Amazon S3 - How to fix 'The request signature we calculated does not match the signature' error?

Question

I have searched on the web for over two days now, and probably have looked through most of the online documented scenarios and workarounds, but nothing worked for me so far.

I am on AWS SDK for PHP V2.8.7 running on PHP 5.3.

I am trying to connect to my Amazon S3 bucket with the following code:

// Create a `Aws` object using a configuration file
$aws = Aws::factory('config.php');

// Get the client from the service locator by namespace
$s3Client = $aws->get('s3');

$bucket = "xxx";
$keyname = "xxx";

try {
    $result = $s3Client->putObject(array(
        'Bucket' => $bucket,
        'Key' => $keyname,
        'Body' => 'Hello World!'
    ));

    $file_error = false;
} catch (Exception $e) {
    $file_error = true;

    echo $e->getMessage();

    die();
}

My config.php file is as follows:

return [
    // Bootstrap the configuration file with AWS specific features
    'includes' => ['_aws'],
    'services' => [
        // All AWS clients extend from 'default_settings'. Here we are
        // overriding 'default_settings' with our default credentials and
        // providing a default region setting.
        'default_settings' => [
            'params' => [
                'credentials' => [
                    'key'    => 'key',
                    'secret' => 'secret'
                ]
            ]
        ]
    ]
];

It is producing the following error:

The request signature we calculated does not match the signature you provided. Check your key and signing method.

I've already checked my access key and secret at least 20 times, generated new ones, used different methods to pass in the information (i.e. profile and including credentials in code) but nothing is working at the moment.

So, the AWS SDK just implements a bunch of direct API calls. With AWS, every single call you make takes your private key (or `secret` above), and uses that to calculate a signature based on your access key, the current timestamp, plus a bunch of other factors. See http://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html. It's a longshot, but given that they include the timestamp, perhaps your local environment's time is off? — Josh Padnick, May 29 '15 at 00:58
Happened when we had passed an incorrect size (`Content-Length`) in object metadata. (Long version: we were directly passing the input stream from a Java `HttpServletRequest` to the S3 client, and passing in `request.getContentLength()` as `Content-Length` via metadata; when the servlet was (randomly) receiving chunked requests (`Transfer-Encoding: chunked`), `getContentLength()` was returning `-1` - which led `putObject` to fail (randomly). Obscure; but clearly our fault because we were passing an incorrect object size.) — Janaka Bandara, Jul 05 '20 at 02:35
First time visitor, please go through many answers, there are many scenario in which you will get this error & various solutions given in this page — Satish Patro, Sep 13 '21 at 14:43
In my case, for opensearch, i had given different info in path and URL... — kumarahul, Sep 17 '21 at 04:43
This error was occurring for me because my query params were not included as part of my path when signing. So it should be `path: "/default/resource?param1=1111&param2=11111"` Not just `path: "/default/resource` — NiltiakSivad, Apr 06 '23 at 18:21

score 178 · Accepted Answer · edited May 15 '19 at 18:22

178

After two days of debugging, I finally discovered the problem...

The key I was assigning to the object started with a period i.e. ..\images\ABC.jpg, and this caused the error to occur.

I wish the API provides more meaningful and relevant error message, alas, I hope this will help someone else out there!

edited May 15 '19 at 18:22

Yves M.

29,855
23
108
144

answered May 29 '15 at 01:37

Joseph Lam

5,289
3
14
13

1

I had the state bucket and key backwards and this is the error you get (signature doesn't match). Wtf terraform? – Lo-Tan Dec 16 '18 at 23:09
37

A leading slash also caused this issue for me. You need just path/to/file, not /path/to/file – Graham Jan 17 '19 at 22:39
15

And for me the issue were **white spaces** inside of key – Adam Szmyd May 27 '19 at 09:59
Replacing `/home/user/` with `~` and then changing it back again worked for me – retr0 Jun 28 '19 at 12:19
16

To add to this, I was getting this error message when having a plus sign `+` in my key. – LCC Jul 25 '19 at 11:58
in my case it was on aws so new `S3( 'key' 'secret', true );` last additional optional useSSL = true needed to set, which by default – phvish Aug 30 '19 at 09:46
14

In my case this was caused by having a path in the bucket parameter. Instead of `bucket = "bucketname"`, I had `bucket = "bucketname/something"`. This also gives the Signature does not match error. – CyclingDave Nov 14 '19 at 16:27
7

I was getting this when I did not provide the `Content-Type` header in my upload file request – Angel Venchev Mar 11 '20 at 07:24
4

I had to replace a plus sign (`+`) in my URL with `%20`. – gpresland Jul 22 '20 at 19:23
I had a problem with spanish tildes `Alegría| note the `í` was throwing an error. – Jose A Aug 09 '20 at 08:51
1

I had a problem with an extra URL parameter that I was adding to the query string (&version=1.3). Can't have extra parameters – jpruizs Sep 26 '20 at 01:27
I was stuck because my file ended right after the secret key, i.e. no line return... – Joël Dec 10 '20 at 08:23
Mine was setting "OriginalFileName" in the header with a leading space / tab – Boycs Jan 13 '21 at 23:43
2

I had a / in the middle of the SERVER_SECRET_KEY and solved after three hours of research... – maxdangelo Apr 11 '21 at 19:24
3

In my case, I was making a POST request, instead of PUT (`getSignedUrlPromise` method had an operation parameter 'putObject') – Ivan Loler May 04 '21 at 13:03
2

Came here having this issue using Minio. I can confirm: HTTP Verb mismatch will trigger a signature fail as well as additional characters somewhere. Take this as an example on how NOT to create API error reportings. – Ric Hard Oct 22 '21 at 14:37
my secret key also has + and failed. how to resolve this – purplecity Dec 23 '21 at 10:29
Adding to the laundry list of potential causes, for me it was the browser environment itself. Seems that some cookies, possibly from AWS logins may interfere causing this error message. Opening the link in Incognito mode has helped at times with the link then starting to work outside of Incognito too. Basically what I'm saying is that even though the link and associated credentials are 100% correct it can still malfunction and become utterly confusing. – domjancik Feb 10 '22 at 12:10
2

I have spent practically the entire workday to discover that my kotlin server was setting a content-type of `image/jpeg`, and my javascript library was setting a content-type header of `image/jpg`. That one little e... Nearly an entire workday... I read the min.io documentation, installed mc, did mc admin trace etc etc, stared at logs for hours... one e... jpeg... #@#!IM$#@M! – Magical Gordon Aug 10 '22 at 22:05
In my case, I was copying the signed URL out of a quoted string, and I accidently included a trailing ` \ ` (backslash) at the end of the URL that was meant to escape the final `"` – PeterS Feb 08 '23 at 14:28
for .net c# we have to us as below var request = new GetPreSignedUrlRequest() { BucketName = bucketName, Key = objectKey, Verb = HttpVerb.PUT, Expires = DateTime.UtcNow.AddHours(1), ContentType = "image/jpeg", }; – AG Mohamed Jun 02 '23 at 15:42
Had the same problem description, here is what helped - I've regenerated the key and that helped. Seems like AWS changed the format and our key was generated 4 years ago. We are sure that none of our credentials were changed before this action, so: regeneration helped. We are using AWS SDK for .NET. – 0x49D1 Jul 20 '23 at 09:25

score 73 · Answer 2 · answered Sep 05 '15 at 07:04

73

I get this error with the wrong credentials. I think there were invisible characters when I pasted it originally.

answered Sep 05 '15 at 07:04

Alex Levine

1,489
15
16

14

I simply dobuble-clicked on `key_hash_lala/key_hash_continues` and it selected only one part. Alas, how hard is it to tell the user "wrong passsword, dude!"? – Ufos May 10 '19 at 10:34
The first time I had issues copying the key from the downloadable csv. For the second key i created, I just copied it from the the browser and didn't have any issues – nthaxis Jul 11 '19 at 19:49
+1 to @nthaxis - copying from the .csv caused a failure - copying directly from the browser and it works a treat – NKCampbell Sep 15 '19 at 03:38
For me, it was a result of wrong credentials as well. I missed a character in my credentials. – Promise Preston Jan 08 '21 at 04:44
for all of us that use double click to select and copy, it won't copy trailing "+" chars!! – Cesc May 18 '22 at 10:15
For me there were an invisible \n at the end of AWS_ACCESS_KEY_ID that were causing the error – Janderson Silva May 19 '22 at 00:21
Hello from 2022, same issue :) thank you! – uudecode Sep 15 '22 at 10:56

score 40 · Answer 3 · answered Jul 08 '19 at 16:20

40

I had the same error in nodejs. But adding signatureVersion in s3 constructor helped me:

const s3 = new AWS.S3({
  apiVersion: '2006-03-01',
  signatureVersion: 'v4',
});

answered Jul 08 '19 at 16:20

Oleg

1,048
1
9
18

2

Tried many things before i stumbled onto this! This was the answer for me. – DavidG Nov 13 '20 at 10:27
Worked for me, file path ok, every else was ok, currently the same function is in use for other app and never give this error in that app. Thanks, Oleg – Javier Rojas Jul 02 '21 at 00:09
2

This solved it for me too. – Chad Johnson May 11 '22 at 18:48
1

This is what worked for me as well `signatureVersion`. Would have been helpful if the document had mention about this https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/getting-started_basic-usage.html – Manas Feb 01 '23 at 09:03
Worked for me as well – shubhamjr Jun 13 '23 at 10:11
you are a life saver . i was facing this error for the past 8 hours – Naveen Ravi Jun 13 '23 at 18:34

score 32 · Answer 4 · answered Apr 05 '16 at 20:31

32

I had the same problem when tried to copy an object with some UTF8 characters. Below is a JS example:

var s3 = new AWS.S3();

s3.copyObject({
    Bucket: 'somebucket',
    CopySource: 'path/to/Weird_file_name_ðÓpíu.jpg',
    Key: 'destination/key.jpg',
    ACL: 'authenticated-read'
}, cb);

Solved by encoding the CopySource with encodeURIComponent()

answered Apr 05 '16 at 20:31

ecdeveloper

2,777
1
22
16

Thanks, worked with me! I also tried to encode the "Key" since the key also contains UTF8 characters, and it ends up in a wrong directory Only encoding the CopySource works just fine. – Eric Fu Jan 28 '22 at 13:30

Harrish Selvarajah · Answer 5 · 2020-06-01T17:07:12.807

23

This error seems to occur mostly if there is a space before or after your secret key

edited Jun 01 '20 at 17:07

answered Jun 01 '20 at 16:59

Harrish Selvarajah

1,763
12
11

1

Had same problem. Skype sometimes copies values with blank lines. Just paste it to notepad and then copy it without whitespaces. – michal-michalak Aug 11 '20 at 18:04
1

Yes ! Check also if you have spaces in any other headers. – Eino Gourdin Aug 31 '20 at 09:41

score 21 · Answer 6 · answered Nov 18 '20 at 20:38

21

My AccessKey had some special characters in that were not properly escaped.

I didn't check for special characters when I did the copy/paste of the keys. Tripped me up for a few mins.

A simple backslash fixed it. Example (not my real access key obviously):

secretAccessKey: 'Gk/JCK77STMU6VWGrVYa1rmZiq+Mn98OdpJRNV614tM'

becomes

secretAccessKey: 'Gk\/JCK77STMU6VWGrVYa1rmZiq\+Mn98OdpJRNV614tM'

answered Nov 18 '20 at 20:38

AliS

655
6
9

this is a good catch i too have it in mine, but this also didnt solved my issue – Shreyan Mehta Apr 13 '23 at 02:32

score 20 · Answer 7 · answered Jan 20 '22 at 13:25

20

I've just encountered this and, I'm a little embarrassed to say, it was because I was using an HTTP POST request instead of PUT.

Despite my embarrassment, I thought I'd share in case it saves somebody an hour of head scratching.

answered Jan 20 '22 at 13:25

Ross Coundon

647
1
9
20

4

lol, I'm so glad you shared this -- I did the same thing and didn't even think to check that! – Adam Coster Dec 09 '22 at 22:03
1

youre my hero – Adnan Aug 12 '23 at 12:19

score 13 · Answer 8 · answered Mar 04 '19 at 21:12

In a previous version of the aws-php-sdk, prior to the deprecation of the S3Client::factory() method, you were allowed to place part of the file path, or Key as it is called in the S3Client->putObject() parameters, on the bucket parameter. I had a file manager in production use, using the v2 SDK. Since the factory method still worked, I did not revisit this module after updating to ~3.70.0. Today I spent the better part of two hours debugging why I had started receiving this error, and it ended up being due to the parameters I was passing (which used to work):

$s3Client = new S3Client([
    'profile' => 'default',
    'region' => 'us-east-1',
    'version' => '2006-03-01'
]);
$result = $s3Client->putObject([
    'Bucket' => 'awesomecatpictures/catsinhats',
    'Key' => 'whitecats/white_cat_in_hat1.png',
    'SourceFile' => '/tmp/asdf1234'
]);

I had to move the catsinhats portion of my bucket/key path to the Key parameter, like so:

$s3Client = new S3Client([
    'profile' => 'default',
    'region' => 'us-east-1',
    'version' => '2006-03-01'
]);
$result = $s3Client->putObject([
    'Bucket' => 'awesomecatpictures',
    'Key' => 'catsinhats/whitecats/white_cat_in_hat1.png',
    'SourceFile' => '/tmp/asdf1234'
]);

What I believe is happening is that the Bucket name is now being URL Encoded. After further inspection of the exact message I was receiving from the SDK, I found this:

Error executing PutObject on https://s3.amazonaws.com/awesomecatpictures%2Fcatsinhats/whitecats/white_cat_in_hat1.png

AWS HTTP error: Client error: PUT https://s3.amazonaws.com/awesomecatpictures%2Fcatsinhats/whitecats/white_cat_in_hat1.png resulted in a 403 Forbidden

This shows that the / I provided to my Bucket parameter has been through urlencode() and is now %2F.

The way the Signature works is fairly complicated, but the issue boils down to the bucket and key are used to generate the encrypted signature. If they do not match exactly on both the calling client, and within AWS, then the request will be denied with a 403. The error message does actually point out the issue:

The request signature we calculated does not match the signature you provided. Check your key and signing method.

So, my Key was wrong because my Bucket was wrong.

Thank you for posting this, when I saw "check your key" I was thinking the access key or secret key was wrong. In my case it was the object key (and bucket). So moving around the bucket and object key values as you describe worked. Amazon needs to clarify what key they're complaining about IMO. Thanks again — tbone, Dec 30 '21 at 20:44

score 13 · Answer 9 · answered Sep 08 '20 at 10:05

13

For Python set - signature_version s3v4

s3 = boto3.client(
   's3',
   aws_access_key_id='AKIAIO5FODNN7EXAMPLE',
   aws_secret_access_key='ABCDEF+c2L7yXeGvUyrPgYsDnWRRC1AYEXAMPLE',
   config=Config(signature_version='s3v4')
)

answered Sep 08 '20 at 10:05

saurav sarkar

187
1
8

Indeed. More info here: https://aws.amazon.com/premiumsupport/knowledge-center/presigned-url-s3-bucket-expiration/ – Davy Oct 19 '20 at 13:42

score 11 · Answer 10 · answered Feb 28 '20 at 17:45

11

In my case I was using s3.getSignedUrl('getObject') when I needed to be using s3.getSignedUrl('putObject') (because I'm using a PUT to upload my file), which is why the signatures didn't match.

answered Feb 28 '20 at 17:45

Elon Zito

2,872
1
24
28

Thank you! I was using POST instead of PUT... using PUT just worked. – Jk33 Apr 08 '22 at 04:13

score 9 · Answer 11 · answered Feb 21 '17 at 10:33

9

Actually in Java i was getting same error.After spending 4 hours to debug it what i found that that the problem was in meta data in S3 Objects as there was space while sitting cache controls in s3 files.This space was allowed in 1.6.* version but in 1.11.* it is disallowed and thus was throwing the signature mismatch error

answered Feb 21 '17 at 10:33

sarir

91
1
5

Also happens if you pass an incorrect `Content-Length` in the metadata – Janaka Bandara Jul 05 '20 at 02:37

score 8 · Answer 12 · edited Sep 20 '21 at 11:09

8

For me I used axios and by deafult it sends header

content-type: application/x-www-form-urlencoded

so i change to send:

content-type: application/octet-stream

and also had to add this Content-Type to AWS signature

const params = {
    Bucket: bucket,
    Key: key,
    Expires: expires,
    ContentType: 'application/octet-stream'
}

const s3 = new AWS.S3()
s3.getSignedUrl('putObject', params)

edited Sep 20 '21 at 11:09

Emmanuel

4,933
5
46
71

answered Feb 28 '19 at 03:05

Dawid Kisielewski

809
5
17

Same, changing `content-type` did the trick. – Toto Briac Jul 10 '21 at 08:56

score 7 · Answer 13 · answered Jan 06 '21 at 19:57

I had the same issue, the problem I had was I imported the wrong environment variable, which means that my secret key for AWS was wrong. Based on reading all the answers, I would verify that all your access ID and secret key is right and there are no additional characters or anything.

score 6 · Answer 14 · edited Mar 30 '23 at 13:30

6

If none of the other mentioned solution works for you , then try using

aws configure

This command (Getting started with the AWS CLI) will open a set of options asking for keys, region and output format.

Hope this helps!

edited Mar 30 '23 at 13:30

Abdullah Khawer

4,461
4
29
66

answered Feb 19 '18 at 06:21

saurabh

601
6
8

score 6 · Answer 15 · answered Dec 14 '18 at 09:16

Another possible issue might be that the meta values contain non US-ASCII characters. For me it helped to UrlEncode the values when adding them to the putRequest:

request.Metadata.Add(AmzMetaPrefix + "artist", HttpUtility.UrlEncode(song.Artist));
request.Metadata.Add(AmzMetaPrefix + "title", HttpUtility.UrlEncode(song.Title));

score 5 · Answer 16 · answered Nov 13 '18 at 09:44

5

In my case I parsed an S3 url into its components.

For example:

Url:    s3://bucket-name/path/to/file

Was parsed into:

Bucket: bucket-name
Path:   /path/to/file

Having the path part containing a leading '/' failed the request.

answered Nov 13 '18 at 09:44

AVIDeveloper

2,954
1
25
32

score 4 · Answer 17 · answered May 29 '19 at 05:41

4

I had the same issue. I had the default method, PUT set to define the pre-signed URL but was trying to perform a GET. The error was due to method mismatch.

answered May 29 '19 at 05:41

maheeka

1,983
1
17
25

This worked for me. The HTTP verb (PUT, POST) used to generate the signed URL must be the same as the verb used when performing an upload with that URL. – craigcaulfield May 27 '20 at 21:46

score 4 · Answer 18 · answered Mar 15 '21 at 14:23

4

When I gave the wrong secret key which is of value "secret" knowingly, it gave this error. I was expecting some valid error message details like "authentication failed" or something

answered Mar 15 '21 at 14:23

Satish Patro

3,645
2
27
53

score 3 · Answer 19 · answered Mar 09 '18 at 18:17

3

I just experienced this uploading an image to S3 using the AWS SDK with React Native. It turned out to be caused by the ContentEncoding parameter.

Removing that parameter "fixed" the issue.

answered Mar 09 '18 at 18:17

John Veldboom

2,049
26
29

score 3 · Answer 20 · answered Aug 01 '19 at 11:22

3

generating a fresh access key worked for me.

answered Aug 01 '19 at 11:22

yungBolo

41
1

fresh access key worked for me too - thankfully i got the hint from reading https://github.com/aws/aws-sdk-js/issues/86#issuecomment-153433220 and in my case it was SQS that was throwing the exception in the title. The keys I was earlier using (when getting exception) were 97 days old with exclamation mark in the IAM dashboard – gawkface Apr 27 '21 at 01:59

score 3 · Answer 21 · answered Nov 26 '19 at 05:25

3

Most of the time it happens because of the wrong key (AWS_SECRET_ACCESS_KEY). Please cross verify your AWS_SECRET_ACCESS_KEY. Hope it will work...

answered Nov 26 '19 at 05:25

Amol Kakade

61
3

score 3 · Answer 22 · answered Jun 27 '20 at 18:13

3

After debugging and spending a lot of time, in my case, the issue was with the access_key_id and secret_access_key, just double check your credentials or generate new one if possible and make sure you are passing the credentials in params.

answered Jun 27 '20 at 18:13

jazeb007

578
1
5
11

When I read the above answer, I double-checked my secret key and realized that I have added / at the end. – Ezrqn Kemboi Jul 22 '20 at 12:45

score 3 · Answer 23 · answered Aug 19 '21 at 10:46

3

This issue happened to me because I was accidentally assigning the value of the ACCESS_KEY_ID to SECRET_ACCESS_KEY_ID. Once this was fixed everything worked fine.

answered Aug 19 '21 at 10:46

flyingfishcattle

1,817
3
14
25

score 2 · Answer 24 · answered Jun 04 '21 at 17:43

Like others, I also had the similar issue but in java sdk v1. For me, below 2 fixes helped me.

My key to object looked like this /path/to/obj/. In this, i first removed the / in the beginning.
Further, point 1 alone did not solve the issue. I upgraded my sdk version from 1.9.x to 1.11.x

After applying both the fixes, it worked. So my suggestion is not slog it out. If nothing else is working, just try upgrading the lib.

score 1 · Answer 25 · answered Jun 14 '17 at 23:55

I had a similar error, but for me it seemed to be caused by re-using an IAM user to work with S3 in two different Elastic Beanstalk environments. I treated the symptom by creating an identically permissioned IAM user for each environment and that made the error go away.

score 1 · Answer 26 · answered Mar 06 '19 at 08:05

I don't know if anyone came to this issue while trying to test the outputted URL in browser but if you are using Postman and try to copy the generated url of AWS from the RAW tab, because of escaping backslashes you are going to get the above error.

Use the Pretty tab to copy and paste the url to see if it actually works.

I run into this issue recently and this solution solved my issue. It's for testing purposes to see if you actually retrieve the data through the url.

This answer is a reference to those who try to generate a download, temporary link from AWS or generally generate a URL from AWS to use.

can you please tell me how you solved that issue? it is working fine in postman but not in nodejs — Yashraj basan, Jun 13 '21 at 13:25

score 1 · Answer 27 · answered Feb 24 '22 at 01:02

I was getting this error in our shared environment where the SDK was being used, but using the same key/secret and the aws cli, it worked fine. The build system script had a space after the key and secret and session keys, which the code read in as well. So the fix for me was to adjust the build script to remove the spaces after the variables being used.

Just adding this for anyone who might miss that frustrating invisible space at the end of their creds.

score 1 · Answer 28 · answered Jun 14 '23 at 09:35

I have spent 8 hours trying to fix this issue. For me, everything mentioned in all answers were fine. The keys were correct and tested through CLI. I was using SDK V3 which is the latest and doesn't need the signature version. It finally turned out to be passing a wrong object in the Body! (not a text nor a array buffer). Yes, it's one of the most stupid error messages that I have ever seen in my 16 years career. AWS sometimes drives me crazy.

score 0 · Answer 29 · answered Oct 09 '18 at 13:56

0

In my case the bucketname was wrong, it included the first part of the key (bucketxxx/keyxxx) - there was nothing wrong with the signature.

answered Oct 09 '18 at 13:56

Martin Flower

353
4
14

score 0 · Answer 30 · answered Nov 28 '18 at 13:33

0

In my case (python) it failed because I had these two lines of code in the file, inherited from an older code

http.client.HTTPConnection._http_vsn = 10 http.client.HTTPConnection._http_vsn_str = 'HTTP/1.0'

answered Nov 28 '18 at 13:33

Nir Soudry

379
3
6

score 0 · Answer 31 · answered Jan 07 '19 at 12:40

I encountered this in a Docker image, with a non-AWS S3 endpoint, when using the latest awscli version available to Debian stretch, i.e. version 1.11.13.

Upgrading to CLI version 1.16.84 resolved the issue.

To install the latest version of the CLI with a Dockerfile based on a Debian stretch image, instead of:

RUN apt-get update
RUN apt-get install -y awscli
RUN aws --version

Use:

RUN apt-get update
RUN apt-get install -y python-pip
RUN pip install awscli
RUN aws --version

score 0 · Answer 32 · answered Jan 16 '19 at 14:07

0

I had to set

Aws.config.update({
  credentials: Aws::Credentials.new(access_key_id, secret_access_key)
})

before with the ruby aws sdk v2 (there is probably something similiar to this in the other languages as well)

answered Jan 16 '19 at 14:07

Yo Ludke

2,149
2
23
38

score 0 · Answer 33 · answered Mar 29 '19 at 17:08

The issue in my case was the API Gateway URL used to configure Amplify that had an extra slash at the end...

The queried url looked like https://....amazonaws.com/myapi//myendpoint. I removed the extra slash in the conf and it worked.

Not the most explicit error message of my life.

Mauricio Gracia Gutierrez · Answer 34 · 2019-04-25T21:14:39.450

In my case I was calling s3request.promise().then() incorreclty which caused two executions of the request happening when only one call was done.

What I mean is that I was iterating through 6 objects but 12 requests were made (you can check by logging in the console or debuging network in the browser)

Since the timestamp for the second, unwanted, request did not match the signture of the firs one this produced this issue.

score 0 · Answer 35 · answered Jul 25 '19 at 06:23

Got this error while uploading document to CloudSearch through Java SDK. The issue was because of a special character in the document to be uploaded. The error "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method." is very misleading.

score 0 · Answer 36 · answered Sep 25 '19 at 17:22

Like others have said, I had this exact same problem and it turned out to be related to the password / access secret. I generated a password for my s3 user that was not valid, and it didn't inform me. When trying to connect with the user, it gave this error. It doesn't seem to like certain or all symbols in passwords (at least for Minio)

score 0 · Answer 37 · answered Sep 26 '19 at 06:07

0

I am getting the same error Due to following reason.

I have entered right credentials but with copy-paste. So that may b issue of junk characters insertion while copy paste. I have entered manually and ran the code and now its working fine

Thank You

answered Sep 26 '19 at 06:07

Pooja K Bhatt

979
2
10
18

score 0 · Answer 38 · answered Nov 26 '19 at 15:15

I solved this issue by adding apiVersion inside AWS.S3(), then it works perfectly for S3 signed url.

Change from

var s3 = new AWS.S3();

to

var s3 = new AWS.S3({apiVersion: '2006-03-01'});

For more detailed examples, can refer to this AWS Doc SDK Example: https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/javascript/example_code/s3/s3_getsignedurl.js

score 0 · Answer 39 · answered Feb 13 '20 at 03:34

Just to add to the many different ways this can show up.

If you using safari on iOS and you are connected to the Safari Technology Preview console - you will see the same problem. If you disconnect from the console - the problem will go away.

Of course it makes troubleshooting other issues difficult but it is a 100% repro.

I am trying to figure out what I can change in STP to stop it from doing this but have not found it yet.

score 0 · Answer 40 · answered Apr 07 '20 at 02:03

I got this error while trying to copy an object. I fixed it by encoding the copySource. This is actually described in the method documentation:

Params: copySource – The name of the source bucket and key name of the source object, separated by a slash (/). Must be URL-encoded.

CopyObjectRequest objectRequest = CopyObjectRequest.builder()
                .copySource(URLEncoder.encode(bucket + "/" + oldFileKey, "UTF-8"))
                .destinationBucket(bucket)
                .destinationKey(newFileKey)
                .build();

Parash · Answer 41 · 2020-05-21T14:50:01.833

0

This mostly happens when you take a SECRET key and pass it to elastic client.

e.g: Secret Key: ABCW1233**+OxMMMMMMM8x**

While configuring in the client, You should only pass: ABCW1233**(The part before the + sign).

edited May 21 '20 at 14:50

answered May 18 '20 at 09:39

Parash

81
1
4

It looks like this is a real key, that is *NOT* a good idea to publish on a public website such as SO – xiawi May 18 '20 at 10:04
1

It was not a real key but just random digits, however on your suggestion, I have made it look more like a total example key. Thank you. – Parash May 21 '20 at 14:51

score 0 · Answer 42 · answered May 25 '20 at 10:28

0

In my case, I was using S3 (uppercase) as service name when making request using postman in AWS signature Authorization method

answered May 25 '20 at 10:28

Juan Sánchez

1,014
2
15
29

2

can you please add more detail where to ad AWS Sign ? – Mr Coder Jun 25 '20 at 15:38

score 0 · Answer 43 · edited Nov 25 '20 at 09:48

Weirdly I previously had an error The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256. There was an answer on Stackoverflow which required to add AWS_S3_REGION_NAME = 'eu-west-2' (your region), AWS_S3_SIGNATURE_VERSION = "s3v4.

After doing that the previous error cleared but I ended up with this signature error again. Searched for answers until I ended up removing the AWS_S3_SIGNATURE_VERSION = "s3v4 Then it worked. Placed it here maybe it might help someone. I am using Django by the way.

score 0 · Answer 44 · answered Jun 23 '21 at 15:16

I was facing the same issue. Code snippet where causing the issue:

<iframe title="PDF Viewer" src={`${docPdfLink}&embed=true`} />

For me, there were two problems

Using embed at the end of the link was making a signature mismatch, So, was getting the problem.
file in S3 has content type other than application/pdf due to which I wasn't able to render pdf after fixing 1st point even.

So, Here is what I did in code:

<iframe title="PDF Viewer" src={docPdfLink} />

and here in s3 bucket: s3 file content type Besides, we also need to make sure that whenever we are adding or creating pdf to s3, it should have application content application/pdf

score 0 · Answer 45 · answered Sep 03 '21 at 14:56

0

These changes worked for me. Modified the code

FROM: const s3 = new AWS.S3();

TO: const s3 = new AWS.S3({ apiVersion: '2006-03-01', signatureVersion: 'v4', });

Changed the method call from POST to PUT.

answered Sep 03 '21 at 14:56

Srinivas

64
1
6

score 0 · Answer 46 · answered Sep 07 '21 at 15:04

I had the same issue in c#. In turn out that the issue was coming from the way restsharp return the body when you try to access it directly. In our case, it was with the /feeds/2021-06-30/documents endpoint with this body:

{
    "contentType":"text/xml; charset=UTF-8"
}

The issue was when trying to sign the request on the AWSSignerHelper class on the HashRequestBody method you have the following code:

 public virtual string HashRequestBody(IRestRequest request)
    {
        Parameter body = request.Parameters.FirstOrDefault(parameter => ParameterType.RequestBody.Equals(parameter.Type));
        string value = body != null ? body.Value.ToString() : string.Empty;
        return Utils.ToHex(Utils.Hash(value));
    }

At this point the value of body.Value.ToString() will be:

{contentType:text/xml; charset=UTF-8}

It is missing the double quotes which restsharp add when it post the request however when you access the value like that it doesn't which give an invalid hash because the value isn't the same as the one sended.

I replaced the code with that for the moment and it work:

public virtual string HashRequestBody(IRestRequest request)
    {
        Parameter body = request.Parameters.FirstOrDefault(parameter => ParameterType.RequestBody.Equals(parameter.Type));
        string value = body != null ? body.Value.ToString() : string.Empty;
        if (body?.ContentType == "application/json")
        {
            value = Newtonsoft.Json.JsonConvert.SerializeObject(body.Value);
        }
        return Utils.ToHex(Utils.Hash(value));
    }

score 0 · Answer 47 · answered Nov 30 '21 at 08:10

If you are a Android developer and is using the signature function from AWS sample code, you are most likely wondering why the ListS3Object works but not the GetS3Object. This is because when you set the setDoOutput(true) and using GET HTTP method, Android's HttpURLConnection switches the request to a POST. Thus, invalidating your signature. Check my original post of the issue.

score 0 · Answer 48 · answered Dec 01 '21 at 10:10

As per java docs of files uploading to S3 bucket: If you are uploading Amazon Web Services KMS-encrypted objects, you need to specify the correct region of the bucket on your client and configure Amazon Web Services Signature Version 4 for added security. For more information on how to do this, see http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html# specify-signature-version

So you may need to configure the signature version 4.

score 0 · Answer 49 · answered Jun 26 '22 at 12:04

0

In my case it was missing CORS configuration for the bucket. This helped:

[{
    "AllowedHeaders": ["*"],
    "AllowedMethods": ["GET","HEAD","POST","PUT"],
    "AllowedOrigins": ["*"],
    "ExposeHeaders": []
}]

answered Jun 26 '22 at 12:04

JozefS

328
2
11

score 0 · Answer 50 · answered Jul 19 '22 at 00:42

I am using the java SDK and got the same error. For me it was because I was sending special characters in the request. The characters I was sending were the Korean letters of a file name. And the specific location was:

com.amazonaws.services.s3.model.PutObjectRequest request.metadata.userMetadata

I realised that I didn't really need to send this information, so removing it fixed my error.

score 0 · Answer 51 · answered Oct 20 '22 at 15:15

I was getting this same error while downloading a S3 file during a CloudFormation::Init procedure. The issue was that the folder name in S3 had a space in it. I moved the files to a new folder without a space, instead an underscore, and that fixed the issue.

score 0 · Answer 52 · answered Feb 03 '23 at 07:23

0

I was facing the same issue with Cloudfront backend with s3, and my solution was not sending the "Host" header in the cloudfront origin policy.

Hope it would solve some other's problem.

Regards, Krishna k

answered Feb 03 '23 at 07:23

Mr Chaudhary

1

Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Feb 05 '23 at 17:30
Please add further details to your answers. – Lajos Arpad Feb 08 '23 at 13:29

score 0 · Answer 53 · answered Jun 21 '23 at 16:29

Also stuck on this for hours... turns out seems to be an issue/ bug on the AWS side as per this Github issue/ comment. The suggested solution is to specify the AWS endpoint directly

boto3.client(
  's3',
  endpoint_url=f'https://s3.{region}.amazonaws.com',
  config=boto3.session.Config(s3={'addressing_style': 'virtual'})
)

score 0 · Answer 54 · answered Jul 12 '23 at 20:38

In my case, the issue is that we are using the wrong Bucket Name. AWS S3 buckets have specific naming conventions that we need to follow. You can find the naming convention rules in the link below:

Bucket Naming Rules

For example:

Bucket Name: g7asset-shwe (throwing error)

Bucket Name: g7asset (working properly)

Additionally, it's important to note that S3 does not actually have a "folder" structure. Each object in a bucket has a unique key, and the object is accessed through that key.

While some S3 utilities, including the AWS console, simulate a "folder" structure, it's not directly related to how S3 functions. In other words, you don't need to worry about it. Simply create the object with a forward slash (/) in its key, and everything will work as expected.

score 0 · Answer 55 · answered Jul 26 '23 at 18:56

I encountered the same error message when using the Amazon SES SDK to instantiate an AmazonSimpleEmailServiceClient object and subsequently GetSendStatistics.

I was using my administrative level IAM users credentials to connect ... which failed with the familiar error: "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."

I resolved this by creating an Access Key under the My Security Credentials for my IAM user. When I used the credentials from the new access key, my connection to Amazon SES via the SDK worked.

score 0 · Answer 56 · answered Aug 01 '23 at 16:35

0

You must check all the metadata values you are sending to s3 must be of type string, as aws s3 doesn't support non-string values.

answered Aug 01 '23 at 16:35

shraban kumar sahani

1

Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Aug 06 '23 at 06:59

score -1 · Answer 57 · answered Dec 14 '18 at 02:21

I could solve this issue with setting environment variables.

export AWS_ACCESS_KEY=
export AWS_SECRET_ACCESS_KEY=

In IntelliJ + py.test, I set environment variables with [Run] > [Edit Configurations] > [Configuration] > [Environment] > [Environment variables]

score -1 · Answer 58 · answered Mar 24 '20 at 04:45

-1

I got this when I had quotes around the key in ~/.aws/credentials.

aws_secret_access_key = "KEY"

answered Mar 24 '20 at 04:45

Fakrudeen

5,778
7
44
70

score -1 · Answer 59 · answered Apr 22 '21 at 06:08

-1

For no good reason that I could see, deleting the bucket and re-creating it worked for me.

answered Apr 22 '21 at 06:08

Doug

665
2
8
22

Jalal Sordo · Answer 60 · 2023-01-23T22:17:22.523

It May not be 100% the answer to the OP, but some people might find this useful, In my case, it was one of those times when the IDE autocomplete the code and you don't check afterwards :

My bean had

new BasicAWSCredentials(storageProperties.getAccessKey(), storageProperties.getAccessKey())))

So basically two getAccessKey() instead of getSecret(), so it should be:

new BasicAWSCredentials(storageProperties.getAccessKey(), storageProperties.getSecret())))

score -1 · Answer 61 · answered Jul 04 '23 at 11:37

I had the same error [1] when I was trying to get a file from S3 using Ansible. My error was to use the presigned URL returned by aws_s3 when I put the file to S3 in order to get the file later in my Ansible role.

- name: Upload CVE report to S3
  amazon.aws.aws_s3:
    profile: "{{ wazuh_cve_report_aws_boto_profile }}"
    bucket: "{{ wazuh_cve_report_aws_s3_bucket }}"
    object: "{{ wazuh_cve_report_aws_s3_object_prefix }}"
    src: "{{ wazuh_cve_report_generated_reports_dir }}/vulnerabilities.csv"
    region: "{{ wazuh_cve_report_aws_region }}"
    mode: put
    overwrite: different
    encrypt: true
  register: wazuh_cve_report_s3_object_register

- name: Debug S3 object
  ansible.builtin.debug:
    msg: "{{ wazuh_cve_report_s3_object_register.url }}"

Trying to get the file using the URL in wazuh_cve_report_s3_object_register.url results in SignatureDoesNotMatch error code.

To remediate to this problem I had to use another task with mode geturl to get the correct presigned URL to download the file that I had just uploaded.

- name: Upload CVE report to S3
  amazon.aws.aws_s3:
    profile: "{{ wazuh_cve_report_aws_boto_profile }}"
    bucket: "{{ wazuh_cve_report_aws_s3_bucket }}"
    object: "{{ wazuh_cve_report_aws_s3_object_prefix }}"
    src: "{{ wazuh_cve_report_generated_reports_dir }}/vulnerabilities.csv"
    region: "{{ wazuh_cve_report_aws_region }}"
    mode: put
    overwrite: different
    encrypt: true

- name: Get CVE report presigned URL for Downloading from S3
  amazon.aws.aws_s3:
    profile: "{{ wazuh_cve_report_aws_boto_profile }}"
    bucket: "{{ wazuh_cve_report_aws_s3_bucket }}"
    object: "{{ wazuh_cve_report_aws_s3_object_prefix }}"
    src: "{{ wazuh_cve_report_generated_reports_dir }}/vulnerabilities.csv"
    region: "{{ wazuh_cve_report_aws_region }}"
    # 7 days
    expiry: 604800
    mode: geturl
  register: wazuh_cve_report_s3_object_register

- name: Debug S3 object
  ansible.builtin.debug:
    msg: "{{ wazuh_cve_report_s3_object_register.url }}"

We can't GET a file with presigned URL that was signed for PUT method.

When you create a presigned URL, you must provide your security credentials, and then specify the following:

An Amazon S3 bucket

An object key (if downloading this object will be in your Amazon S3 bucket, if uploading this is the file name to be uploaded)

An HTTP method (GET for downloading objects or PUT for uploading)

An expiration time interval [2]

Hoping my answer may help someone.

Regards

[1] The request signature we calculated does not match the signature you provided. Check your key and signing method.

[2] https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html

score -2 · Answer 62 · answered Apr 08 '20 at 11:57

-2

In my case I had to wait for a couple of hours between uploading files into the bucket and generating pre-signed URLs for them.

answered Apr 08 '20 at 11:57

Andrii Yurchuk

3,090
6
29
40

3

It is not event a solution. Nobody will wait for hours to upload a file. – Alex Sham Aug 27 '21 at 13:15

score -2 · Answer 63 · edited Aug 18 '21 at 04:38

In my case incorrect order of the api call parameters caused this.

For example when I called /api/call1?parameter1=x&parameter2=y I received the following message:

"The signature of the request did not match calculated signature."

Upon swapping the parameters: /api/call1?parameter2=y&parameter1=x, the api call worked as expected.

Very frustrating as the api documentation itself had the parameters in a different order. This also wasn't the only call this happened for.

Amazon S3 - How to fix 'The request signature we calculated does not match the signature' error?

63 Answers63

Linked