Amazon MWS - request signature calculated does not match the signature provided

Question

Getting the following error message from https://mws.amazonservices.com/:

<Type>Sender</Type>
<Code>SignatureDoesNotMatch</Code>
−
<Message>
The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.
</Message>

Here is the VB.net code I am using to calculate the request. I have removed the SecretKey and AWSAccessKeyId for security reasons.

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        Dim sURL As String = "https://mws.amazonservices.com/"

        Dim sRequest As String = ""
        sRequest &= "Acknowledged=" & Server.UrlEncode("false")
        sRequest &= "&Action=" & Server.UrlEncode("GetReportList")
        sRequest &= "&AWSAccessKeyId=" & Server.UrlEncode("REMOVED-FOR-SECURITY")
        sRequest &= "&Marketplace=" & Server.UrlEncode("REMOVED-FOR-SECURITY")
        sRequest &= "&Merchant=" & Server.UrlEncode("REMOVED-FOR-SECURITY")
        sRequest &= "&SignatureMethod=" & Server.UrlEncode("HmacSHA256")
        sRequest &= "&SignatureVersion=" & Server.UrlEncode("2")
        sRequest &= "&Timestamp=" & Server.UrlEncode(DateTime.Now.ToString("yyyy-MM-ddTHH:mm:ssCST"))
        sRequest &= "&Version=" & Server.UrlEncode("2009-01-01")

        Dim StringToSign As String = "GET\n" & "mws.amazonservices.com\n" & "/\n" & sRequest
        sRequest &= "&Signature=" & Server.UrlEncode(HashString(StringToSign))

        Response.Write("<a href=""" & sURL & "?" & sRequest & """>Click here</a>")

    End Sub

    Public Shared Function HashString(ByVal StringToHash As String) As String
        Dim myEncoder As New System.Text.UTF8Encoding
        Dim Key() As Byte = myEncoder.GetBytes("REMOVED-FOR-SECURITY")
        Dim XML() As Byte = myEncoder.GetBytes(StringToHash)
        Dim myHMACSHA256 As New System.Security.Cryptography.HMACSHA256(Key)
        Dim HashCode As Byte() = myHMACSHA256.ComputeHash(XML)
        Return Convert.ToBase64String(HashCode)
    End Function

Andrew · Accepted Answer · 2015-01-23T21:49:10.623

150

If you are landing here from Google after starting to work through some of the Amazon documentation, it's quite likely that you're seeing the 'request signature' error above due to a inadvertent leading or trailing space on your secret access key. Check that first!

edited Jan 23 '15 at 21:49

answered Nov 03 '11 at 22:00

Andrew

9,090
8
46
59

1

It was actually a single quote at the end of the secret key which was specified in the web.config file of my web app - Thanks! – Ricardo Sanchez Jan 09 '12 at 04:02
3

totally fixed it for me, trailing space at the end of my secret key in my credentials file – spinners Aug 28 '14 at 21:41
1

yeap, not matching key/secret – Robert Trzebiński Jan 22 '15 at 14:51
1

Bingo. My secret access key had a leading space that I hadn't noticed. – plenderj May 20 '15 at 18:20
1

same error was caused by me using a bogus bucket name - specifically, I've had a leading slash in the String used as a bucket name. – alexakarpov Sep 22 '15 at 03:38
2

thanks Andrew! and here's how to check for it for fellow devs: http://docs.aws.amazon.com/AWSToolkitVS/latest/UserGuide/tkv_setup.html#creds – keremispirli Oct 27 '15 at 22:34
1

Yes thank you so much, would of never thought to check this – Joe Maher Feb 02 '16 at 12:52
1

I made a mistake by defining a PUT VERB and upload using the POST VERB. – JonHendrix Nov 21 '17 at 11:33
1

This has nothing to do with the keys. AWS SDK doesn't have necessary input validation. – vishu9219 Jan 10 '18 at 12:50
1

Thank you so much. Spent an hour on debugging this issue – Sher Sanginov Dec 28 '21 at 02:37

score 26 · Answer 2 · answered May 21 '14 at 00:01

26

In my experience, this error just means "One of your parameters is wrong, good luck finding it!" I ran into this error using the S3 SDK. I was trying to upload a file but I mistakenly supplied the full file path ("C:\Users\addaone\image.png") as the Key instead of just the file name.

answered May 21 '14 at 00:01

Nick Rogers

375
4
6

1

Yep, that's my experience too! – Paul Grimshaw Jul 08 '14 at 08:43
just to share my experience, in my case it was the endpoint property, I was using the bucket name into the endpoint name (as suggested by a previous aws error...) – Andrea Rega Oct 03 '17 at 10:10

score 20 · Answer 3 · answered Dec 21 '13 at 15:15

20

The solution was to generate a new Access Key. My first AWSSecretKey had trailing forward slashes on it that probably were causing the issue, while the new one didn't have any forward slashes and worked.

answered Dec 21 '13 at 15:15

Joao Leme

9,598
3
33
47

7

All non alpha numeric characters seem to fail. Keep generating new one until you get a clean one – baronS Mar 31 '16 at 09:51
1

Isn't there any other solution ? – Pratik Singhal Mar 10 '17 at 07:48
I regenerate a key without any non alpha numeric character, and it works. – Charlie Chen Apr 24 '17 at 01:45
That actually helped, I also had a / in my secret key. I created a new key and now it works. I am using the official aws sdk. Now I have "+"s (plus characters) in my key but it works! – Lukas Jul 04 '17 at 13:10

score 19 · Answer 4 · answered Oct 02 '13 at 21:28

19

I ran into this problem as well. For me it's because I accidentally put a / in front of my bucket name.

instead of test/foo/bar I had /test/foo/bar for my bucket name.

answered Oct 02 '13 at 21:28

Jason H

501
4
11

1

Thank you! Spent an hour trying to fix this, all it was '/folder' at the end of my bucket name.. – Tomas Jun 28 '16 at 16:54

score 16 · Answer 5 · answered Apr 19 '12 at 16:19

16

I found this because I wasn't doing the URL encoding - it seems this error is returned if any of the parameters passed are invalid - it may have nothing at all to do with the access key.

answered Apr 19 '12 at 16:19

Fiona - myaccessible.website

14,481
16
82
117

11

In particular, a plus sign (+) is a character that can be generated as part of the signature. This is translated by most servers as a space ( ), which does not the expected signature with the plus sign and throws this error. – matt Apr 29 '14 at 23:02

score 3 · Answer 6 · answered Mar 10 '15 at 00:48

3

Another thing to check is that each of your parameters likely need to be sorted by ASCII value. "AWSAccessKeyId" parameter should come before "Marketplace", however "AssociatedTag" should come after "AWSAccessId".

answered Mar 10 '15 at 00:48

dechimp

99
1
3

score 3 · Answer 7 · answered Sep 25 '15 at 12:49

Similar answer to Andrew (accepted answer), but my trailing spaces were not on the keys, but on the metadata for an S3 upload:

using (AmazonS3Client client = new AmazonS3Client(region))
{
    PutObjectRequest putObjectRequest = new PutObjectRequest
    {
        ServerSideEncryptionMethod = ServerSideEncryptionMethod.AES256,
        InputStream = stream,
        BucketName = s3Bucket,
        Key = key,
        ContentType = "application/octet-stream",
        Timeout = TimeSpan.FromMinutes(60), //http timeout talking to S3, including upload time.
        ReadWriteTimeout = TimeSpan.FromMinutes(5) //timeout reading the input stream
    };
    if (!string.IsNullOrEmpty(fileName))
        putObjectRequest.Metadata.Add("Name", fileName); 
    PutObjectResponse putObjectResponse = client.PutObject(putObjectRequest);
    // Exception in client.PutObject if fileName has leading spaces in Metadata!
}

Call stack here:

The request signature we calculated does not match the signature you provided. Check your key and signing method.
at Amazon.Runtime.Internal.HttpErrorResponseExceptionHandler.HandleException(IExecutionContext executionContext, HttpErrorResponseException exception) in d:\Jenkins\jobs\v3-stage-release\workspace\AWSDotNetPublic\sdk\src\Core\Amazon.Runtime\Pipeline\ErrorHandler\HttpErrorResponseExceptionHandler.cs:line 116
at Amazon.Runtime.Internal.ExceptionHandler`1.Handle(IExecutionContext executionContext, Exception exception) in d:\Jenkins\jobs\v3-stage-release\workspace\AWSDotNetPublic\sdk\src\Core\Amazon.Runtime\Pipeline\ErrorHandler\ExceptionHandler.cs:line 38
[...]
at Amazon.Runtime.AmazonServiceClient.Invoke[TRequest,TResponse](TRequest request, IMarshaller`2 marshaller, ResponseUnmarshaller unmarshaller) in d:\Jenkins\jobs\v3-stage-release\workspace\AWSDotNetPublic\sdk\src\Core\Amazon.Runtime\AmazonServiceClient.cs:line 117
at Amazon.S3.AmazonS3Client.PutObject(PutObjectRequest request) in d:\Jenkins\jobs\v3-stage-release\workspace\AWSDotNetPublic\sdk\src\Services\S3\Generated\_bcl45\AmazonS3Client.cs:line 3646
at MoveDocumentDataToDisk.AwsRepository.PutObject(RegionEndpoint region, String s3Bucket, String key, String fileName, Stream stream) in C:\code\clarinetsupportfiles\MoveDocumentDataToDisk\MoveDocumentDataToDisk\Program.cs:line 314

score 1 · Answer 8 · answered Nov 04 '13 at 17:32

1

Mine was because I copied environment variables from someone but they just had placeholder text. Hah!

answered Nov 04 '13 at 17:32

Elijah Murray

2,132
5
30
43

score 1 · Answer 9 · answered Apr 28 '15 at 14:51

1

This is also encountered when we try to upload a zero byte file. I have opened up a bug here today.

answered Apr 28 '15 at 14:51

vikas027

5,282
4
39
51

The issue has been resolved for zero byte files, check the issue tracked [here](https://github.com/aws/aws-sdk-ruby/issues/795). And here is a sample working [script](https://gist.github.com/vikas027/be1010dd13f70ecd2f5e#file-s3_file_upload_ruby_sdk_v2-rb). – vikas027 Apr 30 '15 at 03:27
I still got this with a zero byte file, or no file at all – krodmannix May 19 '15 at 00:31

score 1 · Answer 10 · answered Dec 28 '16 at 04:22

I was getting the same 'calculated does not match' message when my mistake was related to how my roles were configured

Check your roles, policies and CORS configuration for your bucket to be sure you have permission to use the headers that you are using.

In my case, I had been including the

ACL: 'public-read'

parameter in signing the bucket as well as

xhr.setRequestHeader('x-amz-acl', 'public-read');

while uploading the image.

I was missing the "s3:PutObjectAcl", permission in my associated Iam user. Here is a policy that worked.

{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Sid": "Stmt12345",
        "Effect": "Allow",
        "Action": [
            "s3:DeleteObject",
            "s3:GetObject",
            "s3:ListBucket",
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": [
            "arn:aws:s3:::mybucketname/*"
        ],
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": [
                    "public-read"
                ]
            }
        }
    }
  ]
}

score 1 · Answer 11 · edited May 23 '17 at 11:47

1

I ran into the same error message when using WebClient to download a file on an Amazon 3S url. I blogged about it here: http://blog.cdeutsch.com/2010/11/net-webclient-403-forbidden-error.html

The final solution I used was found here: GETting a URL with an url-encoded slash

edited May 23 '17 at 11:47

Community

1
1

answered Nov 29 '10 at 22:46

cdeutsch

3,847
27
25

score 1 · Answer 12 · answered Jul 12 '17 at 12:59

PHP: I had problem that when adding a "/" to denote a folder in s3, I was adding it to the bucket name, it seems the PUTOBJECT command of aws-package replaced "/" with "%2F", so it failed sha256 calculation of the request as it could look:
awsbucket%2Ffolder/filename
but it probably did a pre-calculation of the sha with:
awsbucket/folder/filename

Solution was to pre-add the folder name to the filename instead.

from:
awsbucket/folder
filename
to:
awsbucket
folder/filename

score 0 · Answer 13 · answered Mar 11 '14 at 00:11

0

I ran into this problem when I had a wrong URL (it gave me this error sometimes, and sometimes it said they key could no be found, implying a 404 error). These URLS are case sensitive, so make sure you are being exact. I had ".jpg" in my URL, and needed ".JPG"

answered Mar 11 '14 at 00:11

Pstrazzulla

455
5
6

I got the error when tried to use ARN instead of URL. – Der_Meister May 15 '15 at 19:18

score 0 · Answer 14 · answered Dec 16 '14 at 19:47

I just ran into this error. I'm using PHP, and ran a scandir() on my directory with my files.

The scandir() function returned . and .. as the first two indexes of the array. After adding a conditional statement in to be sure it doesn't create a file for these, it worked.

score 0 · Answer 15 · answered May 30 '15 at 02:03

This problem may occur for users that have placed the IAM user's "Password" in the CLI instead of the "Private Access Key". Where is the "Private Access Key" you may ask? You can't retrieve it, but you can create a new one via:

IAM, Users, Manage Access Keys, Create Access Key
Ok, copy the key quick! It is your only chance. :)

score 0 · Answer 16 · answered Jul 29 '15 at 12:47

I got the same error with a SubmitFeed call, and after various hours of debugging it turned out that CURL turned my POST request into a PUT request, which made my signature invalid.

It helped a lot to set CURLINFO_HEADER_OUT to 1 via curl_setopt(), so a later call to curl_getinfo() said my request was a PUT request.

So I compared the CURL options in Amazon PHP library to what I did via curl_setopt(), and tataa: the Amazon PHP library does this:

curl_setopt(CURLINFO_HEADER_OUT, 'POST');

(or GET, depending on self::REQUEST_TYPE). Doing the same in my own CURL request turned the request from PUT to POST, so my hashed signature was intact again.

score 0 · Answer 17 · edited Jan 12 '16 at 01:15

0

I ran into same issue using curl command to upload a zero byte file to S3 presigned url.

I found when remove header -H 'Content-Type: application/octet-stream' then can work.

edited Jan 12 '16 at 01:15

hedgesky

3,271
1
21
36

answered Jan 12 '16 at 00:48

guile chao

93
1
2
5

score 0 · Answer 18 · answered Feb 04 '16 at 15:08

0

I was using Ruby's aws-sdk v1 and I was getting this error because I was specifying the content type when calling url_for, following this example on the docs. Removing the content_type parameter on the url_for called solved the problem for me.

answered Feb 04 '16 at 15:08

Tomas Romero

8,418
11
50
72

score 0 · Answer 19 · answered Jun 29 '16 at 13:31

0

We were receiving this on a webserver but not in a console app using an old version of the AWS C# SDK (1.5.10.0). Once we upgraded to the most recent it went away.

answered Jun 29 '16 at 13:31

Zach Wymer

540
9
11

score 0 · Answer 20 · answered Jul 29 '16 at 16:09

0

Check your request headers, in my case I was sending something an extra header form the code that I copy pasted (like a noob) containing:

HOST: localhost:8080

answered Jul 29 '16 at 16:09

Ordiel

2,442
3
36
52

score 0 · Answer 21 · answered Jan 23 '17 at 14:13

0

After lot of struggle, I used the putObject Constructor to upload File instead of inputstream and it worked. Not sure what was wrong though.

answered Jan 23 '17 at 14:13

karthik

7,041
1
13
12

score 0 · Answer 22 · answered May 23 '18 at 17:16

0

I ran into this problem using .net core 2.1.300-preview1 as well. Updating to 2.1.300-rc1 was the solution.

answered May 23 '18 at 17:16

Jonathan DeMarks

2,373
2
15
14

score 0 · Answer 23 · answered May 30 '20 at 18:40

0

1 more answer to the stack: trying to stream data & setting -1 as content length also shows this error

answered May 30 '20 at 18:40

Tudor

1,510
1
18
17

score 0 · Answer 24 · answered Jan 17 '21 at 13:57

I got this error in java because I had the wrong value for AWS_SECRET_ACCESS_KEY ... it was incorrectly pointing to my pem file. Instead, I needed to use the secret value for my access key found here: https://console.aws.amazon.com/iam/home?region=us-east-1#/security_credentials.

Amazon MWS - request signature calculated does not match the signature provided

24 Answers24

Linked