@servicevic-oss/cdk-cleanup-certificate-validation-records 1.3.54 → 1.3.56

package/.jsii

@@ -7,8 +7,8 @@
     ]
   },
   "bundled": {
-    "@aws-sdk/client-acm": "^3.1093.0",
-    "@aws-sdk/client-route-53": "^3.1093.0",
+    "@aws-sdk/client-acm": "^3.1095.0",
+    "@aws-sdk/client-route-53": "^3.1095.0",
     "@types/aws-lambda": "^8.10.162",
     "async-await-retry": "^2.1.0"
   },
@@ -8898,6 +8898,6 @@
       "symbolId": "src/index:CertificateWithCleanup"
     }
   },
-  "version": "1.3.54",
-  "fingerprint": "RAKsqFAeKRshJj06YxUUAJA/VbvXtequOXmrDeOSU3U="
+  "version": "1.3.56",
+  "fingerprint": "DIJsB2ttQvnckw78N245lkTrspSPX5U4w4OSlapLasY="
 }

package/lib/index.js

@@ -43,7 +43,7 @@ const constructs_1 = require("constructs");
  * leave behind when deleting a DNS validated certificate
  */
 class CertificateValidationRecordCleanup extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup", version: "1.3.54" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup", version: "1.3.56" };
     static HANDLER_UID = 'CertRecordsCleanupHandler-2B663BAB-7981';
     static PROVIDER_UID = 'CertRecordsCleanupProvider-57EBF059-2E26';
     static LOG_GROUP_UID = 'CertRecordsCleanupLogGroup-57ABF051-1E25';
@@ -109,7 +109,7 @@ exports.CertificateValidationRecordCleanup = CertificateValidationRecordCleanup;
  * A wrapper class for a vanilla `Certificate` object with automatic cleanup attached
  */
 class CertificateWithCleanup extends cdk.aws_certificatemanager.Certificate {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateWithCleanup", version: "1.3.54" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateWithCleanup", version: "1.3.56" };
     constructor(scope, id, props) {
         super(scope, id, props);
         if (props.validation && props.validation.props.hostedZone && props.validation?.method == cdk.aws_certificatemanager.ValidationMethod.DNS) {

package/node_modules/@aws-sdk/client-acm/dist-cjs/index.js

@@ -71,7 +71,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.1092.0";
+var version = "3.1094.0";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/client-acm/dist-types/runtimeConfig.browser.d.ts

@@ -42,6 +42,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -52,6 +53,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
     clientContextParams?: {
         serviceType?: string | undefined | import("@smithy/types").Provider<string | undefined>;
     };

package/node_modules/@aws-sdk/client-acm/dist-types/runtimeConfig.d.ts

@@ -43,6 +43,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
     httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").ACMHttpAuthSchemeProvider;
@@ -52,6 +53,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
     clientContextParams?: {
         serviceType?: string | undefined | import("@smithy/types").Provider<string | undefined>;
     };

package/node_modules/@aws-sdk/client-acm/dist-types/runtimeConfig.native.d.ts

@@ -41,6 +41,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -51,6 +52,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
     clientContextParams?: {
         serviceType?: string | undefined | import("@smithy/types").Provider<string | undefined>;
     };

package/node_modules/@aws-sdk/client-acm/dist-types/ts3.4/runtimeConfig.browser.d.ts

@@ -71,6 +71,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -90,6 +91,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
   clientContextParams?: {
     serviceType?: string | undefined | import("@smithy/types").Provider<string | undefined>;
   };

package/node_modules/@aws-sdk/client-acm/dist-types/ts3.4/runtimeConfig.d.ts

@@ -72,6 +72,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
   httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").ACMHttpAuthSchemeProvider;
@@ -90,6 +91,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
   clientContextParams?: {
     serviceType?: string | undefined | import("@smithy/types").Provider<string | undefined>;
   };

package/node_modules/@aws-sdk/client-acm/dist-types/ts3.4/runtimeConfig.native.d.ts

@@ -75,6 +75,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -94,6 +95,7 @@ export declare const getRuntimeConfig: (config: ACMClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
   clientContextParams?: {
     serviceType?: string | undefined | import("@smithy/types").Provider<string | undefined>;
   };

package/node_modules/@aws-sdk/client-acm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/client-acm",
-  "version": "3.1093.0",
+  "version": "3.1095.0",
   "description": "AWS SDK for JavaScript Acm Client for Node.js, Browser and React Native",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-acm",
   "license": "Apache-2.0",
@@ -48,12 +48,12 @@
     "test:index": "tsc --noEmit ./test/index-types.ts && node ./test/index-objects.spec.mjs"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.976.0",
-    "@aws-sdk/credential-provider-node": "^3.972.71",
+    "@aws-sdk/core": "^3.977.0",
+    "@aws-sdk/credential-provider-node": "^3.972.72",
     "@aws-sdk/types": "^3.974.2",
-    "@smithy/core": "^3.29.4",
-    "@smithy/fetch-http-handler": "^5.6.6",
-    "@smithy/node-http-handler": "^4.9.6",
+    "@smithy/core": "^3.29.8",
+    "@smithy/fetch-http-handler": "^5.6.10",
+    "@smithy/node-http-handler": "^4.9.10",
     "@smithy/types": "^4.16.1",
     "tslib": "^2.6.2"
   },

package/node_modules/@aws-sdk/client-route-53/dist-cjs/index.js

@@ -70,7 +70,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.1092.0";
+var version = "3.1094.0";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/client-route-53/dist-types/runtimeConfig.browser.d.ts

@@ -42,6 +42,7 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -52,4 +53,5 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-route-53/dist-types/runtimeConfig.d.ts

@@ -43,6 +43,7 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
     httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").Route53HttpAuthSchemeProvider;
@@ -52,4 +53,5 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-route-53/dist-types/runtimeConfig.native.d.ts

@@ -41,6 +41,7 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -51,4 +52,5 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-route-53/dist-types/ts3.4/runtimeConfig.browser.d.ts

@@ -71,6 +71,7 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -90,4 +91,5 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-route-53/dist-types/ts3.4/runtimeConfig.d.ts

@@ -72,6 +72,7 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
   httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").Route53HttpAuthSchemeProvider;
@@ -90,4 +91,5 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-route-53/dist-types/ts3.4/runtimeConfig.native.d.ts

@@ -75,6 +75,7 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -94,4 +95,5 @@ export declare const getRuntimeConfig: (config: Route53ClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-route-53/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/client-route-53",
-  "version": "3.1093.0",
+  "version": "3.1095.0",
   "description": "AWS SDK for JavaScript Route 53 Client for Node.js, Browser and React Native",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-route-53",
   "license": "Apache-2.0",
@@ -52,18 +52,18 @@
     "test:index": "tsc --noEmit ./test/index-types.ts && node ./test/index-objects.spec.mjs"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.976.0",
-    "@aws-sdk/credential-provider-node": "^3.972.71",
+    "@aws-sdk/core": "^3.977.0",
+    "@aws-sdk/credential-provider-node": "^3.972.72",
     "@aws-sdk/middleware-sdk-route53": "^3.972.23",
     "@aws-sdk/types": "^3.974.2",
-    "@smithy/core": "^3.29.4",
-    "@smithy/fetch-http-handler": "^5.6.6",
-    "@smithy/node-http-handler": "^4.9.6",
+    "@smithy/core": "^3.29.8",
+    "@smithy/fetch-http-handler": "^5.6.10",
+    "@smithy/node-http-handler": "^4.9.10",
     "@smithy/types": "^4.16.1",
     "tslib": "^2.6.2"
   },
   "devDependencies": {
-    "@smithy/snapshot-testing": "^2.2.9",
+    "@smithy/snapshot-testing": "^2.2.13",
     "@tsconfig/node20": "20.1.8",
     "@types/node": "^20.14.8",
     "concurrently": "7.0.0",

package/node_modules/@aws-sdk/core/dist-cjs/submodules/httpAuthSchemes/index.js

@@ -1,21 +1,27 @@
-const { HttpResponse, HttpRequest } = require("@smithy/core/protocols");
-const { normalizeProvider, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require("@smithy/core");
-const { ProviderError } = require("@smithy/core/config");
+const { ProviderError, booleanSelector, SelectorType, loadConfig } = require("@smithy/core/config");
 const { setCredentialFeature } = require("@aws-sdk/core/client");
+const { normalizeProvider, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require("@smithy/core");
 const { SignatureV4 } = require("@smithy/signature-v4");
+const { HttpResponse, HttpRequest } = require("@smithy/core/protocols");
 
 const getDateHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.date ?? response.headers?.Date) : undefined;
+const getAgeHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.age ?? response.headers?.Age) : undefined;
 
 const getSkewCorrectedDate = (systemClockOffset) => new Date(Date.now() + systemClockOffset);
 
-const isClockSkewed = (clockTime, systemClockOffset) => Math.abs(getSkewCorrectedDate(systemClockOffset).getTime() - clockTime) >= 300000;
-
-const getUpdatedSystemClockOffset = (clockTime, currentSystemClockOffset) => {
-    const clockTimeInMs = Date.parse(clockTime);
-    if (isClockSkewed(clockTimeInMs, currentSystemClockOffset)) {
-        return clockTimeInMs - Date.now();
+const getUpdatedSystemClockOffset = (clockTime, currentSystemClockOffset, timeRequestSent, ageHeader) => {
+    if (ageHeader !== undefined) {
+        return currentSystemClockOffset;
+    }
+    const serverTime = Date.parse(clockTime);
+    const timeResponseReceived = Date.now();
+    if (timeRequestSent !== undefined && timeResponseReceived - timeRequestSent > 900_000) {
+        return currentSystemClockOffset;
     }
-    return currentSystemClockOffset;
+    const candidateSkew = timeRequestSent !== undefined
+        ? serverTime - (timeRequestSent + timeResponseReceived) / 2
+        : serverTime - timeResponseReceived;
+    return candidateSkew;
 };
 
 const throwSigningPropertyError = (name, property) => {
@@ -57,9 +63,14 @@ class AwsSdkSigV4Signer {
                 signingName = second?.signingName ?? signingName;
             }
         }
-        signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
+        signingProperties._disableClockSkewCorrection = noSkewCorrection;
+        if (!noSkewCorrection) {
+            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+            signingProperties._requestSentAt = Date.now();
+        }
         const signedRequest = await signer.sign(httpRequest, {
-            signingDate: getSkewCorrectedDate(config.systemClockOffset),
+            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),
             signingRegion: signingRegion,
             signingService: signingName,
         });
@@ -68,27 +79,36 @@ class AwsSdkSigV4Signer {
     errorHandler(signingProperties) {
         return (error) => {
             const errorException = error;
-            const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
-            if (serverTime) {
-                const config = throwSigningPropertyError("config", signingProperties.config);
-                const preRequestOffset = signingProperties._preRequestSystemClockOffset;
-                const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset);
-                const isLocalCorrection = newOffset !== config.systemClockOffset;
-                const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;
-                const clockSkewCorrected = isLocalCorrection || isConcurrentCorrection;
-                if (clockSkewCorrected && errorException.$metadata) {
+            if (!signingProperties._disableClockSkewCorrection) {
+                const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
+                if (serverTime) {
+                    const config = throwSigningPropertyError("config", signingProperties.config);
+                    const preRequestOffset = signingProperties._preRequestSystemClockOffset;
+                    const timeRequestSent = signingProperties._requestSentAt;
+                    const ageHeader = getAgeHeader(errorException.$response);
+                    const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset, timeRequestSent, ageHeader);
                     config.systemClockOffset = newOffset;
-                    errorException.$metadata.clockSkewCorrected = true;
+                    const skewExceedsThreshold = Math.abs(newOffset) >= 240_000;
+                    const isLocalCorrection = newOffset !== preRequestOffset;
+                    const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;
+                    if (skewExceedsThreshold && (isLocalCorrection || isConcurrentCorrection) && errorException.$metadata) {
+                        errorException.$metadata.clockSkewCorrected = true;
+                    }
                 }
             }
             throw error;
         };
     }
     successHandler(httpResponse, signingProperties) {
+        if (signingProperties._disableClockSkewCorrection) {
+            return;
+        }
         const dateHeader = getDateHeader(httpResponse);
         if (dateHeader) {
             const config = throwSigningPropertyError("config", signingProperties.config);
-            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset);
+            const timeRequestSent = signingProperties._requestSentAt;
+            const ageHeader = getAgeHeader(httpResponse);
+            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset, timeRequestSent, ageHeader);
         }
     }
 }
@@ -103,9 +123,14 @@ class AwsSdkSigV4ASigner extends AwsSdkSigV4Signer {
         const configResolvedSigningRegionSet = await config.sigv4aSigningRegionSet?.();
         const multiRegionOverride = (configResolvedSigningRegionSet ??
             signingRegionSet ?? [signingRegion]).join(",");
-        signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
+        signingProperties._disableClockSkewCorrection = noSkewCorrection;
+        if (!noSkewCorrection) {
+            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+            signingProperties._requestSentAt = Date.now();
+        }
         const signedRequest = await signer.sign(httpRequest, {
-            signingDate: getSkewCorrectedDate(config.systemClockOffset),
+            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),
             signingRegion: multiRegionOverride,
             signingService: signingName,
         });
@@ -162,7 +187,7 @@ const NODE_SIGV4A_CONFIG_OPTIONS = {
     default: undefined,
 };
 
-const resolveAwsSdkSigV4Config = (config) => {
+const bindResolveAwsSdkSigV4Config = (defaultDisableClockSkewCorrection) => (config) => {
     let inputCredentials = config.credentials;
     let isUserSupplied = !!config.credentials;
     let resolvedCredentials = undefined;
@@ -260,11 +285,11 @@ const resolveAwsSdkSigV4Config = (config) => {
         systemClockOffset,
         signingEscapePath,
         signer,
+        disableClockSkewCorrection: normalizeProvider(config.disableClockSkewCorrection ?? defaultDisableClockSkewCorrection),
     });
     return resolvedConfig;
 };
-const resolveAWSSDKSigV4Config = resolveAwsSdkSigV4Config;
-function normalizeCredentialProvider(config, { credentials, credentialDefaultProvider, }) {
+function normalizeCredentialProvider(config, { credentials, credentialDefaultProvider }) {
     let credentialsProvider;
     if (credentials) {
         if (!credentials?.memoized) {
@@ -299,6 +324,19 @@ function bindCallerConfig(config, credentialsProvider) {
     return fn;
 }
 
+const ENV_DISABLE_CLOCK_SKEW_CORRECTION = "AWS_DISABLE_CLOCK_SKEW_CORRECTION";
+const CONFIG_DISABLE_CLOCK_SKEW_CORRECTION = "disable_clock_skew_correction";
+const NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS = {
+    environmentVariableSelector: (env) => booleanSelector(env, ENV_DISABLE_CLOCK_SKEW_CORRECTION, SelectorType.ENV),
+    configFileSelector: (profile) => booleanSelector(profile, CONFIG_DISABLE_CLOCK_SKEW_CORRECTION, SelectorType.CONFIG),
+    default: false,
+};
+
+const DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION = loadConfig(NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS);
+
+const resolveAwsSdkSigV4Config = bindResolveAwsSdkSigV4Config(DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION);
+const resolveAWSSDKSigV4Config = resolveAwsSdkSigV4Config;
+
 exports.AWSSDKSigV4Signer = AWSSDKSigV4Signer;
 exports.AwsSdkSigV4ASigner = AwsSdkSigV4ASigner;
 exports.AwsSdkSigV4Signer = AwsSdkSigV4Signer;