AWS auth in a Gondolin VM: why SigV4 breaks the secrets bridge
The Gondolin bridge substitutes placeholders in request headers, but the AWS SDK signs the request over the placeholder value. The substitution happens too late and every call returns SignatureDoesNotMatch. The fix is to mount the host's ~/.aws/ read-only instead.
Development#gondolin#aws#sigv4