Putting objects in S3 from Java application complains about missing AWS Signature

0

Hello,

I am trying to write to S3 bucket from my Java application. My application is running in EKS. I have provided AWS credentials using system propertiesaws.accessKeyId and aws.secretAccessKey.

When sending put request, I get this error - com.amazonaws.services.s3.model.AmazonS3Exception: Put Object requests with Object Lock parameters require AWS Signature Version 4 (Service: Amazon S3; Status Code: 400; Error Code: InvalidArgument

Java SDK should automatically authenticate using the credentials and I should not need to compute the signature. Am I missing anything here?

  • Can you share the code to put the object, including client initialization?

  • Here is my code for creating the client

        final AwsClientBuilder.EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(
                s3Endpoint,
                s3Region
        );
    
        final AmazonS3 s3client = AmazonS3ClientBuilder
                .standard()
                .withEndpointConfiguration(endpoint)
                .enablePathStyleAccess()
                .withClientConfiguration(new ClientConfiguration().withSignerOverride("AWSS3V4SignerType"))
                .build();
    

    And then I make a call for writing object into the bucket

            PutObjectRequest request = new PutObjectRequest(s3Bucket, fileName, new ByteArrayInputStream(content_bytes), metadata);
            s3client.putObject(request);
    
질문됨 2년 전871회 조회
1개 답변
0
수락된 답변

The error message indicates that you need to use AWS Signature Version 4 to authenticate your requests to Amazon S3 with Object Lock parameters. This is because Object Lock is a feature that provides WORM (Write Once Read Many) functionality, and as such, requires a higher level of security.

You can enable Signature Version 4 by removing the .withClientConfiguration(new ClientConfiguration().withSignerOverride("AWSS3V4SignerType")) line from your code. The AWS SDK for Java will automatically use Signature Version 4 if it's required for the API you're calling.

Here's an updated version of your code:

final AwsClientBuilder.EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(
            s3Endpoint,
            s3Region
    );

final AmazonS3 s3client = AmazonS3ClientBuilder
            .standard()
            .withEndpointConfiguration(endpoint)
            .enablePathStyleAccess()
            .build();

Note that it's recommended to use IAM roles or instance profiles to provide AWS credentials to applications running on EC2 or EKS, rather than using explicit access keys. This approach can help improve security and simplify credential management.

profile pictureAWS
답변함 2년 전
  • Thanks, I updated my code to use SDK v2 and that solved the problem.

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠