我们计算的请求签名与您提供的签名不匹配。S3 Bucket Http Post

Question

我试图按照教程HTTP://docs.aws.amazon.com/amazons3/latest/api/sigv4-post-example.html使用HTTP post方法将图像上传到s3 bucket。但我每次都得到以下错误

 Error
 <Code>SignatureDoesNotMatch</Code>
 <Message>
 The request signature we calculated does not match the signature you 
 provided. Check your key and signing method.
  </Message>

 <form action="http://mynewdulibucket.s3.amazonaws.com/" method="post" enctype="multipart/form-data">
Key to upload:
<input type="input"  name="key" value="user/user1/${filename}" /><br />
<input type="hidden" name="acl" value="public-read" />
<input type="hidden" name="success_action_redirect" value="http://mynewdulibucket.s3.amazonaws.com/successful_upload.html" />
Content-Type:
<input type="input"  name="Content-Type" value="image/jpeg" /><br />
<input type="hidden" name="x-amz-meta-uuid" value="14365123651274" />
<input type="hidden" name="x-amz-server-side-encryption" value="AES256" />
<input type="text"   name="X-Amz-Credential" value="XXXXXXXXXXXXX/20151229/us-east-1/s3/aws4_request" />
<input type="text"   name="X-Amz-Algorithm" value="AWS4-HMAC-SHA256" />
<input type="text"   name="X-Amz-Date" value="20151229T000000Z" />

Tags for File:
<input type="input"  name="x-amz-meta-tag" value="" /> <br />
<input type="hidden" name="Policy" value="XXXXXXXXXXXXXXX"/>
<input type="hidden" name="X-Amz-Signature" value="XXXXXXXXXXXXX" />
File:
<input type="file"   name="file" /> <br />
<!-- The elements after this will be ignored -->
<input type="submit" name="submit" value="Upload to Amazon S3" />

政策如下：

{ "expiration": "2018-12-30T12:00:00.000Z",
 "conditions": [
{"bucket": "mynewdulibucket"},
["starts-with", "$key", "user/user1/MyPhoto.jpg"],
{"acl": "public-read"},
{"success_action_redirect": "http://mynewdulibucket.s3.amazonaws.com/successful_upload.html"},
["starts-with", "$Content-Type", "image/"],
{"x-amz-meta-uuid": "14365123651274"},
{"x-amz-server-side-encryption": "AES256"},
["starts-with", "$x-amz-meta-tag", ""],
{"x-amz-credential": "XXXXXXXXX/20151229/us-east-1/s3/aws4_request"},
{"x-amz-algorithm": "AWS4-HMAC-SHA256"},
{"x-amz-date": "20151229T000000Z" }
]
  }

生成策略和签名的代码将粘贴到相关的表单字段中：

public class Main {

public static void main(String[] args) throws Exception
{
    String policy_document = "{\"expiration\":\"2018-12-30T12:00:00.000Z\",\"conditions\":[{\"bucket\":\"mynewdulibucket\"},[\"starts-with\",\"$key\",\"user/user1/MyPhoto.jpg\"],{\"acl\":\"public-read\"},{\"success_action_redirect\":\"http://mynewdulibucket.s3.amazonaws.com/successful_upload.html\"},[\"starts-with\",\"$Content-Type\",\"image/\"],{\"x-amz-meta-uuid\":\"14365123651274\"},{\"x-amz-server-side-encryption\":\"AES256\"},[\"starts-with\",\"$x-amz-meta-tag\",\"\"],{\"x-amz-credential\":\"AKIAJQHQNWQ7FCTGNKQQ/20151229/us-east-1/s3/aws4_request\"},{\"x-amz-algorithm\":\"AWS4-HMAC-SHA256\"},{\"x-amz-date\":\"20151229T000000Z\"}]}";
    String encodedPolicy = new String(Base64.getEncoder().encode(policy_document.getBytes("UTF-8"))).replaceAll("\n", "").replaceAll("\r", "");
    String secretKey = "XXXXXXXXXXXXXXXX";

    String signature = getSigning(secretKey, "20151229T000000Z", "us-east-1", "s3",encodedPolicy);

    //the following values get pasted into the form fields Policy and X-Amz-Signature respectively (see above XXXXX)
    System.out.println("base64 " + encodedPolicy);

    System.out.println("signature " + signature);

}


static byte[] HmacSHA256(String data, byte[] key) throws Exception
{
    String algorithm="HmacSHA256";
    Mac mac = Mac.getInstance(algorithm);
    mac.init(new SecretKeySpec(key, algorithm));
    return mac.doFinal(data.getBytes("UTF8"));
}

static String getSigning(String key, String dateStamp, String regionName, String serviceName,String base64signature) throws Exception {
    byte[] kSecret = ("AWS4" + key).getBytes("UTF8");
    byte[] kDate = HmacSHA256(dateStamp, kSecret);
    byte[] kRegion = HmacSHA256(regionName, kDate);
    byte[] kService = HmacSHA256(serviceName, kRegion);
    //
    byte[] kSigning = HmacSHA256("aws4_request", kService);

    byte[] signature = HmacSHA256(base64signature, kSigning);

    return new String(Base64.getEncoder().encode(signature));
}

Answer 1

当您没有正确进行身份验证时，就会出现这种误导性错误。

验证：

• 您的~/.aws/配置是正确的。
• 您在调用时正确地提供了API密钥。
• 您的环境变量正在正确地传递您的凭据。
• 运行此操作的实例已为其IAM角色分配了正确的权限。