S3 - SignatureDoesNotMatch issue (The request signature we calculated does not match the signature you provided. Check your key and signing method)

[sakthiskv]

Hi All,
I created a new bucket in S3 for Storing objects using server-side encryption with customer-provided keys (SSE-C). I Am able to put objects into that bucket. But the Presigned Url it's not working and getting the below error.

SignatureDoesNotMatch
The request signature we calculated does not match the signature you provided. Check your key and signing method.


d8bd46749f2867f3cc4ccd08a4e15d053934c5e64f1b176398bae
41 57 53 34 2d 48 4d 41 43 2d 53 48 41 32 35 36 0a 32 30 32 32 31 31 32 39 54 30 35 31 32 30 30 5a 0a 32 30 32 32 31 31 32 39 2f 61 70 2d 73 6f 75 74 68 2d 31 2f 73 33 2f 61 77 73 34 5f 72 65 71 75 65 73 74 0a 66 63 39 37 38 31 30 61 33 37 65 37 34 35 36 64 63 66 62 30 36 33 31 66 66 65 66 64 31 33 34 65 31 62 35 65 33 30 37 35 35 63 32 39 31 34 36 33 66 30 34 32 31 62 37 36 61 37 65 64 30 65 33 31
GET /1-proof0149173a-2098-4c0a-ac20-c1f997f34ebe X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA44L5AVRUKA6J7OEW%2F20221129%2Fap-south-1%2Fs3%2Faws4_request&X-Amz-Date=20221129T051200Z&X-Amz-Expires=1799&X-Amz-SignedHeaders=host%3Bx-amz-server-side-encryption-customer-algorithm%3Bx-amz-server-side-encryption-customer-key%3Bx-amz-server-side-encryption-customer-key-md5 host:new-monkeycap-proof-content-stage.s3.ap-south-1.amazonaws.com x-amz-server-side-encryption-customer-algorithm: x-amz-server-side-encryption-customer-key: x-amz-server-side-encryption-customer-key-md5: host;x-amz-server-side-encryption-customer-algorithm;x-amz-server-side-encryption-customer-key;x-amz-server-side-encryption-customer-key-md5 UNSIGNED-PAYLOAD
47 45 54 0a 2f 31 2d 70 72 6f 6f 66 30 31 34 39 31 37 33 61 2d 32 30 39 38 2d 34 63 30 61 2d 61 63 32 30 2d 63 31 66 39 39 37 66 33 34 65 62 65 0a 58 2d 41 6d 7a 2d 41 6c 67 6f 72 69 74 68 6d 3d 41 57 53 34 2d 48 4d 41 43 2d 53 48 41 32 35 36 26 58 2d 41 6d 7a 2d 43 72 65 64 65 6e 74 69 61 6c 3d 41 4b 49 41 34 34 4c 35 41 56 52 55 4b 41 36 4a 37 4f 45 57 25 32 46 32 30 32 32 31 31 32 39 25 32 46 61 70 2d 73 6f 75 74 68 2d 31 25 32 46 73 33 25 32 46 61 77 73 34 5f 72 65 71 75 65 73 74 26 58 2d 41 6d 7a 2d 44 61 74 65 3d 32 30 32 32 31 31 32 39 54 30 35 31 32 30 30 5a 26 58 2d 41 6d 7a 2d 45 78 70 69 72 65 73 3d 31 37 39 39 26 58 2d 41 6d 7a 2d 53 69 67 6e 65 64 48 65 61 64 65 72 73 3d 68 6f 73 74 25 33 42 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 61 6c 67 6f 72 69 74 68 6d 25 33 42 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 6b 65 79 25 33 42 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 6b 65 79 2d 6d 64 35 0a 68 6f 73 74 3a 6e 65 77 2d 6d 6f 6e 6b 65 79 63 61 70 2d 70 72 6f 6f 66 2d 63 6f 6e 74 65 6e 74 2d 73 74 61 67 65 2e 73 33 2e 61 70 2d 73 6f 75 74 68 2d 31 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 0a 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 61 6c 67 6f 72 69 74 68 6d 3a 0a 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 6b 65 79 3a 0a 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 6b 65 79 2d 6d 64 35 3a 0a 0a 68 6f 73 74 3b 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 61 6c 67 6f 72 69 74 68 6d 3b 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 6b 65 79 3b 78 2d 61 6d 7a 2d 73 65 72 76 65 72 2d 73 69 64 65 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 63 75 73 74 6f 6d 65 72 2d 6b 65 79 2d 6d 64 35 0a 55 4e 53 49 47 4e 45 44 2d 50 41 59 4c 4f 41 44

+XBPIhSd8z1YmdMAQl0AAZ3/KD3ZyrBaygS8IgGjHmVlPHOtC9F8VjGCuH6w=

JAVA code

Put Object

	PutObjectRequest putObjectRequest = new PutObjectRequest(bucketName, fileName, uploadFile)
				.withSSECustomerKey(new SSECustomerKey(SSECUSTOMER_KEY));
		ObjectMetadata objectMetaData = new ObjectMetadata();
		objectMetaData.setContentLength(uploadFile.length());
		objectMetaData.setContentType(contentType);
		putObjectRequest.withMetadata(objectMetaData);
		s3Client.putObject(putObjectRequest);

Generate Presigned URL:

          GeneratePresignedUrlRequest generatePresignedUrlRequest = new GeneratePresignedUrlRequest(bucketName, fileName)
				.withExpiration(Date.from(Instant.now().plus(S3ExpireTime, ChronoUnit.MINUTES)))
				.withSSECustomerKey(new SSECustomerKey(SSECUSTOMER_KEY));
		URL url = s3Client.generatePresignedUrl(generatePresignedUrlRequest);

Anything wrong I am doing here? Please help me to resolve this issue.

[debora-ito]

@sakthiskv apologies for the long silence here. Are you still experiencing this issue?

[atharvadhamale]

Hi, @debora-ito
I am facing this same issue when writing a file to S3 using CustomSigner which is supposed to inherit the Signer and override the sign().
What i think can be done for this issue is that we need to calculate the content-sha-256 of the file and add it to the request-headers before passing the execution further to the sdk from CustomSigner. I need help to understand how to calculate the content-sha-256 of a file and the data that I have currently is the SdkHttpFullRequest and ExecutionAttributes.

LOGS:

 <Error>
<Code>XAmzContentSHA256Mismatch</Code>
<Message>The provided 'x-amz-content-sha256' header does not match what was computed.</Message>
<ClientComputedContentSHA256>e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</ClientComputedContentSHA256>
<S3ComputedContentSHA256>ffa629ade8b1c6515497946265f049e18a38b9983d5a1b10da0460ffedfde86d</S3ComputedContentSHA256>
<RequestId>********************</RequestId>
<HostId>***************************</HostId>
</Error>

[debora-ito]

@atharvadhamale signing and checksum logic are complex to explain, the SDK abstracts the complexity so you don't have to worry about it. Is there a reason why you're using a custom signer?

[atharvadhamale]

@debora-ito
I wish to implement something like this example or implement this.
I need to use CustomSigner to get the request signed from our backend rather than sending the request for signing directly to the S3.
plz provide me with the equivalent classes in sdkv2 for the ones used in this answer or guide me with steps to implement something as in the example