Delphi AWS SDK — S3, SQS, IoT, Lambda, DynamoDB

Amazon Web Services exposes more than 250 APIs — storage, queueing, IoT, compute, machine learning, identity, DNS, CDN, search, RDBMS, key management and dozens more. The official AWS SDK ships in Java, Python, JavaScript, Go, Ruby, PHP and .NET, but not in Delphi or C++Builder. sgcWebSockets fills the gap with a coherent set of native components: TsgcHTTP_API_AmazonSQS for queueing, TsgcWSAPI_AWSIoT for MQTT over WebSocket (Signature v4 presigned), TsgcHTTPClient with the built-in AWS Signature v4 signer for any REST service, and the sgcOpenAPI code generator for the long tail of services that publish a machine-readable specification.

Authentication is uniform: an access key + secret key pair (or a temporary STS session token with IAM role assumption), region, and service identifier. The Signature v4 helper computes the canonical request, the string-to-sign, the HMAC chain and the Authorization header for every outbound call, so every AWS endpoint — from S3 PUT to Bedrock InvokeModel — speaks the same dialect. Everything runs on Windows, macOS, Linux, iOS and Android with the same Pascal source.

Every AWS request — S3 PUT, DynamoDB Query, Lambda Invoke, even the MQTT-on-WebSocket presigned URL used by AWS IoT — carries an Authorization: AWS4-HMAC-SHA256 header (or query string) derived from your access key, secret key, region and service name. sgcWebSockets ships a single Pascal Signature v4 helper that handles canonical request building, the string-to-sign, HMAC chaining and clock-skew detection — reusable from any HTTP / WebSocket / MQTT component. Combined with TsgcOAuth2Client for STS / Cognito flows and the built-in IAM role assumption pattern, you get the same security posture as the official SDKs in any other language.

AWS IoT Core accepts MQTT over TLS (port 8883) with X.509 mutual TLS, MQTT over WebSocket (port 443) signed with Signature v4, or MQTT with a custom authoriser. TsgcWSAPI_AWSIoT handles all three — the WebSocket transport is the easiest path from corporate networks that block 8883, and the component generates the presigned URL transparently from your access key.

uses
  sgcWSAPI_AWSIoT;

var
  vIoT: TsgcWSAPI_AWSIoT;
begin
  vIoT := TsgcWSAPI_AWSIoT.Create(nil);
  try
    vIoT.Authentication.SignatureV4.AccessKey := 'AKIA...';
    vIoT.Authentication.SignatureV4.SecretKey := 'wJalrXUtn...';
    vIoT.Authentication.SignatureV4.Region    := 'eu-west-1';
    vIoT.Host       := 'a1b2c3d4e5f6g7-ats.iot.eu-west-1.amazonaws.com';
    vIoT.OnMQTTConnect      := DoMQTTConnect;
    vIoT.OnMQTTSubscribe    := DoMQTTSubscribe;
    vIoT.OnMQTTPublish      := DoMQTTPublish;
    vIoT.Active := True;
  finally
    vIoT.Free;
  end;
end;