I checked why the aws_auth handler doesn't run for subrequests, and saw that nginx doesn't call access phase handlers for subrequests, but other phase handlers are executed for subrequests.
So, a quick workaround for this issue is to move ngx_aws_auth from the access phase to the pre-access phase. New nginx versions have a pre-content phase, which is probably the most suitable here, but these versions currently don't work with nginx-vod-module.
Anyway, just change NGX_HTTP_ACCESS_PHASE to NGX_HTTP_PREACCESS_PHASE in ngx_aws_auth and you should be set.
This fixes the issue discussed in https://github.com/anomalizer/ngx_aws_auth/issues/47 . From a comment (https://github.com/kaltura/nginx-vod-module/issues/717#issuecomment-339252129) by @erankor :