Amazon S3 - How to fix 'The request signature we calculated does not match the signature' error?

Question

I have searched on the web for over two days now, and probably have looked through most of the online documented scenarios and workarounds, but nothing worked for me so far.

I am on AWS SDK for PHP V2.8.7 running on PHP 5.3.

I am trying to connect to my Amazon S3 bucket with the following code:

// Create a `Aws` object using a configuration file
$aws = Aws::factory('config.php');

// Get the client from the service locator by namespace
$s3Client = $aws->get('s3');

$bucket = "xxx";
$keyname = "xxx";

try {
    $result = $s3Client->putObject(array(
        'Bucket' => $bucket,
        'Key' => $keyname,
        'Body' => 'Hello World!'
    ));

    $file_error = false;
} catch (Exception $e) {
    $file_error = true;

    echo $e->getMessage();

    die();
}

My config.php file is as follows:

return [
    // Bootstrap the configuration file with AWS specific features
    'includes' => ['_aws'],
    'services' => [
        // All AWS clients extend from 'default_settings'. Here we are
        // overriding 'default_settings' with our default credentials and
        // providing a default region setting.
        'default_settings' => [
            'params' => [
                'credentials' => [
                    'key'    => 'key',
                    'secret' => 'secret'
                ]
            ]
        ]
    ]
];

It is producing the following error:

The request signature we calculated does not match the signature you provided. Check your key and signing method.

I've already checked my access key and secret at least 20 times, generated new ones, used different methods to pass in the information (i.e. profile and including credentials in code) but nothing is working at the moment.

So, the AWS SDK just implements a bunch of direct API calls. With AWS, every single call you make takes your private key (or secret above), and uses that to calculate a signature based on your access key, the current timestamp, plus a bunch of other factors. See docs.aws.amazon.com/general/latest/gr/…. It's a longshot, but given that they include the timestamp, perhaps your local environment's time is off? — Josh Padnick
– Josh Padnick, Commented May 29, 2015 at 0:58
First time visitor, please go through many answers, there are many scenario in which you will get this error & various solutions given in this page — Satish Patro
– Satish Patro, Commented Sep 13, 2021 at 14:43

TylerH · Accepted Answer · 2024-09-06 16:38:15Z

203

The key I was assigning to the object started with a period i.e. ..\images\ABC.jpg, and this caused the error to occur.

edited Sep 6, 2024 at 16:38

TylerH

21.3k84 gold badges84 silver badges121 bronze badges

answered May 29, 2015 at 1:37

Joseph Lam

6,2293 gold badges17 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Alex Levine · Accepted Answer · 2015-09-05 07:04:26Z

87

I get this error with the wrong credentials. I think there were invisible characters when I pasted it originally.

answered Sep 5, 2015 at 7:04

Alex Levine

1,64716 silver badges16 bronze badges

2 Comments

ilyakam Mar 14 at 15:32

That's what happened in my case. More specifically, Cyberduck added a line break character at the end of the secret access key.

austinrocks1995 Oct 21 at 23:54

same, worked.. thank you

Oleg · Accepted Answer · 2019-07-08 16:20:54Z

48

I had the same error in nodejs. But adding signatureVersion in s3 constructor helped me:

const s3 = new AWS.S3({
  apiVersion: '2006-03-01',
  signatureVersion: 'v4',
});

answered Jul 8, 2019 at 16:20

Oleg

1,1781 gold badge10 silver badges18 bronze badges

Comments

TylerH · Accepted Answer · 2024-09-06 16:45:15Z

45

I've just encountered this because I was using an HTTP POST request instead of PUT.

edited Sep 6, 2024 at 16:45

TylerH

21.3k84 gold badges84 silver badges121 bronze badges

answered Jan 20, 2022 at 13:25

Ross Coundon

9371 gold badge12 silver badges20 bronze badges

1 Comment

gratinierer Jan 17 at 12:56

exactly the solution, if using CodeGuru-upload-url.

ecdeveloper · Accepted Answer · 2016-04-05 20:31:15Z

39

I had the same problem when tried to copy an object with some UTF8 characters. Below is a JS example:

var s3 = new AWS.S3();

s3.copyObject({
    Bucket: 'somebucket',
    CopySource: 'path/to/Weird_file_name_ðÓpíu.jpg',
    Key: 'destination/key.jpg',
    ACL: 'authenticated-read'
}, cb);

Solved by encoding the CopySource with encodeURIComponent()

answered Apr 5, 2016 at 20:31

ecdeveloper

2,8951 gold badge25 silver badges17 bronze badges

Comments

AliS · Accepted Answer · 2020-11-18 20:38:34Z

30

My AccessKey had some special characters in that were not properly escaped.

I didn't check for special characters when I did the copy/paste of the keys. Tripped me up for a few mins.

A simple backslash fixed it. Example (not my real access key obviously):

secretAccessKey: 'Gk/JCK77STMU6VWGrVYa1rmZiq+Mn98OdpJRNV614tM'

becomes

secretAccessKey: 'Gk\/JCK77STMU6VWGrVYa1rmZiq\+Mn98OdpJRNV614tM'

answered Nov 18, 2020 at 20:38

AliS

7557 silver badges11 bronze badges

1 Comment

Shreyan Mehta Over a year ago

this is a good catch i too have it in mine, but this also didnt solved my issue

Harrish Selvarajah · Accepted Answer · 2020-06-01 17:07:12Z

25

This error seems to occur mostly if there is a space before or after your secret key

edited Jun 1, 2020 at 17:07

answered Jun 1, 2020 at 16:59

Harrish Selvarajah

1,88116 silver badges13 bronze badges

Comments

saurav sarkar · Accepted Answer · 2020-09-08 10:05:58Z

17

For Python set - signature_version s3v4

s3 = boto3.client(
   's3',
   aws_access_key_id='AKIAIO5FODNN7EXAMPLE',
   aws_secret_access_key='ABCDEF+c2L7yXeGvUyrPgYsDnWRRC1AYEXAMPLE',
   config=Config(signature_version='s3v4')
)

answered Sep 8, 2020 at 10:05

saurav sarkar

2272 silver badges8 bronze badges

1 Comment

Davy Over a year ago

Indeed. More info here: aws.amazon.com/premiumsupport/knowledge-center/…

Aaron St. Clair · Accepted Answer · 2019-03-04 21:12:01Z

In a previous version of the aws-php-sdk, prior to the deprecation of the S3Client::factory() method, you were allowed to place part of the file path, or Key as it is called in the S3Client->putObject() parameters, on the bucket parameter. I had a file manager in production use, using the v2 SDK. Since the factory method still worked, I did not revisit this module after updating to ~3.70.0. Today I spent the better part of two hours debugging why I had started receiving this error, and it ended up being due to the parameters I was passing (which used to work):

$s3Client = new S3Client([
    'profile' => 'default',
    'region' => 'us-east-1',
    'version' => '2006-03-01'
]);
$result = $s3Client->putObject([
    'Bucket' => 'awesomecatpictures/catsinhats',
    'Key' => 'whitecats/white_cat_in_hat1.png',
    'SourceFile' => '/tmp/asdf1234'
]);

I had to move the catsinhats portion of my bucket/key path to the Key parameter, like so:

$s3Client = new S3Client([
    'profile' => 'default',
    'region' => 'us-east-1',
    'version' => '2006-03-01'
]);
$result = $s3Client->putObject([
    'Bucket' => 'awesomecatpictures',
    'Key' => 'catsinhats/whitecats/white_cat_in_hat1.png',
    'SourceFile' => '/tmp/asdf1234'
]);

What I believe is happening is that the Bucket name is now being URL Encoded. After further inspection of the exact message I was receiving from the SDK, I found this:

Error executing PutObject on https://s3.amazonaws.com/awesomecatpictures%2Fcatsinhats/whitecats/white_cat_in_hat1.png

AWS HTTP error: Client error: PUT https://s3.amazonaws.com/awesomecatpictures%2Fcatsinhats/whitecats/white_cat_in_hat1.png resulted in a 403 Forbidden

This shows that the / I provided to my Bucket parameter has been through urlencode() and is now %2F.

The way the Signature works is fairly complicated, but the issue boils down to the bucket and key are used to generate the encrypted signature. If they do not match exactly on both the calling client, and within AWS, then the request will be denied with a 403. The error message does actually point out the issue:

The request signature we calculated does not match the signature you provided. Check your key and signing method.

So, my Key was wrong because my Bucket was wrong.

simsketch · Accepted Answer · 2020-02-28 17:45:54Z

16

In my case I was using s3.getSignedUrl('getObject') when I needed to be using s3.getSignedUrl('putObject') (because I'm using a PUT to upload my file), which is why the signatures didn't match.

answered Feb 28, 2020 at 17:45

simsketch

3,0821 gold badge26 silver badges29 bronze badges

Comments

sarir · Accepted Answer · 2017-02-21 10:33:01Z

11

Actually in Java i was getting same error.After spending 4 hours to debug it what i found that that the problem was in meta data in S3 Objects as there was space while sitting cache controls in s3 files.This space was allowed in 1.6.* version but in 1.11.* it is disallowed and thus was throwing the signature mismatch error

answered Feb 21, 2017 at 10:33

sarir

1111 silver badge6 bronze badges

1 Comment

Janaka Bandara Over a year ago

Also happens if you pass an incorrect Content-Length in the metadata

Sebastian · Accepted Answer · 2018-12-14 09:16:55Z

8

Another possible issue might be that the meta values contain non US-ASCII characters. For me it helped to UrlEncode the values when adding them to the putRequest:

request.Metadata.Add(AmzMetaPrefix + "artist", HttpUtility.UrlEncode(song.Artist));
request.Metadata.Add(AmzMetaPrefix + "title", HttpUtility.UrlEncode(song.Title));

answered Dec 14, 2018 at 9:16

Sebastian

1,7691 gold badge21 silver badges21 bronze badges

1 Comment

RobertG Jul 21 at 17:40

This may be worth mentioning: With this solution, you need to URL-decode the data "by hand" when you retrieve the data, not great. But encoding or escaping seem to be the only options to make non-ASCII characters work.

Emmanuel · Accepted Answer · 2021-09-20 11:09:13Z

8

For me I used axios and by deafult it sends header

content-type: application/x-www-form-urlencoded

so i change to send:

content-type: application/octet-stream

and also had to add this Content-Type to AWS signature

const params = {
    Bucket: bucket,
    Key: key,
    Expires: expires,
    ContentType: 'application/octet-stream'
}

const s3 = new AWS.S3()
s3.getSignedUrl('putObject', params)

edited Sep 20, 2021 at 11:09

Emmanuel

5,4835 gold badges53 silver badges74 bronze badges

answered Feb 28, 2019 at 3:05

Dawid Kisielewski

8396 silver badges17 bronze badges

Comments

TylerH · Accepted Answer · 2024-09-06 16:47:54Z

8

Try using

aws configure

This command (Getting started with the AWS CLI) will open a set of options asking for keys, region and output format.

edited Sep 6, 2024 at 16:47

TylerH

21.3k84 gold badges84 silver badges121 bronze badges

answered Feb 19, 2018 at 6:21

saurabh

6816 silver badges8 bronze badges

Comments

Saurav Panthee · Accepted Answer · 2021-01-06 19:57:45Z

7

I had the same issue, the problem I had was I imported the wrong environment variable, which means that my secret key for AWS was wrong. Based on reading all the answers, I would verify that all your access ID and secret key is right and there are no additional characters or anything.

answered Jan 6, 2021 at 19:57

Saurav Panthee

6576 silver badges8 bronze badges

Comments

AVIDeveloper · Accepted Answer · 2018-11-13 09:44:12Z

6

In my case I parsed an S3 url into its components.

For example:

Url:    s3://bucket-name/path/to/file

Was parsed into:

Bucket: bucket-name
Path:   /path/to/file

Having the path part containing a leading '/' failed the request.

answered Nov 13, 2018 at 9:44

AVIDeveloper

3,5962 gold badges28 silver badges35 bronze badges

Comments

maheeka · Accepted Answer · 2019-05-29 05:41:39Z

5

I had the same issue. I had the default method, PUT set to define the pre-signed URL but was trying to perform a GET. The error was due to method mismatch.

answered May 29, 2019 at 5:41

maheeka

2,1131 gold badge19 silver badges29 bronze badges

1 Comment

Michał Jabłoński Over a year ago

It was the opposite for me, ie I was using GET to define the presigned URL, and then was trying to use the url with PUT metnod, which obviously resulted in a 403.

Amol Kakade · Accepted Answer · 2019-11-26 05:25:39Z

5

Most of the time it happens because of the wrong key (AWS_SECRET_ACCESS_KEY). Please cross verify your AWS_SECRET_ACCESS_KEY. Hope it will work...

answered Nov 26, 2019 at 5:25

Amol Kakade

811 silver badge3 bronze badges

Comments

Satish Patro · Accepted Answer · 2021-03-15 14:23:11Z

5

When I gave the wrong secret key which is of value "secret" knowingly, it gave this error. I was expecting some valid error message details like "authentication failed" or something

answered Mar 15, 2021 at 14:23

Satish Patro

4,6042 gold badges38 silver badges62 bronze badges

Comments

flyingfishcattle · Accepted Answer · 2021-08-19 10:46:58Z

4

This issue happened to me because I was accidentally assigning the value of the ACCESS_KEY_ID to SECRET_ACCESS_KEY_ID. Once this was fixed everything worked fine.

answered Aug 19, 2021 at 10:46

flyingfishcattle

2,2213 gold badges19 silver badges31 bronze badges

Comments

Abdalrahman Shatou · Accepted Answer · 2023-06-14 09:35:35Z

4

I have spent 8 hours trying to fix this issue. For me, everything mentioned in all answers were fine. The keys were correct and tested through CLI. I was using SDK V3 which is the latest and doesn't need the signature version. It finally turned out to be passing a wrong object in the Body! (not a text nor a array buffer). Yes, it's one of the most stupid error messages that I have ever seen in my 16 years career. AWS sometimes drives me crazy.

answered Jun 14, 2023 at 9:35

Abdalrahman Shatou

4,7787 gold badges56 silver badges84 bronze badges

1 Comment

Quentin Dec 28, 2024 at 19:16

In my case, I forgot the Content-Type header

John Veldboom · Accepted Answer · 2018-03-09 18:17:43Z

3

I just experienced this uploading an image to S3 using the AWS SDK with React Native. It turned out to be caused by the ContentEncoding parameter.

Removing that parameter "fixed" the issue.

answered Mar 9, 2018 at 18:17

John Veldboom

2,28731 silver badges34 bronze badges

Comments

yungBolo · Accepted Answer · 2019-08-01 11:22:25Z

3

generating a fresh access key worked for me.

answered Aug 1, 2019 at 11:22

yungBolo

411 bronze badge

Comments

jazeb007 · Accepted Answer · 2020-06-27 18:13:14Z

3

After debugging and spending a lot of time, in my case, the issue was with the access_key_id and secret_access_key, just double check your credentials or generate new one if possible and make sure you are passing the credentials in params.

answered Jun 27, 2020 at 18:13

jazeb007

6781 gold badge6 silver badges13 bronze badges

Comments

Joseph Combs · Accepted Answer · 2017-06-14 23:55:56Z

2

I had a similar error, but for me it seemed to be caused by re-using an IAM user to work with S3 in two different Elastic Beanstalk environments. I treated the symptom by creating an identically permissioned IAM user for each environment and that made the error go away.

answered Jun 14, 2017 at 23:55

Joseph Combs

91910 silver badges12 bronze badges

Comments

Manish Bansal · Accepted Answer · 2021-06-04 17:43:52Z

2

Like others, I also had the similar issue but in java sdk v1. For me, below 2 fixes helped me.

My key to object looked like this /path/to/obj/. In this, i first removed the / in the beginning.
Further, point 1 alone did not solve the issue. I upgraded my sdk version from 1.9.x to 1.11.x

After applying both the fixes, it worked. So my suggestion is not slog it out. If nothing else is working, just try upgrading the lib.

answered Jun 4, 2021 at 17:43

Manish Bansal

2,7602 gold badges26 silver badges40 bronze badges

Comments

pr1nc3 · Accepted Answer · 2019-03-06 08:05:04Z

1

I don't know if anyone came to this issue while trying to test the outputted URL in browser but if you are using Postman and try to copy the generated url of AWS from the RAW tab, because of escaping backslashes you are going to get the above error.

Use the Pretty tab to copy and paste the url to see if it actually works.

I run into this issue recently and this solution solved my issue. It's for testing purposes to see if you actually retrieve the data through the url.

This answer is a reference to those who try to generate a download, temporary link from AWS or generally generate a URL from AWS to use.

answered Mar 6, 2019 at 8:05

pr1nc3

8,3763 gold badges27 silver badges40 bronze badges

1 Comment

Yashraj basan Over a year ago

can you please tell me how you solved that issue? it is working fine in postman but not in nodejs

user1506104 · Accepted Answer · 2021-11-30 08:10:32Z

1

If you are a Android developer and is using the signature function from AWS sample code, you are most likely wondering why the ListS3Object works but not the GetS3Object. This is because when you set the setDoOutput(true) and using GET HTTP method, Android's HttpURLConnection switches the request to a POST. Thus, invalidating your signature. Check my original post of the issue.

answered Nov 30, 2021 at 8:10

user1506104

7,1265 gold badges76 silver badges99 bronze badges

Comments

jcm · Accepted Answer · 2022-02-24 01:02:12Z

1

I was getting this error in our shared environment where the SDK was being used, but using the same key/secret and the aws cli, it worked fine. The build system script had a space after the key and secret and session keys, which the code read in as well. So the fix for me was to adjust the build script to remove the spaces after the variables being used.

Just adding this for anyone who might miss that frustrating invisible space at the end of their creds.

answered Feb 24, 2022 at 1:02

jcm

335 bronze badges

Comments

Tom Williams · Accepted Answer · 2022-07-19 00:42:25Z

1

I am using the java SDK and got the same error. For me it was because I was sending special characters in the request. The characters I was sending were the Korean letters of a file name. And the specific location was:

com.amazonaws.services.s3.model.PutObjectRequest request.metadata.userMetadata

I realised that I didn't really need to send this information, so removing it fixed my error.

answered Jul 19, 2022 at 0:42

Tom Williams

311 bronze badge

Collectives™ on Stack Overflow

Amazon S3 - How to fix 'The request signature we calculated does not match the signature' error?

71 Answers 71

Comments

2 Comments

Comments

1 Comment

Comments

1 Comment

Comments

1 Comment

1 Comment

Comments

1 Comment

1 Comment

Comments

Comments

Comments

Comments

1 Comment

Comments

Comments

Comments

1 Comment

Comments

Comments

Comments

Comments

Comments

1 Comment

Comments

Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

71 Answers 71

Comments

2 Comments

Comments

1 Comment

Comments

1 Comment

Comments

1 Comment

1 Comment

Comments

1 Comment

1 Comment

Comments

Comments

Comments

Comments

1 Comment

Comments

Comments

Comments

1 Comment

Comments

Comments

Comments

Comments

Comments

1 Comment

Comments

Comments

Comments

Linked

Related