golang：使用 SSE 对 S3 对象的预签名 url 的 GET 请求失败并出现 403 错误

Question

当我向 Go 中的 AWS Presign 方法生成的预签名 url 发出 GET 请求时，我收到 403 Forbidden HTTP 响应。

错误信息是：

The request signature we calculated does not match the signature you provided. Check your key and signing method

X-Amz-SignedHeaders 是：host;x-amz-server-side-encryption-customer-algorithm;x-amz-server-side-encryption-customer-key;x-amz-server-side-encryption-customer-key-md5

我正在像这样将对象写入 S3：

type DocumentStore struct {
    bucketName               string
    bucketEncryptionKeyAlias string
    aws                      *session.Session
}

func (s *DocumentStore) PutDocument(ctx context.Context, envelope []byte, metadata map[string]string) (PutDocumentResult, error) {
    uploader := s3manager.NewUploader(s.aws)

    var objectKey = uuid.New().String()

    if _, err := uploader.UploadWithContext(ctx, &s3manager.UploadInput{
        Bucket:               aws.String(s.bucketName),
        Key:                  aws.String(objectKey),
        ContentType:          aws.String("application/octet-stream"),
        Body:                 bytes.NewReader(envelope),
        ServerSideEncryption: aws.String(s3.ServerSideEncryptionAwsKms),
        SSEKMSKeyId:          aws.String(s.bucketEncryptionKeyAlias),
        Metadata:             aws.StringMap(metadata),
    }); err != nil {
        return PutDocumentResult{}, fmt.Errorf("put document failed on upload: %v", err.Error())
    }

    return PutDocumentResult{
        BucketName: s.bucketName,
        ObjectKey:  objectKey,
    }, nil
}

我要这样签署 url：

func (s *DocumentStore) NewSignedGetURL(ctx context.Context, objectKey string, ttl time.Duration) (string, error) {
    svc := s3.New(s.aws)

    req, _ := svc.GetObjectRequest(&s3.GetObjectInput{
        Bucket: aws.String(s.bucketName),
        Key: aws.String(objectKey),
        SSECustomerKey: aws.String(s.bucketEncryptionKeyAlias),
        SSECustomerAlgorithm: aws.String(s3.ServerSideEncryptionAwsKms),
    })

    url, err := req.Presign(ttl)
    if err != nil {
        return "", fmt.Errorf("failed to presign GetObjectRequest for key %q: %v", objectKey, err)
    }

    return url, nil
}

我这样调用方法：

result, err := target.PutDocument(context.TODO(), envelope, metadata)
if err != nil {
    t.Errorf("PutDocument failed: %v", err)
    return
}

getURL, err := target.NewSignedGetURL(context.TODO(), result.ObjectKey, time.Minute*5)
if err != nil {
    t.Errorf("failed to sign url: %v", err)
    return
}

req, _ := http.NewRequest("GET", getURL, nil)
req.Header.Add("x-amz-server-side-encryption-customer-algorithm", s3.ServerSideEncryptionAwsKms)
req.Header.Add("x-amz-server-side-encryption-customer-key", test.cfg.AWS.BucketKMSAlias)
req.Header.Add("x-amz-server-side-encryption-customer-key-md5", "")

resp, err := http.DefaultClient.Do(req.WithContext(context.TODO()))
if err != nil {
    t.Errorf("failed to request object from signed url: %v", err)
    return
}
defer resp.Body.Close()

data, err := ioutil.ReadAll(resp.Body)
if err != nil {
    t.Errorf("failed to read object stream from S3: %v", err)
    return
}

if resp.StatusCode != http.StatusOK {
    t.Errorf("failed to get object. Http status: %s(%d)\n%s", resp.Status, resp.StatusCode, data)
    return
}

我可以像这样从 aws cli 读取下载文件：

aws --profile dispatcher_stage --region us-east-1 s3 cp s3://[bucket-name]/0c/09179312-e283-431c-ab71-6a0c437177fe . --sse aws:kms --sse-kms-key-id alias/[key-alias-name]

我错过了什么？

Answer 1

我想通了：只要用户对 KMS 密钥具有 Decrypt 权限，GetObject 请求就不需要 SSE 参数。以下是相关更改：

我现在签署 url 是这样的：

func (s *DocumentStore) NewSignedGetURL(ctx context.Context, objectKey string, ttl time.Duration) (string, error) {
    svc := s3.New(s.aws)

    req, _ := svc.GetObjectRequest(&s3.GetObjectInput{
        Bucket: aws.String(s.bucketName),
        Key: aws.String(objectKey),
    })

    url, err := req.Presign(ttl)
    if err != nil {
        return "", fmt.Errorf("failed to presign GetObjectRequest for key %q: %v", objectKey, err)
    }

    return url, nil
}

我正在这样下载对象：

getURL, err := target.NewSignedGetURL(context.TODO(), result.ObjectKey, time.Minute*5)
if err != nil {
    t.Errorf("failed to sign url: %v", err)
    return
}

req, _ := http.NewRequest("GET", getURL, nil)
req.Header.Add("host", req.Host)

resp, err := http.DefaultClient.Do(req.WithContext(context.TODO()))
if err != nil {
    t.Errorf("failed to request object from signed url: %v", err)
    return
}
defer resp.Body.Close()

data, err := ioutil.ReadAll(resp.Body)
if err != nil {
    t.Errorf("failed to read object stream from S3: %v", err)
    return
}

golang：使用 SSE 对 S3 对象的预签名 url 的 GET 请求失败并出现 403 错误

golang: GET request for presigned url of S3 object with SSE fails with 403 error

amazon-s3

go

amazon-web-services

aws-sdk

aws-sdk-go