當我向 Go 中的GETAWS 方法生成的預簽名 URL 發(fā)出請求時，收到 403 Forbidden HTTP 響應(yīng)。Presign錯誤信息是：我們計算的請求簽名與您提供的簽名不匹配。檢查您的密鑰和簽名方法X-Amz-SignedHeaders是：host;x-amz-server-side-encryption-customer-algorithm;x-amz-server-side-encryption-customer-key;x-amz-server-side-encryption-customer-key-md5我將對象寫入 S3，如下所示：type DocumentStore struct { bucketName string bucketEncryptionKeyAlias string aws *session.Session}func (s *DocumentStore) PutDocument(ctx context.Context, envelope []byte, metadata map[string]string) (PutDocumentResult, error) { uploader := s3manager.NewUploader(s.aws) var objectKey = uuid.New().String() if _, err := uploader.UploadWithContext(ctx, &s3manager.UploadInput{ Bucket: aws.String(s.bucketName), Key: aws.String(objectKey), ContentType: aws.String("application/octet-stream"), Body: bytes.NewReader(envelope), ServerSideEncryption: aws.String(s3.ServerSideEncryptionAwsKms), SSEKMSKeyId: aws.String(s.bucketEncryptionKeyAlias), Metadata: aws.StringMap(metadata), }); err != nil { return PutDocumentResult{}, fmt.Errorf("put document failed on upload: %v", err.Error()) } return PutDocumentResult{ BucketName: s.bucketName, ObjectKey: objectKey, }, nil}我像這樣簽署網(wǎng)址：func (s *DocumentStore) NewSignedGetURL(ctx context.Context, objectKey string, ttl time.Duration) (string, error) { svc := s3.New(s.aws) req, _ := svc.GetObjectRequest(&s3.GetObjectInput{ Bucket: aws.String(s.bucketName), Key: aws.String(objectKey), SSECustomerKey: aws.String(s.bucketEncryptionKeyAlias), SSECustomerAlgorithm: aws.String(s3.ServerSideEncryptionAwsKms), }) url, err := req.Presign(ttl) if err != nil { return "", fmt.Errorf("failed to presign GetObjectRequest for key %q: %v", objectKey, err) } return url, nil}我缺少什么？
1 回答
HUWWW
TA貢獻1874條經(jīng)驗 獲得超12個贊
我發(fā)現(xiàn)：GetObject只要用戶擁有DecryptKMS 密鑰的權(quán)限，請求就不需要 SSE 參數(shù)。以下是相關(guān)變更：
我現(xiàn)在正在像這樣簽署網(wǎng)址：
func (s *DocumentStore) NewSignedGetURL(ctx context.Context, objectKey string, ttl time.Duration) (string, error) {
svc := s3.New(s.aws)
req, _ := svc.GetObjectRequest(&s3.GetObjectInput{
Bucket: aws.String(s.bucketName),
Key: aws.String(objectKey),
})
url, err := req.Presign(ttl)
if err != nil {
return "", fmt.Errorf("failed to presign GetObjectRequest for key %q: %v", objectKey, err)
}
return url, nil
}
我正在下載這樣的對象：
getURL, err := target.NewSignedGetURL(context.TODO(), result.ObjectKey, time.Minute*5)
if err != nil {
t.Errorf("failed to sign url: %v", err)
return
}
req, _ := http.NewRequest("GET", getURL, nil)
req.Header.Add("host", req.Host)
resp, err := http.DefaultClient.Do(req.WithContext(context.TODO()))
if err != nil {
t.Errorf("failed to request object from signed url: %v", err)
return
}
defer resp.Body.Close()
data, err := ioutil.ReadAll(resp.Body)
if err != nil {
t.Errorf("failed to read object stream from S3: %v", err)
return
}
- 1 回答
- 0 關(guān)注
- 268 瀏覽
添加回答
舉報
0/150
提交
取消