方法调用以获取给出不一致结果的预签名URL(S3)

Question

我正在使用AmazonS3Client类的generatePresignedUrl方法获取一个预签名的URL。但是，当在与文件上载相同的会话中调用该方法时。它返回表单的url：

https://mp-dev.downloads.xyz.com.s3.ap-south-1.amazonaws.com/certificate/404/17_04_2017/xyz/ithluaxypnmmheubk9l21kbnejqy7oj1jw.zip？x-amz-algorithm=aws4-hmac-sha256&x-amz-date=20170417t090656z&x-amz-signedheaders=host&x-amz-expires=900&x-amz-credential=asdfsffgodq%2f20170417%2fap-south-1%2fs3%2faws4_request&x-amz-south-1%2fs3%2faws4_request-签名=9B2E112608C46CBEB16FF577B6E1321F889EFSDFDSC850212251B231CB909D1942

但当我重新运行API并使用相同的参数调用相同的方法时,我得到的url格式如下：

https://mp-dev.downloads.xyz.com.s3.amazonaws.com/certificate/404/17_04_2017/xyz/ithluaxypnmmheubk9l21kbnejqy7oj1jw.zip？awsaccesskeyid=Akiajfafdttisr4uhodq&expires=1492421420&signature=CZUY1ACATGUEEPoxn8aeqfxlx18%3D

第一个Url可以正常工作，但第二个Url的结果是：

不支持您提供的授权机制。请使用AWS4-HMAC-SHA256。

我尝试更改配置以使用特征码版本4,如下所述：

不支持您提供的授权机制。请使用AWS4-HMAC-SHA256

@SkipAuthentication
  @GET
  @Path("/xyz")
  public String download(@QueryParam("cer") String objectKey) {
    return testService.test(objectKey).toString();
  }

public URL test(String objectKey) {
    return awsDownloadService.generateDownloadUrl(objectKey, awsServer.getDownloadsBucketName());
  }

  public URL generateDownloadUrl(String keyName, String bucketName) {
    LOG.info("generateDownloadUrl - {} {} {} {}>",accessKeyId, secretAccessKey, keyName, bucketName);
    BasicAWSCredentials awsCreds = new BasicAWSCredentials(accessKeyId, secretAccessKey);
    AmazonS3Client s3Client = new AmazonS3Client(awsCreds);

    Date expiration = new Date();
    long msec = expiration.getTime();
    msec += 1000 * 60 * 15; // 15 minutes.
    expiration.setTime(msec);
    GeneratePresignedUrlRequest generatePresignedUrlRequest = 
                  new GeneratePresignedUrlRequest(bucketName, keyName);
    generatePresignedUrlRequest.setMethod(HttpMethod.GET); // Default.
    generatePresignedUrlRequest.setExpiration(expiration);
    URL url = s3Client.generatePresignedUrl(generatePresignedUrlRequest);
    LOG.info("GeneratePreAuthenticatedUrl - url generated is <{}>",url);
    return url;
  }

AmazonS3ClientBuilder builder = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(awsCreds));
    builder.setRegion(Regions.AP_SOUTH_1.getName());
    AmazonS3 s3client = builder.build();

尽管如此，前面展示的amazons3client行为还是有点奇怪的。谁能解释一下以前的行为吗？

Answer 1

最近的SDK中显然不推荐使用Amazons3Client类。以以下方式创建客户端解决了这个问题,因为它还考虑了区域,并因此附加了适当的签名版本：

BasicAWSCredentials awsCreds = new BasicAWSCredentials(accessKeyId, secretAccessKey);
    AmazonS3ClientBuilder builder = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(awsCreds));
    builder.setRegion(regionName);
    AmazonS3 s3client = builder.build();