/// <summary>
        /// Calculates the AWS4 signature using the supplied request parameters and AWS account credentials.
        /// </summary>
        /// <param name="parameters">Request header parameters to be included in the signature</param>
        /// <param name="serviceURL">Service endpoint URL</param>
        /// <param name="authenticationServiceName">
        /// The short-form name of the target service for inclusion in the signature; only needed if this 
        /// cannot be determined by parsing the endpoint.
        /// </param>
        /// <param name="authenticationRegion">
        /// Region name for inclusion in the signature; only needed if this  cannot be determined by parsing 
        /// the endpoint.
        /// </param>
        /// <param name="httpMethod">The HTTP method used to make the request.</param>
        /// <param name="credentials">User credentials</param>
        /// <returns>The signature string to be added as header 'Authorization' on the eventual request</returns>
        /// <exception cref="Amazon.Runtime.SignatureException">If any problems are encountered while signing the request</exception>
        public static string CalculateSignature(IDictionary<string, string> parameters,
                                                string serviceURL,
                                                string httpMethod,
                                                string authenticationServiceName,
                                                string authenticationRegion,
                                                ImmutableCredentials credentials)
        {
            string signingAlgorithm = SigningAlgorithm.HmacSHA256.ToString().ToUpper();

            DateTime dt = DateTime.UtcNow;
            string dateTime = dt.ToString(AWSSDKUtils.ISO8601BasicDateTimeFormat, CultureInfo.InvariantCulture);
            string dateStamp = dt.ToString("yyyyMMdd", CultureInfo.InvariantCulture);

            string region;
            if (!string.IsNullOrEmpty(authenticationRegion))
                region = authenticationRegion;
            else
                region = AWSSDKUtils.DetermineRegion(serviceURL).ToLower();
            string service = authenticationServiceName.Trim().ToLower();

            if (!parameters.ContainsKey("Host"))
                parameters.Add("Host", serviceURL);
            parameters.Add("X-Amz-Date", dateTime);

            string scope = string.Format("{0}/{1}/{2}/{3}", dateStamp, region, service, TERMINATOR);

            List<string> headersToSign = GetHeadersForSigning(parameters);
            string canonicalRequest = GetCanonicalRequest(headersToSign,
                                                          new Uri(serviceURL),
                                                          "",
                                                          parameters,
                                                          AWSSDKUtils.GetParametersAsString(parameters),
                                                          null, // No support for binary request body yet here.
                                                          httpMethod);

            StringBuilder stringToSign = new StringBuilder();
            stringToSign.AppendFormat("{0}-{1}\n{2}\n{3}\n", SCHEME, ALGORITHM, dateTime, scope);

            HashAlgorithm ha = HashAlgorithm.Create("SHA-256");
            byte[] canonicalRequestHashBytes = ha.ComputeHash(Encoding.UTF8.GetBytes(canonicalRequest));
            stringToSign.Append(AWSSDKUtils.ToHex(canonicalRequestHashBytes, true));

            KeyedHashAlgorithm kha = KeyedHashAlgorithm.Create(signingAlgorithm);
            kha.Key = ComposeSigningKey(signingAlgorithm, credentials.ClearSecretKey, credentials.SecureSecretKey, region, dateStamp, service);
            byte[] signature = kha.ComputeHash(Encoding.UTF8.GetBytes(stringToSign.ToString()));

            StringBuilder authorizationHeader = new StringBuilder();
            authorizationHeader.AppendFormat("{0}-{1} ", SCHEME, ALGORITHM);
            authorizationHeader.AppendFormat("Credential={0}/{1}, ", credentials.AccessKey, scope);
            authorizationHeader.AppendFormat("SignedHeaders={0}, ", GetSignedHeaders(headersToSign));
            authorizationHeader.AppendFormat("Signature={0}", AWSSDKUtils.ToHex(signature, true));

            return authorizationHeader.ToString();
        }

 public void TestCredentialsFile()
 {
     var ic = new ImmutableCredentials("access-key", "secret-key", null);
     TestCredentialsFile(ic);
     ic = new ImmutableCredentials("access-key", "secret-key", "token");
     TestCredentialsFile(ic);
 }

        private static void LoadSettings(string settingsResourcePartialName = "settings.json")
        {
            SetDefaults();

            var storedSettings = GetStoredSettings(settingsResourcePartialName);
            if (storedSettings == null)
                return;

            try
            {
                var ic = new ImmutableCredentials(storedSettings.AccessKeyId, storedSettings.SecretAccessKey, storedSettings.SessionToken);
                Credentials = new StoredCredentials(ic);
            }
            catch(Exception e)
            {
                Console.WriteError("Unable to parse get credentials from settings file, defaulting to anonymous credentials. Exception: {0}", e.ToString());
                Credentials = new AnonymousAWSCredentials();
            }

            try
            {
                RegionEndpoint = Amazon.RegionEndpoint.GetBySystemName(storedSettings.RegionEndpoint);
            }
            catch(Exception e)
            {
                Console.WriteError("Unable to parse RegionEndpoint from settings file, defaulting to {0}. Exception: {1}", DefaultRegion, e.ToString());
                RegionEndpoint = Amazon.RegionEndpoint.GetBySystemName(DefaultRegion);
            }
            ResultsBucket = storedSettings.ResultsBucket;
            ResultsTopic = storedSettings.ResultsTopic;
        }

 /// <summary>
 /// Use a HEAD bucket request to get the region for the given bucket.
 ///
 /// This method creates an AmazonS3Client from the credentials passed in.
 /// It's critical that the AmazonS3Client is not used to make any requests that will
 /// be routed through the pipeline.
 /// </summary>
 /// <param name="bucketName"></param>
 /// <param name="credentials"></param>
 /// <returns>the value of the x-amz-bucket-region header from the response</returns>
 private static async Task<string> GetBucketRegionNoPipelineAsync(string bucketName, ImmutableCredentials credentials)
 {
     var headBucketPreSignedUrl = GetHeadBucketPreSignedUrl(bucketName, credentials);
     using (var s3Client = GetUsEast1ClientFromCredentials(credentials))
     {
         return (await AmazonS3HttpUtil.GetHeadAsync(s3Client, s3Client.Config, headBucketPreSignedUrl,
             HeaderKeys.XAmzBucketRegion).ConfigureAwait(false)).HeaderValue;
     }
 }

 /// <summary>
 /// Use a HEAD bucket request to get the region for the given bucket.
 ///
 /// This method creates an AmazonS3Client from the credentials passed in.
 /// It's critical that the AmazonS3Client is not used to make any requests that will
 /// be routed through the pipeline.
 /// </summary>
 /// <param name="bucketName"></param>
 /// <param name="credentials"></param>
 /// <returns>the value of the x-amz-bucket-region header from the response</returns>
 private static string GetBucketRegionNoPipeline(string bucketName, ImmutableCredentials credentials)
 {
     var headBucketPreSignedUrl = GetHeadBucketPreSignedUrl(bucketName, credentials);
     using (var s3Client = GetUsEast1ClientFromCredentials(credentials))
     {
         var response = AmazonS3HttpUtil.GetHead(s3Client, s3Client.Config, headBucketPreSignedUrl, HeaderKeys.XAmzBucketRegion);
         return response.HeaderValue;
     }
 }

        public SystemEnvironmentAWSCredentials()
        {
            string accessKey = Environment.GetEnvironmentVariable("AWS_ACCESS_KEY_ID");
            string secretKey = Environment.GetEnvironmentVariable("AWS_SECRET_KEY");

            if (String.IsNullOrEmpty(accessKey) || String.IsNullOrEmpty(secretKey))
            {
                throw new Exception("No credentials found in the system environment.");
            }
            _credentials = new ImmutableCredentials(accessKey, secretKey, "");
        }

        /// <summary>
        /// Constructs an instance of EnvironmentAWSCredentials and attempts to load AccessKey and SecretKey from ConfigurationManager.AppSettings
        /// </summary>
        public EnvironmentAWSCredentials()
        {
            string accessKey = ConfigurationManager.GetAccessKey();
            string secretKey = ConfigurationManager.GetSecretKey();

            if (string.IsNullOrEmpty(accessKey))
            {
                throw new ArgumentException(string.Format("Access Key could not be found.  Add an appsetting to your App.config with the name {0} with a value of your access key.", "AWSAccessKey"));
            }

            if (string.IsNullOrEmpty(secretKey))
            {
                throw new ArgumentException(string.Format("Secret Key could not be found.  Add an appsetting to your App.config with the name {0} with a value of your secret key.", "AWSSecretKey"));
            }

            this.wrappedCredentials = new ImmutableCredentials(accessKey, secretKey);
        }

        private static void TestCredentialsFile(ImmutableCredentials ic)
        {
            var profileName = "testProfile";
            var profilesLocation = WriteCreds(profileName, ic);
            var creds = new StoredProfileAWSCredentials(profileName, profilesLocation);
            var rc = creds.GetCredentials();
            Assert.AreEqual(ic.SecretKey, rc.SecretKey);
            Assert.AreEqual(ic.AccessKey, rc.AccessKey);
            Assert.AreEqual(ic.UseToken, rc.UseToken);
            Assert.AreEqual(ic.Token, rc.Token);

            for (int i = 0; i < 4; i++)
            {
                creds = new StoredProfileAWSCredentials(profileName + i, profilesLocation);
                Assert.IsNotNull(creds);
                rc = creds.GetCredentials();
                Assert.IsNotNull(rc.AccessKey);
                Assert.IsNotNull(rc.SecretKey);
                var shouldHaveToken = (i % 2 == 1);
                Assert.AreEqual(shouldHaveToken, rc.UseToken);
            }
        }

        /// <summary>
        /// Constructs an instance of EnvironmentVariablesAWSCredentials. If no credentials are found in the environment variables 
        /// then an InvalidOperationException.
        /// </summary>
        public EnvironmentVariablesAWSCredentials()
        {
            string accessKeyId = Environment.GetEnvironmentVariable(ENVIRONMENT_VARIABLE_ACCESSKEY);
            string secretKey = Environment.GetEnvironmentVariable(ENVIRONMENT_VARIABLE_SECRETKEY);
            if (string.IsNullOrEmpty(accessKeyId) || string.IsNullOrEmpty(secretKey))
            {
                throw new InvalidOperationException(string.Format(CultureInfo.InvariantCulture,
                    "The environment variables {0} and {1} were not set with AWS credentials.", ENVIRONMENT_VARIABLE_ACCESSKEY, ENVIRONMENT_VARIABLE_SECRETKEY));
            }

            string sessionToken = Environment.GetEnvironmentVariable(ENVIRONMENT_VARIABLE_SESSION_TOKEN);

            this._wrappedCredentials = new ImmutableCredentials(accessKeyId, secretKey, sessionToken);
            var logger = Logger.GetLogger(typeof(EnvironmentVariablesAWSCredentials));
            logger.InfoFormat("Credentials found using environment variables.");
        }

        /// <summary>
        /// Constructs a SessionAWSCredentials object for the specified accessKey, secretKey.
        /// </summary>
        /// <param name="awsAccessKeyId"></param>
        /// <param name="awsSecretAccessKey"></param>
        /// <param name="token"></param>
        public SessionAWSCredentials(string awsAccessKeyId, string awsSecretAccessKey, string token)
        {
            if (string.IsNullOrEmpty(awsAccessKeyId)) throw new ArgumentNullException("awsAccessKeyId");
            if (string.IsNullOrEmpty(awsSecretAccessKey)) throw new ArgumentNullException("awsSecretAccessKey");
            if (string.IsNullOrEmpty(token)) throw new ArgumentNullException("token");

            _lastCredentials = new ImmutableCredentials(awsAccessKeyId, awsSecretAccessKey, token);
        }

 /// <summary>
 /// Returns a copy of the current credentials.
 /// </summary>
 /// <returns></returns>
 public ImmutableCredentials Copy()
 {
     ImmutableCredentials credentials2 = new ImmutableCredentials();
     credentials2.AccessKey = this.AccessKey;
     credentials2.SecretKey = this.SecretKey;
     return credentials2;
 }

 public StoredCredentials(ImmutableCredentials ic)
 {
     credentials = ic;
 }

 /// <summary>
 /// Returns a copy of the current credentials.
 /// </summary>
 /// <returns></returns>
 public ImmutableCredentials Copy()
 {
     ImmutableCredentials credentials = new ImmutableCredentials
     {
         AccessKey = this.AccessKey,
         SecretKey = this.SecretKey,
         Token = this.Token,
     };
     return credentials;
 }

 /// <summary>
 /// Constructs a BasicAWSCredentials object for the specified accessKey and secretKey
 /// SecretKey is stored in SecureString
 /// </summary>
 /// <param name="accessKey"></param>
 /// <param name="secretKey"></param>
 public BasicAWSCredentials(string accessKey, SecureString secretKey)
 {
     _credentials = new ImmutableCredentials(accessKey, secretKey, null);
 }

 private static string GetHeadBucketPreSignedUrl(string bucketName, ImmutableCredentials credentials)
 {
     // IMPORTANT:
     // This method is called as part of the request pipeline.
     // If the pipeline were to be invoked here it would cause
     // unwanted recursion.
     // As such, the only reason it's OK to use an S3Client here
     // is because this code is using a method that doesn't go
     // through the request pipeline: GetPreSignedURLInternal
     var request = new GetPreSignedUrlRequest
     {
         BucketName = bucketName,
         Expires = DateTime.Now.AddDays(1),
         Verb = HttpVerb.HEAD,
         Protocol = Protocol.HTTP
     };
     // all buckets accessible via USEast1
     using (var s3Client = GetUsEast1ClientFromCredentials(credentials))
     {
         return s3Client.GetPreSignedURLInternal(request, false);
     }
 }

 private static AmazonS3Client GetUsEast1ClientFromCredentials(ImmutableCredentials credentials)
 {
     if (credentials.UseToken)
     {
         return new AmazonS3Client(credentials.AccessKey, credentials.SecretKey, credentials.Token, RegionEndpoint.USEast1);
     }
     else
     {
         return new AmazonS3Client(credentials.AccessKey, credentials.SecretKey, RegionEndpoint.USEast1);
     }
 }

 private static void AppendCredentialsSet(StreamWriter writer, string profileName, ImmutableCredentials ic)
 {
     writer.WriteLine();
     writer.WriteLine("; profile {0} and its credentials", profileName);
     writer.WriteLine("# alternative comment marker");
     writer.WriteLine("[{0}]", profileName);
     writer.WriteLine("aws_access_key_id = {0}", ic.AccessKey);
     writer.WriteLine("aws_secret_access_key={0}", ic.SecretKey);
     if (ic.UseToken)
         writer.WriteLine("aws_session_token= {0}", ic.Token);
     writer.WriteLine();
 }

        private static string WriteCreds(string profileName, ImmutableCredentials ic)
        {
            string configPath = Path.GetFullPath("credentials");
            using (var stream = File.Open(configPath, FileMode.Create, FileAccess.Write, FileShare.None))
            using (var writer = new StreamWriter(stream))
            {
                AppendCredentialsSet(writer, profileName + "0", basicCreds);
                AppendCredentialsSet(writer, profileName + "1", sessionCreds);
                AppendCredentialsSet(writer, profileName, ic);
                AppendCredentialsSet(writer, profileName + "2", basicCreds);
                AppendCredentialsSet(writer, profileName + "3", sessionCreds);
            }

            return configPath;
        }

        /// <summary>
        /// Constructs an instance of EnvironmentAWSCredentials and attempts
        /// to load AccessKey and SecretKey from ConfigurationManager.AppSettings
        /// </summary>
        public EnvironmentAWSCredentials()
        {
            NameValueCollection appConfig = ConfigurationManager.AppSettings;

            // Use hardcoded credentials
            if (!string.IsNullOrEmpty(appConfig[ACCESSKEY]) && !string.IsNullOrEmpty(appConfig[SECRETKEY]))
            {
                var accessKey = appConfig[ACCESSKEY];
                var secretKey = appConfig[SECRETKEY];
                this._wrappedCredentials = new ImmutableCredentials(accessKey, secretKey, null);
                var logger = Logger.GetLogger(typeof(EnvironmentAWSCredentials));
                logger.InfoFormat("Credentials found with {0} and {1} app settings", ACCESSKEY, SECRETKEY);
            }
            // Fallback to the StoredProfileAWSCredentials provider
            else
            {
                this._wrappedCredentials = new StoredProfileAWSCredentials().GetCredentials();
            }
        }

 public CredentialsRefreshState(ImmutableCredentials credentials, DateTime expiration)
 {
     Credentials = credentials;
     Expiration = expiration;
 }