenant is available. - A Machine-to-Machine (M2M) application is created. - You have the following Auth0 credentials: - Client ID - Client Secret - Domain URL - An AWS account with the necessary permissions to access the required AWS services (For example, Amazon S3). ## 3.0 Set Up AWS SigV4 Proxy *Follow the* [*GitHub official documentation*](https://github.com/awslabs/aws-sigv4-proxy) *to set up the* `aws-sigv4-proxy` *Docker container.* The container exposes an `http` port by default. For secure communication, it is recommended to run an **HTTPS reverse proxy** that forwards requests to the `aws-sigv4-proxy` Docker container. ## 4.0 Create a Kong Service Run the following command to create a Kong service to route requests to the AWS SigV4 Proxy: ```bash curl -s -X POST https://:/services/ \  --data "name=aws-service" \  --data "url=https://:" ``` Where, - `<kong host>`: The hostname or IP address where the Kong Admin API is accessible. For example, `kong.example.com`. - `<admin port>`: The port on which the Kong Admin API listens. For example, `8444`. - `<sigv4-proxy-host>`: The hostname or IP of your AWS SigV4 Proxy container or service. For example, `localhost`. - `<sigv4-proxy-port>`: The port exposed by the SigV4 proxy container. For example, `8080`. Ensure that the `preserve_host` (AWS Host header) setting is enabled so that the host header is passed through to the SigV4 proxy: ```bash curl -s -X PATCH https://:/services/aws-service \  --data "preserve_host=true" ``` ## 5.0 Create a Kong Route Run the following command to create a Kong route for `aws-service` and forward incoming requests to the AWS SigV4 Proxy: ```bash curl -s -X POST https://:/services/aws-service/routes \  --data "name=auth0-route" \  --data "paths[]=/aws-auth0" \  --data "strip_path=true" ``` > [!NOTE] > NOTE > > For Auth0 client credentials configuration, the **API Gateway URL** should be `https://<kong-host>:<kong-proxy-port>/<path>`. > > Where, > > - `<kong-proxy-port>`: The port of Kong’s proxy interface. > - `<path>`: The path configured in the Kong route above. For example, `aws-auth0`. Enable the `preserve_host` setting to forward the incoming AWS Host header to the SigV4 proxy using the following command: ```bash curl -s -X PATCH https://:/routes/auth0-route \  --data "preserve_host=true" ``` This step is critical because the SigV4 proxy uses the Host header to determine which AWS service to sign the request for. For example, `kms.us-east-1.amazonaws.com` . ## 6.0 Configure JWT Route Plugin Run the following command to configure a JWT plugin on the `auth0-route`. This plugin verifies Auth0-issued tokens using an `RS256` signature algorithm and the `azp` claim: ```bash curl -s -X POST https://:/routes/auth0-route/plugins \  --data "name=jwt" \  --data "config.key_claim_name=azp" \  --data "config.claims_to_verify[]=exp" \  --data "config.algorithms[]=RS256"  --data "config.run_on_preflight=true" ``` ## Here, the `azp` claim represents the Auth0 Client ID used in the Client Credentials grant. ## 7.0 Configure Request Transformer Service Plugin Run the following command to configure the Request Transformer Service plugin on the `aws-service`: This plugin removes the authorization header before the request is proxied to AWS SigV4 proxy. ```bash curl -s -X POST https://:/services/aws-service/plugins \  --data "name=request-transformer" \  --data "config.remove.headers[]=Authorization" ``` ## 8.0 Create a Kong Consumer A **Consumer** is an entity that represents an external client, in this case, **Fortanix Key Insight**, that interacts with the APIs managed by Kong Gateway. Run the following command to create a consumer (`ki-consumer`) for Fortanix Key Insight: ```bash curl -s -X POST https://:/consumers \  --data "username=ki-consumer" ``` ## 9.0 Register Auth0 Public Key as a JWT Credential in the Consumer Kong requires an **Auth0 Public Key** to verify the JSON Web Token (JWT) presented by Fortanix Key Insight when scanning AWS. The following sections describe the steps to retrieve the public key and add it to Kong: ### 9.1 Retrieve an Access Token From Auth0 Run the following command to retrieve a client-credentials access token from Auth0 to read information such as the `kid` (key ID): ```bash curl -s --request POST \  --url https:///oauth/token \  --header 'content-type: application/json' \  --data @- <",  "client_secret": "",  "audience": "KI-Scanner",  "grant_type": "client_credentials" } JSON ``` Here, replace `<AUTH0 DOMAIN>`, `<AUTH0 CLIENT ID>`, and `<AUTH0 CLIENT SECRET>` with the Auth0 credentials you collected earlier. ### 9.2 Extract the `kid` From the JWT Access Token Perform the following steps: 1. Set the access token obtained in [*Section 9.1: Retrieve an Access Token from Auth0*](/v1/docs/fortanix-key-insight-set-up-kong-api-gateway#91-retrieve-an-access-token-from-auth0) as an environment variable: ```bash export ACCESS_TOKEN= ``` 2. Use the following Python snippet to extract the `kid` from the JWT access token: ```python import sys, json, base64, os token=os.environ.get("ACCESS_TOKEN") header_b64=token.split('.')[0] pad = '=' * (-len(header_b64) % 4) header=json.loads(base64.urlsafe_b64decode(header_b64+pad)) print(header.get('kid','')) ``` The script reads the access token from the `ACCESS_TOKEN` environment variable and prints the Key ID (`kid`) from the JWT header. ### 9.3 Retrieve the Auth0 Certificate Corresponding to `kid` Use the following Python snippet to retrieve the Auth0 certificate that matches the `kid` obtained in [*Section 9.2: Extract the kid from the JWT Access Token*](/v1/docs/fortanix-key-insight-set-up-kong-api-gateway#92-extract-the-kid-from-the-jwt-access-token): ```python import os, json, urllib.request jwks_url = 'https:///.well-known/jwks.json' kid = os.environ['KID'] with urllib.request.urlopen(jwks_url) as resp:    data = json.loads(resp.read().decode()) key = next((k for k in data.get('keys', []) if k.get('kid') == kid), None) if not key:    print('', end='')    raise SystemExit(0) x5c = key.get('x5c', [None])[0] if not x5c:    print('', end='')    raise SystemExit(0) print('-----BEGIN CERTIFICATE-----') for i in range(0, len(x5c), 64):    print(x5c[i:i+64]) print('-----END CERTIFICATE-----') ``` Save the output as `auth0-cert.pem`. Run the following command to extract the public key from the certificate (`auth0-cert.pem`): ```bash cat auth0-cert.pem | openssl x509 -pubkey -noout ``` This command prints the public key to the console. ### 9.4 Add the Public Key to the Kong Consumer Run the following command to add the extracted public key (`<public key>`) to the Kong consumer (`ki-consume`r) to verify Auth0 RS256-signed tokens: ```bash curl -s -X POST https://:/consumers/ki-consumer/jwt \  --data-urlencode "key=" \  --data-urlencode "algorithm=RS256" \  --data-urlencode "rsa_public_key=" ``` ## The `key` value must match the `azp` claim in the Auth0 access token. ## 10.0 Verify the Setup Run the following AWS KMS request to validate that the entire integration is working end-to-end: (You may need to obtain a fresh access token from Auth0 and use it as `<ACCESS TOKEN>` .) ```bash curl -s \  -H "Authorization: Bearer " \  -H "Host: kms.us-east-1.amazonaws.com" \  -H "Content-Type: application/x-amz-json-1.1" \  -H "X-Amz-Target: TrentService.ListKeys" \  -X POST https://:/aws-auth0/ \  -d '{}' ``` If the setup is correct, the response displays the AWS Key Management Service (KMS) keys accessible using the AWS credentials configured in the SigV4 proxy.