code: func (s *Service) Sign(authKeys Auth, r *http.Request) error {
  	date := r.Header.Get("Date")
  	t := time.Now().UTC()
  	if date != "" {
  		var err error
  		t, err = time.Parse(http.TimeFormat, date)
  		if err != nil {
  			return err
  		}
  	}
  	r.Header.Set("Date", t.Format(iSO8601BasicFormat))
  
  	sk, err := authKeys.KeyForSigning(t)
  	if err != nil {
  		return err
  	}
  
  	k := ghmac([]byte("AWS4"+sk.SecretAccessKey), []byte(t.Format(iSO8601BasicFormatShort)))
  	k = ghmac(k, []byte(s.Region))
  	k = ghmac(k, []byte(s.Name))
  	k = ghmac(k, []byte(AWS4_URL))
  
  	h := hmac.New(sha256.New, k)
  	s.writeStringToSign(h, t, r)
  
  	auth := bytes.NewBufferString("AWS4-HMAC-SHA256 ")
  	auth.Write([]byte("Credential=" + sk.AccessKeyId + "/" + s.creds(t)))
  	auth.Write([]byte{',', ' '})
  	auth.Write([]byte("SignedHeaders="))
  	s.writeHeaderList(auth, r)
  	auth.Write([]byte{',', ' '})
  	auth.Write([]byte("Signature=" + fmt.Sprintf("%x", h.Sum(nil))))
  
  	r.Header.Set("Authorization", auth.String())
  
  	if sk.SessionToken != "" {
  		r.Header.Add(AWSSecurityTokenHeader, sk.SessionToken)
  	}
  
  	return nil
  }
docs: // Sign signs an HTTP request with the given AWS keys for use on service s.