CODEWITHSUNDEEP
amazon-web-servicesamazon-s3sh
jak111
jak111

Reputation: 561

Why do I get a signature error with this AWS bash deploy script?

I am trying to create a bash script to upload files to my s3 bucket. I am having difficulty generating the correct signature.

I get the following error message:

The request signature we calculated does not match the signature you provided. Check your key and signing method.

Here is my script:

Thanks for your help!

#!/usr/bin/env bash

#upload to S3 bucket
sourceFilePath="$1"
#file path at S3
folderPathAtS3="packages";
#S3 bucket region
region="eu-central-1"
#S3 bucket name
bucket="my-bucket-name";
#S3 HTTP Resource URL for your file
resource="/${bucket}/${folderPathAtS3}";
#set content type
contentType="gzip";
#get date as RFC 7231 format
dateValue="$(date +'%a, %d %b %Y %H:%M:%S %z')"
acl="x-amz-acl:private"
#String to generate signature
stringToSign="PUT\n\n${contentType}\n${dateValue}\n${acl}\n${resource}";
#S3 key
s3Key="my-key";
#S3 secret
s3Secret="my-secret-code";
#Generate signature, Amazon re-calculates the signature and compares if it matches the one that was contained in your request. That way the secret access key never needs to be transmitted over the network.
signature=$(echo -en "${stringToSign}" | openssl sha1 -hmac ${s3Secret} -binary | base64);

#Curl to make PUT request.
curl -L -X PUT -T "${sourceFilePath}" \
 -H "Host: ${bucket}.${region}.amazonaws.com" \
 -H "Date: ${dateValue}" \
 -H "Content-Type: ${contentType}" \
 -H "$acl" \
 -H "Authorization: AWS ${s3Key}:${signature}" \
 https://s3.amazonaws.com/${bucket}/${folderPathAtS3}

Upvotes: 2

Views: 324

Answers (1)

Michael - sqlbot
Michael - sqlbot

Reputation: 179384

Your signature seems fine, but your request is wrong and consequently does not match.

-H "Host: ${bucket}.${region}.amazonaws.com" \ is incorrect.

The correct value is ${bucket}.s3 ${region}.amazonaws.com. You're overlooking the s3. in the hostname... but even if correct, this is still invalidj because your URL https://s3.amazonaws.com/${bucket}/... also includes the bucket, which means your bucket name is being implicitly added to the beginning of the object key because it appears twice.

Additionally, https://s3.amazonaws.com is us-east-1. To connect to the correct region, your URL needs to be one of these variants:

https://${region}.s3.amazonaws.com/${bucket}/${folderPathAtS3}

https://${bucket}.${region}.s3.amazonaws.com/${folderPathAtS3}

https://${bucket}.s3.amazonaws.com/${folderPathAtS3}

Use one of these formats, and eliminate -H "Host: ..." because it will then be redundant.

The last of the 3 URL formats will only start to work after the bucket is more than a few minutes or hours old. S3 creates these automatically but it takes some time.

Upvotes: 1

Related Questions