diff --git a/minimal-examples/secure-streams/minimal-secure-streams-policy2c/minimal-secure-streams.c b/minimal-examples/secure-streams/minimal-secure-streams-policy2c/minimal-secure-streams.c
index d79698820..e994caca4 100644
--- a/minimal-examples/secure-streams/minimal-secure-streams-policy2c/minimal-secure-streams.c
+++ b/minimal-examples/secure-streams/minimal-secure-streams-policy2c/minimal-secure-streams.c
@@ -1,7 +1,7 @@
 /*
  * lws-minimal-secure-streams-policy2c
  *
- * Written in 2010-2020 by Andy Green <andy@warmcat.com>
+ * Written in 2010-2021 by Andy Green <andy@warmcat.com>
  *
  * This file is made available under the Creative Commons CC0 1.0
  * Universal Public Domain Dedication.
@@ -426,8 +426,9 @@ int main(int argc, const char **argv)
 			printf("\t.next = (void *)&%s,\n", prev);
 
 		printf("\t.name = \"%s\",\n", auth->name);
+		printf("\t.type= \"%s\",\n", auth->type);
 		printf("\t.streamtype = \"%s\",\n", auth->streamtype);
-		printf("\t.blob = %d,\n", auth->blob_index);
+		printf("\t.blob_index = %d,\n", auth->blob_index);
 		printf("}");
 		if (auth->next)
 			printf(",");
@@ -634,6 +635,13 @@ int main(int argc, const char **argv)
 			printf("\t.trust = {.store = &_ss_ts_%s},\n",
 				purify_csymbol(pol->trust.store->name,
 							buf, sizeof(buf)));
+#if defined(LWS_WITH_SECURE_STREAMS_AUTH_SIGV4)
+		if (pol->aws_region)
+			printf("\t.aws_region= \"%s\",\n", pol->aws_region);
+		if (pol->aws_service)
+			printf("\t.aws_service= \"%s\",\n", pol->aws_service);
+
+#endif
 
 
 		printf("}");
diff --git a/minimal-examples/secure-streams/minimal-secure-streams-sigv4/CMakeLists.txt b/minimal-examples/secure-streams/minimal-secure-streams-sigv4/CMakeLists.txt
index 7dab8b5e0..d612d8a7f 100644
--- a/minimal-examples/secure-streams/minimal-secure-streams-sigv4/CMakeLists.txt
+++ b/minimal-examples/secure-streams/minimal-secure-streams-sigv4/CMakeLists.txt
@@ -12,7 +12,6 @@ require_lws_config(LWS_ROLE_H1 1 requirements)
 require_lws_config(LWS_WITHOUT_CLIENT 0 requirements)
 require_lws_config(LWS_WITH_SECURE_STREAMS 1 requirements)
 require_lws_config(LWS_WITH_SECURE_STREAMS_AUTH_SIGV4 1 requirements)
-require_lws_config(LWS_WITH_SECURE_STREAMS_STATIC_POLICY_ONLY 0 requirements)
 
 if (requirements)
 	add_executable(${SAMP} ss-s3-main.c ss-s3-ss.c)
diff --git a/minimal-examples/secure-streams/minimal-secure-streams-sigv4/policy.json b/minimal-examples/secure-streams/minimal-secure-streams-sigv4/policy.json
new file mode 100644
index 000000000..2cd9a63c1
--- /dev/null
+++ b/minimal-examples/secure-streams/minimal-secure-streams-sigv4/policy.json
@@ -0,0 +1 @@
+{"release":"01234567","product":"myproduct","schema-version":1,"retry": [{"default": {"backoff": [100,200,300,500,1000],"conceal":5,"jitterpc":20,"svalidping":30,"svalidhup":35}}],"certs": [{"baltimore_cybertrust_root": "MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoXDTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKrmD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjrIZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeKmpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSuXmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZydc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/yejl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT929hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3WgxjkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhzksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLSR9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp"}],"trust_stores": [{"name": "s3-root-cert","stack": ["baltimore_cybertrust_root"]}],"auth": [{"name": "sigv4_br","type": "sigv4","blob": 0}],"s": [{"s3PutObj": {"endpoint":"${s3bucket}.s3.amazonaws.com","port":443,"protocol":"h1","http_method":"PUT","http_url":"${s3Obj}","http_no_content_length": false,"tls":true,"tls_trust_store":"s3-root-cert","opportunistic":true,"retry":"default","use_auth":"sigv4_br","aws_region":"region","aws_service":"service","metadata": [{"region": ""},{"service": ""},{"s3bucket": ""},{"s3Obj": ""},{"ctype": "content-type:"},{"xcsha256": "x-amz-content-sha256:"},{"xdate": "x-amz-date:"},{"xacl": "x-amz-acl:"}]}}]}
\ No newline at end of file
diff --git a/minimal-examples/secure-streams/minimal-secure-streams-sigv4/ss-s3-main.c b/minimal-examples/secure-streams/minimal-secure-streams-sigv4/ss-s3-main.c
index d80bacc99..d2175396c 100644
--- a/minimal-examples/secure-streams/minimal-secure-streams-sigv4/ss-s3-main.c
+++ b/minimal-examples/secure-streams/minimal-secure-streams-sigv4/ss-s3-main.c
@@ -1,7 +1,7 @@
 /*
  * S3 Put Object via Secure Streams minimal sigv4 example
  *
- * Written in 2010-2020 by Andy Green <andy@warmcat.com>
+ * Written in 2010-2021 by Andy Green <andy@warmcat.com>
  *			   Amit Pachore <apachor@amazon.com>
  *                         securestreams-dev@amazon.com
  *
@@ -15,6 +15,9 @@
 #include <signal.h>
 
 #include "ss-s3-put.h"
+#if defined(LWS_WITH_SECURE_STREAMS_STATIC_POLICY_ONLY)
+#include "static_policy.h"
+#endif
 
 int interrupted, bad = 1;
 static lws_state_notify_link_t nl;
@@ -22,6 +25,7 @@ extern const lws_ss_info_t s3_ssi;
 
 #if !defined(LWS_SS_USE_SSPC)
 
+#if !defined(LWS_WITH_SECURE_STREAMS_STATIC_POLICY_ONLY)
 static const char * const default_ss_policy =
 	"{"
 	  "\"release\":"			"\"01234567\","
@@ -110,6 +114,7 @@ static const char * const default_ss_policy =
 	   "]"
 	"}"
 ;
+#endif
 
 static char *aws_keyid, *aws_key;
 #endif
@@ -200,8 +205,12 @@ int main(int argc, const char **argv)
 		if ((p = lws_cmdline_option(argc, argv, "-a")))
 			info.ss_proxy_address = p;
 	}
+#else
+#if defined(LWS_WITH_SECURE_STREAMS_STATIC_POLICY_ONLY)
+	info.pss_policies = &_ss_static_policy_entry;
 #else
 	info.pss_policies_json = default_ss_policy;
+#endif
 
 	info.options = LWS_SERVER_OPTION_EXPLICIT_VHOSTS |
 		       LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
diff --git a/minimal-examples/secure-streams/minimal-secure-streams-sigv4/static_policy.h b/minimal-examples/secure-streams/minimal-secure-streams-sigv4/static_policy.h
new file mode 100644
index 000000000..c586f4e3b
--- /dev/null
+++ b/minimal-examples/secure-streams/minimal-secure-streams-sigv4/static_policy.h
@@ -0,0 +1,243 @@
+/*
+ * Autogenerated from the following JSON policy
+ */
+
+#if 0
+{"release":"01234567","product":"myproduct","schema-version":1,"retry": [{"default": {"backoff": [100,200,300,500,1000],"conceal":5,"jitterpc":20,"svalidping":30,"svalidhup":35}}],"certs": [{"baltimore_cybertrust_root": "MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoXDTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKrmD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjrIZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeKmpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSuXmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZydc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/yejl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT929hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3WgxjkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhzksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLSR9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp"}],"trust_stores": [{"name": "s3-root-cert","stack": ["baltimore_cybertrust_root"]}],"auth": [{"name": "sigv4_br","type": "sigv4","blob": 0}],"s": [{"s3PutObj": {"endpoint":"${s3bucket}.s3.amazonaws.com","port":443,"protocol":"h1","http_method":"PUT","http_url":"${s3Obj}","http_no_content_length": false,"tls":true,"tls_trust_store":"s3-root-cert","opportunistic":true,"retry":"default","use_auth":"sigv4_br","aws_region":"region","aws_service":"service","metadata": [{"region": ""},{"service": ""},{"s3bucket": ""},{"s3Obj": ""},{"ctype": "content-type:"},{"xcsha256": "x-amz-content-sha256:"},{"xdate": "x-amz-date:"},{"xacl": "x-amz-acl:"}]}}]}
+
+ Original JSON size: 2058
+#endif
+
+
+static const lws_ss_metadata_t _md_s3PutObj_xacl = {
+	.name = "xacl",
+	.value__may_own_heap = (void *)"x-amz-acl:",
+	.value_length = 0xa,
+	.length = 0,
+	.value_is_http_token = 0xff,
+},
+_md_s3PutObj_xdate = {
+	.next = (void *)&_md_s3PutObj_xacl, 
+	.name = "xdate",
+	.value__may_own_heap = (void *)"x-amz-date:",
+	.value_length = 0xb,
+	.length = 1,
+	.value_is_http_token = 0xff,
+},
+_md_s3PutObj_xcsha256 = {
+	.next = (void *)&_md_s3PutObj_xdate, 
+	.name = "xcsha256",
+	.value__may_own_heap = (void *)"x-amz-content-sha256:",
+	.value_length = 0x15,
+	.length = 2,
+	.value_is_http_token = 0xff,
+},
+_md_s3PutObj_ctype = {
+	.next = (void *)&_md_s3PutObj_xcsha256, 
+	.name = "ctype",
+	.value__may_own_heap = (void *)"content-type:",
+	.value_length = 0xd,
+	.length = 3,
+	.value_is_http_token = 0x1c,
+},
+_md_s3PutObj_s3Obj = {
+	.next = (void *)&_md_s3PutObj_ctype, 
+	.name = "s3Obj",
+	.value__may_own_heap = (void *)"",
+	.value_length = 0x0,
+	.length = 4,
+	.value_is_http_token = 0x0,
+},
+_md_s3PutObj_s3bucket = {
+	.next = (void *)&_md_s3PutObj_s3Obj, 
+	.name = "s3bucket",
+	.value__may_own_heap = (void *)"",
+	.value_length = 0x0,
+	.length = 5,
+	.value_is_http_token = 0x0,
+},
+_md_s3PutObj_service = {
+	.next = (void *)&_md_s3PutObj_s3bucket, 
+	.name = "service",
+	.value__may_own_heap = (void *)"",
+	.value_length = 0x0,
+	.length = 6,
+	.value_is_http_token = 0x0,
+},
+_md_s3PutObj_region = {
+	.next = (void *)&_md_s3PutObj_service, 
+	.name = "region",
+	.value__may_own_heap = (void *)"",
+	.value_length = 0x0,
+	.length = 7,
+	.value_is_http_token = 0x0,
+};
+
+static const uint32_t _rbo_bo_0[] = {
+ 100,  200,  300,  500,  1000, 
+};
+static const lws_retry_bo_t _rbo_0 = {
+	.retry_ms_table = _rbo_bo_0,
+	.retry_ms_table_count = 5,
+	.conceal_count = 5,
+	.secs_since_valid_ping = 30,
+	.secs_since_valid_hangup = 35,
+	.jitter_percent = 20,
+};
+static const uint8_t _ss_der_baltimore_cybertrust_root[] = {
+	/* 0x  0 */ 0x30, 0x82, 0x03, 0x77, 0x30, 0x82, 0x02, 0x5F, 
+	/* 0x  8 */ 0xA0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x04, 0x02, 
+	/* 0x 10 */ 0x00, 0x00, 0xB9, 0x30, 0x0D, 0x06, 0x09, 0x2A, 
+	/* 0x 18 */ 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x05, 
+	/* 0x 20 */ 0x05, 0x00, 0x30, 0x5A, 0x31, 0x0B, 0x30, 0x09, 
+	/* 0x 28 */ 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x49, 
+	/* 0x 30 */ 0x45, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 
+	/* 0x 38 */ 0x04, 0x0A, 0x13, 0x09, 0x42, 0x61, 0x6C, 0x74, 
+	/* 0x 40 */ 0x69, 0x6D, 0x6F, 0x72, 0x65, 0x31, 0x13, 0x30, 
+	/* 0x 48 */ 0x11, 0x06, 0x03, 0x55, 0x04, 0x0B, 0x13, 0x0A, 
+	/* 0x 50 */ 0x43, 0x79, 0x62, 0x65, 0x72, 0x54, 0x72, 0x75, 
+	/* 0x 58 */ 0x73, 0x74, 0x31, 0x22, 0x30, 0x20, 0x06, 0x03, 
+	/* 0x 60 */ 0x55, 0x04, 0x03, 0x13, 0x19, 0x42, 0x61, 0x6C, 
+	/* 0x 68 */ 0x74, 0x69, 0x6D, 0x6F, 0x72, 0x65, 0x20, 0x43, 
+	/* 0x 70 */ 0x79, 0x62, 0x65, 0x72, 0x54, 0x72, 0x75, 0x73, 
+	/* 0x 78 */ 0x74, 0x20, 0x52, 0x6F, 0x6F, 0x74, 0x30, 0x1E, 
+	/* 0x 80 */ 0x17, 0x0D, 0x30, 0x30, 0x30, 0x35, 0x31, 0x32, 
+	/* 0x 88 */ 0x31, 0x38, 0x34, 0x36, 0x30, 0x30, 0x5A, 0x17, 
+	/* 0x 90 */ 0x0D, 0x32, 0x35, 0x30, 0x35, 0x31, 0x32, 0x32, 
+	/* 0x 98 */ 0x33, 0x35, 0x39, 0x30, 0x30, 0x5A, 0x30, 0x5A, 
+	/* 0x a0 */ 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 
+	/* 0x a8 */ 0x06, 0x13, 0x02, 0x49, 0x45, 0x31, 0x12, 0x30, 
+	/* 0x b0 */ 0x10, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x13, 0x09, 
+	/* 0x b8 */ 0x42, 0x61, 0x6C, 0x74, 0x69, 0x6D, 0x6F, 0x72, 
+	/* 0x c0 */ 0x65, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 
+	/* 0x c8 */ 0x04, 0x0B, 0x13, 0x0A, 0x43, 0x79, 0x62, 0x65, 
+	/* 0x d0 */ 0x72, 0x54, 0x72, 0x75, 0x73, 0x74, 0x31, 0x22, 
+	/* 0x d8 */ 0x30, 0x20, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 
+	/* 0x e0 */ 0x19, 0x42, 0x61, 0x6C, 0x74, 0x69, 0x6D, 0x6F, 
+	/* 0x e8 */ 0x72, 0x65, 0x20, 0x43, 0x79, 0x62, 0x65, 0x72, 
+	/* 0x f0 */ 0x54, 0x72, 0x75, 0x73, 0x74, 0x20, 0x52, 0x6F, 
+	/* 0x f8 */ 0x6F, 0x74, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0D, 
+	/* 0x100 */ 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 
+	/* 0x108 */ 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 
+	/* 0x110 */ 0x0F, 0x00, 0x30, 0x82, 0x01, 0x0A, 0x02, 0x82, 
+	/* 0x118 */ 0x01, 0x01, 0x00, 0xA3, 0x04, 0xBB, 0x22, 0xAB, 
+	/* 0x120 */ 0x98, 0x3D, 0x57, 0xE8, 0x26, 0x72, 0x9A, 0xB5, 
+	/* 0x128 */ 0x79, 0xD4, 0x29, 0xE2, 0xE1, 0xE8, 0x95, 0x80, 
+	/* 0x130 */ 0xB1, 0xB0, 0xE3, 0x5B, 0x8E, 0x2B, 0x29, 0x9A, 
+	/* 0x138 */ 0x64, 0xDF, 0xA1, 0x5D, 0xED, 0xB0, 0x09, 0x05, 
+	/* 0x140 */ 0x6D, 0xDB, 0x28, 0x2E, 0xCE, 0x62, 0xA2, 0x62, 
+	/* 0x148 */ 0xFE, 0xB4, 0x88, 0xDA, 0x12, 0xEB, 0x38, 0xEB, 
+	/* 0x150 */ 0x21, 0x9D, 0xC0, 0x41, 0x2B, 0x01, 0x52, 0x7B, 
+	/* 0x158 */ 0x88, 0x77, 0xD3, 0x1C, 0x8F, 0xC7, 0xBA, 0xB9, 
+	/* 0x160 */ 0x88, 0xB5, 0x6A, 0x09, 0xE7, 0x73, 0xE8, 0x11, 
+	/* 0x168 */ 0x40, 0xA7, 0xD1, 0xCC, 0xCA, 0x62, 0x8D, 0x2D, 
+	/* 0x170 */ 0xE5, 0x8F, 0x0B, 0xA6, 0x50, 0xD2, 0xA8, 0x50, 
+	/* 0x178 */ 0xC3, 0x28, 0xEA, 0xF5, 0xAB, 0x25, 0x87, 0x8A, 
+	/* 0x180 */ 0x9A, 0x96, 0x1C, 0xA9, 0x67, 0xB8, 0x3F, 0x0C, 
+	/* 0x188 */ 0xD5, 0xF7, 0xF9, 0x52, 0x13, 0x2F, 0xC2, 0x1B, 
+	/* 0x190 */ 0xD5, 0x70, 0x70, 0xF0, 0x8F, 0xC0, 0x12, 0xCA, 
+	/* 0x198 */ 0x06, 0xCB, 0x9A, 0xE1, 0xD9, 0xCA, 0x33, 0x7A, 
+	/* 0x1a0 */ 0x77, 0xD6, 0xF8, 0xEC, 0xB9, 0xF1, 0x68, 0x44, 
+	/* 0x1a8 */ 0x42, 0x48, 0x13, 0xD2, 0xC0, 0xC2, 0xA4, 0xAE, 
+	/* 0x1b0 */ 0x5E, 0x60, 0xFE, 0xB6, 0xA6, 0x05, 0xFC, 0xB4, 
+	/* 0x1b8 */ 0xDD, 0x07, 0x59, 0x02, 0xD4, 0x59, 0x18, 0x98, 
+	/* 0x1c0 */ 0x63, 0xF5, 0xA5, 0x63, 0xE0, 0x90, 0x0C, 0x7D, 
+	/* 0x1c8 */ 0x5D, 0xB2, 0x06, 0x7A, 0xF3, 0x85, 0xEA, 0xEB, 
+	/* 0x1d0 */ 0xD4, 0x03, 0xAE, 0x5E, 0x84, 0x3E, 0x5F, 0xFF, 
+	/* 0x1d8 */ 0x15, 0xED, 0x69, 0xBC, 0xF9, 0x39, 0x36, 0x72, 
+	/* 0x1e0 */ 0x75, 0xCF, 0x77, 0x52, 0x4D, 0xF3, 0xC9, 0x90, 
+	/* 0x1e8 */ 0x2C, 0xB9, 0x3D, 0xE5, 0xC9, 0x23, 0x53, 0x3F, 
+	/* 0x1f0 */ 0x1F, 0x24, 0x98, 0x21, 0x5C, 0x07, 0x99, 0x29, 
+	/* 0x1f8 */ 0xBD, 0xC6, 0x3A, 0xEC, 0xE7, 0x6E, 0x86, 0x3A, 
+	/* 0x200 */ 0x6B, 0x97, 0x74, 0x63, 0x33, 0xBD, 0x68, 0x18, 
+	/* 0x208 */ 0x31, 0xF0, 0x78, 0x8D, 0x76, 0xBF, 0xFC, 0x9E, 
+	/* 0x210 */ 0x8E, 0x5D, 0x2A, 0x86, 0xA7, 0x4D, 0x90, 0xDC, 
+	/* 0x218 */ 0x27, 0x1A, 0x39, 0x02, 0x03, 0x01, 0x00, 0x01, 
+	/* 0x220 */ 0xA3, 0x45, 0x30, 0x43, 0x30, 0x1D, 0x06, 0x03, 
+	/* 0x228 */ 0x55, 0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14, 0xE5, 
+	/* 0x230 */ 0x9D, 0x59, 0x30, 0x82, 0x47, 0x58, 0xCC, 0xAC, 
+	/* 0x238 */ 0xFA, 0x08, 0x54, 0x36, 0x86, 0x7B, 0x3A, 0xB5, 
+	/* 0x240 */ 0x04, 0x4D, 0xF0, 0x30, 0x12, 0x06, 0x03, 0x55, 
+	/* 0x248 */ 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x08, 0x30, 
+	/* 0x250 */ 0x06, 0x01, 0x01, 0xFF, 0x02, 0x01, 0x03, 0x30, 
+	/* 0x258 */ 0x0E, 0x06, 0x03, 0x55, 0x1D, 0x0F, 0x01, 0x01, 
+	/* 0x260 */ 0xFF, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 
+	/* 0x268 */ 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 
+	/* 0x270 */ 0x0D, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x82, 
+	/* 0x278 */ 0x01, 0x01, 0x00, 0x85, 0x0C, 0x5D, 0x8E, 0xE4, 
+	/* 0x280 */ 0x6F, 0x51, 0x68, 0x42, 0x05, 0xA0, 0xDD, 0xBB, 
+	/* 0x288 */ 0x4F, 0x27, 0x25, 0x84, 0x03, 0xBD, 0xF7, 0x64, 
+	/* 0x290 */ 0xFD, 0x2D, 0xD7, 0x30, 0xE3, 0xA4, 0x10, 0x17, 
+	/* 0x298 */ 0xEB, 0xDA, 0x29, 0x29, 0xB6, 0x79, 0x3F, 0x76, 
+	/* 0x2a0 */ 0xF6, 0x19, 0x13, 0x23, 0xB8, 0x10, 0x0A, 0xF9, 
+	/* 0x2a8 */ 0x58, 0xA4, 0xD4, 0x61, 0x70, 0xBD, 0x04, 0x61, 
+	/* 0x2b0 */ 0x6A, 0x12, 0x8A, 0x17, 0xD5, 0x0A, 0xBD, 0xC5, 
+	/* 0x2b8 */ 0xBC, 0x30, 0x7C, 0xD6, 0xE9, 0x0C, 0x25, 0x8D, 
+	/* 0x2c0 */ 0x86, 0x40, 0x4F, 0xEC, 0xCC, 0xA3, 0x7E, 0x38, 
+	/* 0x2c8 */ 0xC6, 0x37, 0x11, 0x4F, 0xED, 0xDD, 0x68, 0x31, 
+	/* 0x2d0 */ 0x8E, 0x4C, 0xD2, 0xB3, 0x01, 0x74, 0xEE, 0xBE, 
+	/* 0x2d8 */ 0x75, 0x5E, 0x07, 0x48, 0x1A, 0x7F, 0x70, 0xFF, 
+	/* 0x2e0 */ 0x16, 0x5C, 0x84, 0xC0, 0x79, 0x85, 0xB8, 0x05, 
+	/* 0x2e8 */ 0xFD, 0x7F, 0xBE, 0x65, 0x11, 0xA3, 0x0F, 0xC0, 
+	/* 0x2f0 */ 0x02, 0xB4, 0xF8, 0x52, 0x37, 0x39, 0x04, 0xD5, 
+	/* 0x2f8 */ 0xA9, 0x31, 0x7A, 0x18, 0xBF, 0xA0, 0x2A, 0xF4, 
+	/* 0x300 */ 0x12, 0x99, 0xF7, 0xA3, 0x45, 0x82, 0xE3, 0x3C, 
+	/* 0x308 */ 0x5E, 0xF5, 0x9D, 0x9E, 0xB5, 0xC8, 0x9E, 0x7C, 
+	/* 0x310 */ 0x2E, 0xC8, 0xA4, 0x9E, 0x4E, 0x08, 0x14, 0x4B, 
+	/* 0x318 */ 0x6D, 0xFD, 0x70, 0x6D, 0x6B, 0x1A, 0x63, 0xBD, 
+	/* 0x320 */ 0x64, 0xE6, 0x1F, 0xB7, 0xCE, 0xF0, 0xF2, 0x9F, 
+	/* 0x328 */ 0x2E, 0xBB, 0x1B, 0xB7, 0xF2, 0x50, 0x88, 0x73, 
+	/* 0x330 */ 0x92, 0xC2, 0xE2, 0xE3, 0x16, 0x8D, 0x9A, 0x32, 
+	/* 0x338 */ 0x02, 0xAB, 0x8E, 0x18, 0xDD, 0xE9, 0x10, 0x11, 
+	/* 0x340 */ 0xEE, 0x7E, 0x35, 0xAB, 0x90, 0xAF, 0x3E, 0x30, 
+	/* 0x348 */ 0x94, 0x7A, 0xD0, 0x33, 0x3D, 0xA7, 0x65, 0x0F, 
+	/* 0x350 */ 0xF5, 0xFC, 0x8E, 0x9E, 0x62, 0xCF, 0x47, 0x44, 
+	/* 0x358 */ 0x2C, 0x01, 0x5D, 0xBB, 0x1D, 0xB5, 0x32, 0xD2, 
+	/* 0x360 */ 0x47, 0xD2, 0x38, 0x2E, 0xD0, 0xFE, 0x81, 0xDC, 
+	/* 0x368 */ 0x32, 0x6A, 0x1E, 0xB5, 0xEE, 0x3C, 0xD5, 0xFC, 
+	/* 0x370 */ 0xE7, 0x81, 0x1D, 0x19, 0xC3, 0x24, 0x42, 0xEA, 
+	/* 0x378 */ 0x63, 0x39, 0xA9, 
+};
+static const lws_ss_x509_t _ss_x509_baltimore_cybertrust_root = {
+	.vhost_name = "baltimore_cybertrust_root",
+	.ca_der = _ss_der_baltimore_cybertrust_root,
+	.ca_der_len = 891,
+};
+static const lws_ss_trust_store_t _ss_ts_s3_root_cert = {
+	.name = "s3-root-cert",
+	.ssx509 = {
+		&_ss_x509_baltimore_cybertrust_root,
+	}
+};
+
+static const lws_ss_auth_t _ssau_sigv4_br = {
+	.name = "sigv4_br",
+	.type= "sigv4",
+	.streamtype = "(null)",
+	.blob_index = 0,
+};
+
+
+static const lws_ss_policy_t _ssp_s3PutObj = {
+	.streamtype = "s3PutObj",
+	.endpoint = "${s3bucket}.s3.amazonaws.com",
+	.auth = &_ssau_sigv4_br,
+	.metadata = (void *)&_md_s3PutObj_region,
+	.u = {
+		.http = {
+			.method = "PUT",
+			.url = "${s3Obj}",
+		}
+	},
+	.retry_bo = &_rbo_0,
+	.flags = 0x11,
+	.priority = 0x0,
+	.port = 443,
+	.metadata_count = 8,
+	.protocol = 0,
+	.trust = {.store = &_ss_ts_s3_root_cert},
+	.aws_region= "region",
+	.aws_service= "service",
+};
+#define _ss_static_policy_entry _ssp_s3PutObj
+/* estimated footprint 1631 (when sizeof void * = 8) */
diff --git a/minimal-examples/secure-streams/minimal-secure-streams-staticpolicy/minimal-secure-streams.c b/minimal-examples/secure-streams/minimal-secure-streams-staticpolicy/minimal-secure-streams.c
index 1cffe3681..1d7b86909 100644
--- a/minimal-examples/secure-streams/minimal-secure-streams-staticpolicy/minimal-secure-streams.c
+++ b/minimal-examples/secure-streams/minimal-secure-streams-staticpolicy/minimal-secure-streams.c
@@ -1,7 +1,7 @@
 /*
  * lws-minimal-secure-streams-staticpolicy
  *
- * Written in 2010-2020 by Andy Green <andy@warmcat.com>
+ * Written in 2010-2021 by Andy Green <andy@warmcat.com>
  *
  * This file is made available under the Creative Commons CC0 1.0
  * Universal Public Domain Dedication.
@@ -36,7 +36,7 @@ static lws_state_notify_link_t nl;
 
 
 typedef struct myss {
-	struct lws_ss_handle 		*ss;
+	struct lws_ss_handle		*ss;
 	void				*opaque_data;
 	/* ... application specific state ... */
 	lws_sorted_usec_list_t		sul;
@@ -98,8 +98,10 @@ myss_state(void *userobj, void *sh, lws_ss_constate_t state,
 
 	switch (state) {
 	case LWSSSCS_CREATING:
-		lws_ss_set_metadata(m->ss, "uptag", "myuptag123", 10);
-		lws_ss_set_metadata(m->ss, "ctype", "myctype", 7);
+		if (lws_ss_set_metadata(m->ss, "uptag", "myuptag123", 10))
+			lwsl_err("%s set metadata uptag failed\n", __func__);
+		if (lws_ss_set_metadata(m->ss, "ctype", "myctype", 7))
+			lwsl_err("%s set metadata ctype failed\n", __func__);
 		return lws_ss_client_connect(m->ss);
 
 	case LWSSSCS_ALL_RETRIES_FAILED: