我在API网关后面有一个Lambda Nodejs函数,该函数成功返回了预签名URL:
const AWS = require('aws-sdk');
const S3 = new AWS.S3({
apiVersion: '2006-03-01',
signatureVersion: 'v4'
});
function getSignedUrl(id, type) {
const key = `uploads/${id}.${type}`;
return S3.getSignedUrl('putObject', {
Bucket: 'example-bucket-name',
Key: key,
Expires: 300
});
}
预签名的URL可能如下所示:
但是,当在浏览器中测试所说的URL时,我得到了SignatureDoesNotMatch。我想这似乎很公平,因为我以后只想将它与应用程序中的PUT一起使用。
但是使用curl或邮递员却被禁止了403:
curl -v -X PUT -T 489eb7115d0c479eaf9c3b6a01eb1893.png "https://example-bucket-name.s3.eu-central-1.amazonaws.com/uploads/489eb7115d0c479eaf9c3b6a01eb1893.png?Content-Type=image%2Fpng&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIARTVN4TPKUACY5POZ%2F20200616%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20200616T104031Z&X-Amz-Expires=300&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEEMaDGV1LWNlbnRyYWwtMSJHMEUCIQCDd%2B5hFjcBd%2FA6TEV7Se6L%2B6V8VtgCrMg0%2FbOkoGKy1wIgL20u20i%2B80rnBf49MfU1T3MQK2RQdoyQF6SwGQiYgeMq7gEIvP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgwxMTA5NjAwOTAwNjkiDIcy2z8%2FpQIhMOOaZirCAUFhV6uGF%2Ff44lDl%2BaFxIt9D302gcuPaxlrgZWlRMHb%2FEdrKFJsWP%2FG7%2B6ovilKh9WmcBX1fzuVa%2BHQ6rv6OaCueMEnDOBEj%2FvJ1hrI%2FwMDF1RLVlqq7pTDp6h6hmUxPfbqXu1k8sjcFotVzXZTzR0dX6kmWl41uEvaglXjrGG3ApvviH%2BSFLdUdvK9PBgrgSlamGIhxdJN75xxBzQMELfdpPJ6QanhLEwIa%2FuMliHPliXC2fasMzFEheA3Xmik43McnMJ3DovcFOuABdae1G7uUXOSaQzGZ7IjPLLZnMFfow4SzosQHlMUurlqQATPbieC9W3McsMVwggwzZX6BcN9OJb%2B0Ag3x9pS5eLnLsEio%2FyAPZJfXzoGBH5AdZ6TAZtC5cgKy0TEebH%2F3bF4%2FiamoTQ6YcZ4f48NefoNFHcRPXl3VF%2FdINmuTSG1cNlh2svT9jAUfOgaeK7tnFAW79L38Nv7xnnFMYFpyxoUx8XVkffCXmq15dyG7rLIR0FHkJ7p4C8eEqbQzOj%2Fsj1ELFFAWPtq38ZgFnWF%2BYf6W4UrkHD9AGdUucD1qvAA%3D&X-Amz-Signature=e11f346296a979e586b8f81a9db2ef2ce58c9f7a13a4f3c31f9a0bb9997b8b81&X-Amz-SignedHeaders=host"
Lambda函数具有以下权限:
s3:ListBucket Allow: arn:aws:s3:::example-bucket-name
s3:GetBucketLocation Allow: arn:aws:s3:::example-bucket-name
s3:PutObject Allow: arn:aws:s3:::example-bucket-name/uploads/*
S3存储桶具有以下CORS规则:
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>HEAD</AllowedMethod>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>PUT</AllowedMethod>
<AllowedMethod>POST</AllowedMethod>
<MaxAgeSeconds>3000</MaxAgeSeconds>
<ExposeHeader>ETag</ExposeHeader>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
这是存储桶ACL:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSConfigBucketPermissionsCheck",
"Effect": "Allow",
"Principal": {
"Service": "config.amazonaws.com"
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::example-bucket-name"
},
{
"Sid": "DenyUnEncryptedTraffic",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "*",
"Resource": "arn:aws:s3:::example-bucket-name/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
是否可能是上述DenyUnEncryptedTraffic规则导致了403?我通过删除上述规则对其进行了测试,但仍然得到403。
禁止所有公共访问!
存储桶拥有者对存储桶的完全访问权限!
我已经在此上浪费了太多时间,真的需要一些帮助!
答案 0 :(得分:3)
好吧,我现在很傻:
只需用Postman测试所述Presigned PUT URL并以某种方式起作用:
确保输入Presigned URL,选择PUT,然后选择二进制文件并添加文件。
如果有人发现它有用,我会保留。
答案 1 :(得分:1)
AWS返回SignatureDoesNotMatch错误(403)的原因通常是秘密密钥是不正确
答案 2 :(得分:1)
之所以会发生这种情况,是因为请求的标头与生成预签名URL时使用的标头不匹配。
也许您正在使用的HTTP库添加了默认标头,以防万一您没有提到它,例如Content-Type
。我知道Axios
会这样做。
答案 3 :(得分:0)
创建sign url时要注意,如果生成sign url的代码在IAM上没有正确的权限,生成预签名url时不会出错,但是在生成的时候会出错使用网址。