为SSE-C生成预签名url时出错

Question

我已经使用客户密钥（SSE-C）为AWS S3服务器端加密创建了一个客户密钥。

我可以使用密钥上传对象。但是，当我使用AWS Java SDK生成一个预签名的URL时，该URL创建成功了，但是当我点击该URL时，我会得到以下错误。

SignatureDoesNotMatch我们计算的请求签名与您提供的签名不匹配。检查您的密钥和签名方法。

import java.io.IOException;
import java.net.URI;
import java.net.URL;

import org.apache.http.client.methods.HttpPut;
import org.apache.http.entity.FileEntity;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicHeader;

import com.amazonaws.AmazonServiceException;
import com.amazonaws.ClientConfiguration;
import com.amazonaws.HttpMethod;
import com.amazonaws.SdkClientException;
import com.amazonaws.auth.profile.ProfileCredentialsProvider;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;
import com.amazonaws.services.s3.Headers;
import com.amazonaws.services.s3.model.GeneratePresignedUrlRequest;
import com.amazonaws.services.s3.model.SSEAlgorithm;
import com.amazonaws.services.s3.model.SSECustomerKey;
import com.amazonaws.util.Base64;
import com.amazonaws.util.Md5Utils;

public class GeneratePresignedURL {

	public GeneratePresignedURL() throws IOException {
		String bucketName = "abctest";
		String keyName = "testnew.mp4";

		try {
			SSECustomerKey SSE_KEY = new SSECustomerKey("KLgsVafKowMCfKDsbIh597CmMUSoPBn6QJ8OIGxAMBw=");

			ClientConfiguration cnf = new ClientConfiguration();
			cnf.withSignerOverride("AWSS3V4SignerType");
			AmazonS3 s3Client = AmazonS3ClientBuilder.standard().withClientConfiguration(cnf)
					.withCredentials(new ProfileCredentialsProvider()).build();

			// Set the presigned URL to expire after one hour.
			java.util.Date expiration = new java.util.Date();
			long expTimeMillis = expiration.getTime();
			expTimeMillis += 1000 * 60 * 60;
			expiration.setTime(expTimeMillis);

			// Generate the presigned URL.
			System.out.println("Generating pre-signed URL.");
			GeneratePresignedUrlRequest generatePresignedUrlRequest = new GeneratePresignedUrlRequest(bucketName,
					keyName).withMethod(HttpMethod.PUT).withExpiration(expiration).withSSECustomerKey(SSE_KEY);

			generatePresignedUrlRequest.setSSECustomerKeyAlgorithm(SSEAlgorithm.AES256);

			URL url = s3Client.generatePresignedUrl(generatePresignedUrlRequest);

			System.out.println("Pre-Signed URL: " + url.toExternalForm());
		} catch (AmazonServiceException e) {
			// The call was transmitted successfully, but Amazon S3 couldn't process
			// it, so it returned an error response.
			e.printStackTrace();
		} catch (SdkClientException e) {
			// Amazon S3 couldn't be contacted for a response, or the client
			// couldn't parse the response from Amazon S3.
			e.printStackTrace();
		}
	}

Answer 1

谢谢@Pavan

任何需要使用SSE-C的客户端，客户端必须能够发送以下报头。

当使用预签名URL检索现有对象时，或者只检索对象元数据时，我们需要提供您的客户端应用程序中的所有加密头。

        FileInputStream fin = new FileInputStream(uploadFileName);

        byte fileContent[] = new byte[(int) uploadFileName.length()];

        // Reads up to certain bytes of data from this input stream into an array of
        // bytes.
        fin.read(fileContent);
        // create string from byte array

        // Specify server-side encryption.
        ObjectMetadata objectMetadata = new ObjectMetadata();
        objectMetadata.setContentLength(fileContent.length);
        objectMetadata.setSSEAlgorithm(ObjectMetadata.AES_256_SERVER_SIDE_ENCRYPTION);
        PutObjectRequest putRequest = new PutObjectRequest(bucketName, keyName,
                new ByteArrayInputStream(fileContent), objectMetadata);

        // Upload the object and check its encryption status.
        PutObjectResult putResult = s3Client.putObject(putRequest);
        System.out.println("Object \"" + keyName + "\" uploaded with SSE.");

    java.util.Date expiration = new java.util.Date();
    long expTimeMillis = expiration.getTime();
    expTimeMillis += 1000 * 60 * 60;
    expiration.setTime(expTimeMillis);

    System.out.println("Generating pre-signed URL.");
    GeneratePresignedUrlRequest generatePresignedUrlRequest = new GeneratePresignedUrlRequest(bucketName, keyName)
            .withMethod(HttpMethod.GET).withExpiration(expiration);

    URL url = s3Client.generatePresignedUrl(generatePresignedUrlRequest);
    System.out.println("Pre-Signed URL: " + url.toURI());