--- title: Removing a Hidden Round Trip from a Multi-Region AWS API description: A team running a multi-region AWS user-settings service discovered that their SigV4-based authentication forced clients to perform a pre-flight region... canonical: https://daily.dev/posts/removing-a-hidden-round-trip-from-a-multi-region-aws-api-whlio3y4g twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Removing a Hidden Round Trip from a Multi-Region AWS API | daily.dev og:description: A team running a multi-region AWS user-settings service discovered that their SigV4-based authentication forced clients to perform a pre-flight region... og:url: https://daily.dev/posts/removing-a-hidden-round-trip-from-a-multi-region-aws-api-whlio3y4g og:image: https://api.daily.dev/og/posts/WHlio3y4G.png og:image:alt: Removing a Hidden Round Trip from a Multi-Region AWS API og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Removing a Hidden Round Trip from a Multi-Region AWS API **[InfoQ](https://daily.dev/sources/infoq)** · 12 min read · 0 upvotes · 0 comments ## Summary A team running a multi-region AWS user-settings service discovered that their SigV4-based authentication forced clients to perform a pre-flight region discovery call before every new session. When regional outages in us-east-1 made global failover impossible — because SigV4 signatures are cryptographically bound to a single region — they migrated to SigV4a, which signs requests for a set of regions using ECDSA-P256, letting infrastructure (Route 53, Global Accelerator) handle routing. The code change was minimal: replacing a single region string with a region set. The real cost was a six-month rollout coordinating multiple internal teams, handling firewall allowlist issues, custom signing implementations, and SDK version constraints. The post also covers when SigV4 remains the right choice and notes that SigV4a support is narrower than expected across AWS services. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between AWS SigV4 and SigV4a signing? SigV4 cryptographically binds a signed request to one specific region, embedding the region in the credential scope so the signature fails validation if it lands in a different region. SigV4a instead uses ECDSA-P256 asymmetric signing, letting a single signature stay valid across a declared set of regions, so infrastructure like Route 53 or Global Accelerator can route the request without the client committing to a destination beforehand. _Comparing AWS signing schemes for a multi-region rollout is easier with daily.dev surfacing writeups like this one._ ### Why would an AWS service need a region-discovery step before signing requests? A pre-flight discovery call is typically a workaround for SigV4's region-pinning constraint: since SigV4 requires knowing the destination region before signing, clients call an unauthenticated endpoint to learn the nearest region, cache it, then sign all subsequent requests for that region. This adds an extra round trip (measured at 75ms to 1s p90 depending on distance) and becomes an outage risk if the pinned region degrades. _Engineers debugging latency from extra auth round trips can find grounded explanations like this on daily.dev._ ### Does AWS API Gateway support SigV4a authentication? API Gateway REST APIs with IAM authentication support SigV4a, but API Gateway HTTP APIs do not. Support is also uneven elsewhere in AWS: S3 supports SigV4a only on Multi-Region Access Points, not standard regional endpoints, and a missing signature simply returns an unhelpful 403 with no useful diagnostic information. _Verifying which AWS services accept SigV4a before migrating is the kind of detail daily.dev helps engineers track down._ ## Similar posts on daily.dev - [SigV4 authentication is surprisingly complicated](https://daily.dev/posts/sigv4-authentication-is-surprisingly-complicated-enq64yqyf) · Tigris · 4 upvotes · 3 comments - [Amazon CloudFront now supports Origin Access Control \(OAC\) for Amazon S3 Multi-Region Access Points](https://daily.dev/posts/amazon-cloudfront-now-supports-origin-access-control-oac-for-amazon-s3-multi-region-access-points-pcsddc0jg) · AWS · 0 upvotes · 0 comments - [A Year of AWS Outages: Why Multi-Region Is Still Hard, Even With AI](https://daily.dev/posts/a-year-of-aws-outages-why-multi-region-is-still-hard-even-with-ai-kloljrg7i) · AWS Fundamentals · 1 upvotes · 0 comments - [Returning Traffic Safely: An Active/Active ARC Region Switch Game Day](https://daily.dev/posts/returning-traffic-safely-an-active-active-arc-region-switch-game-day-wjmfn8dhg) · Medium · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#authentication](https://daily.dev/tags/authentication), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/removing-a-hidden-round-trip-from-a-multi-region-aws-api-whlio3y4g) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Removing a Hidden Round Trip from a Multi-Region AWS API","url":"https://daily.dev/posts/removing-a-hidden-round-trip-from-a-multi-region-aws-api-whlio3y4g","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/removing-a-hidden-round-trip-from-a-multi-region-aws-api-whlio3y4g"},"datePublished":"2026-07-13T11:00:49.216Z","dateModified":"2026-09-14T06:48:35.723Z","description":"A team running a multi-region AWS user-settings service discovered that their SigV4-based authentication forced clients to perform a pre-flight region...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0fe7fe1e64a977630cc5216aa292c2fe?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0fe7fe1e64a977630cc5216aa292c2fe?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/removing-a-hidden-round-trip-from-a-multi-region-aws-api-whlio3y4g","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,authentication,api-gateway","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Removing a Hidden Round Trip from a Multi-Region AWS API"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/removing-a-hidden-round-trip-from-a-multi-region-aws-api-whlio3y4g#faq","mainEntity":[{"@type":"Question","name":"What is the difference between AWS SigV4 and SigV4a signing?","acceptedAnswer":{"@type":"Answer","text":"SigV4 cryptographically binds a signed request to one specific region, embedding the region in the credential scope so the signature fails validation if it lands in a different region. SigV4a instead uses ECDSA-P256 asymmetric signing, letting a single signature stay valid across a declared set of regions, so infrastructure like Route 53 or Global Accelerator can route the request without the client committing to a destination beforehand. Comparing AWS signing schemes for a multi-region rollout is easier with daily.dev surfacing writeups like this one."}},{"@type":"Question","name":"Why would an AWS service need a region-discovery step before signing requests?","acceptedAnswer":{"@type":"Answer","text":"A pre-flight discovery call is typically a workaround for SigV4's region-pinning constraint: since SigV4 requires knowing the destination region before signing, clients call an unauthenticated endpoint to learn the nearest region, cache it, then sign all subsequent requests for that region. This adds an extra round trip (measured at 75ms to 1s p90 depending on distance) and becomes an outage risk if the pinned region degrades. Engineers debugging latency from extra auth round trips can find grounded explanations like this on daily.dev."}},{"@type":"Question","name":"Does AWS API Gateway support SigV4a authentication?","acceptedAnswer":{"@type":"Answer","text":"API Gateway REST APIs with IAM authentication support SigV4a, but API Gateway HTTP APIs do not. Support is also uneven elsewhere in AWS: S3 supports SigV4a only on Multi-Region Access Points, not standard regional endpoints, and a missing signature simply returns an unhelpful 403 with no useful diagnostic information. Verifying which AWS services accept SigV4a before migrating is the kind of detail daily.dev helps engineers track down."}}]} ```