S3 conditional writes. PutObject presigned url with "If-match etag" does not work for non sigV4 requests.

Question

Hello, i'm trying to use https://docs.aws.amazon.com/AmazonS3/latest/userguide/conditional-writes.html and etags to uppload attachiments from my web ui to an S3 bucket. I want to prevent objects overwrites and want rely on Etags. However it seems that etags feature is not compatibale with browser side files upploading.

I generate a pre-signed PUT url and try to use curl to uppload it

curl -X PUT "https://<my bucket>.s3.eu-west-1.amazonaws.com/a3302b37-cf22-40e6-91f8-d198d7b7da83/cases/58316781-1e14-4b10-aff2-6515926ddcc5/attachments/file.txt\?X-Amz-Security-Token\=***%3D%3D\&X-Amz-Algorithm\=AWS4-HMAC-SHA256\&X-Amz-Date\=20250324T080356Z\&X-Amz-SignedHeaders\=content-type%3Bhost%3Bif-match\&X-Amz-Credential\=***%2F20250324%2Feu-west-1%2Fs3%2Faws4_request\&X-Amz-Expires\=3600\&X-Amz-Signature\=61fbddcf025de09d85c94cf120e58fd40764e9e7538ceb0b498723753c0b75fc" \
     -H "Content-Type: application/text" \
     -H "Content-Length: 5" \
     -H "If-Match: test-tag"\
     --data-binary "@test.txt"

However I always receive below error

<Error><Code>InvalidRequest</Code><Message>**Requests specifying conditional writes either require AWS Signature Version 4 or must be made over a secure connection.**</Message><RequestId>ZQD8528QB8BGATG0</RequestId><HostId>AmaQ7Wu6quomtpfOY8nv8TCuqh130FxSSnDUDI1pya/g8g7mXpBOWsjM1RVm1pb1F7seBilYhErhSYdKzWipYQ==</HostId></Error>%

As per https://docs.aws.amazon.com/AmazonS3/latest/userguide/conditional-writes.html

To use conditional writes, you must make the requests over HTTPS (TLS) or use AWS Signature Version 4 to sign the request.

I do use https url, however apparently it's not "OR" it's "AND SigV4". I believe it's bug or some missing precondition in the documentation. I cannot use etags to uppload files from say ReactJS. I cannot share my aws credentials to sign a request on the browser side.

NOTES:

When I try to specify the eTag value as "*" I get

A header you provided implies functionality that is not implemented</Message><Header>If-Match</Header><additionalMessage>We don't accept the provided value of If-Match header for this API
When I use If-None-Match: * header instead of If-Match everything works as expected

If-Match

We don't accept the provided value of If-Match header for this API 2. When I use `If-None-Match: *` header instead of `If-Match` everything works as expected

re:Post Agent · Answer

Thank you for providing detailed information about your issue with S3 conditional writes using pre-signed URLs. You're correct that there seems to be a discrepancy between the documentation and the actual behavior you're experiencing.

The error message you're receiving indicates that for conditional writes using the If-Match header, AWS is requiring both HTTPS and AWS Signature Version 4 (SigV4), not just one or the other as the documentation suggests.

Your observation about the "AND" requirement instead of "OR" appears to be accurate. This is indeed a limitation when trying to use conditional writes with pre-signed URLs from a browser environment where you can't use SigV4 signing.

Regarding your notes:

1. The "*" value for the If-Match header is not supported for this API, which explains the error you received.

2. The fact that If-None-Match: * works as expected is consistent with the intended behavior for preventing overwrites of existing objects.

For your use case of uploading attachments from a web UI to an S3 bucket while preventing object overwrites, you might consider the following alternatives:

1. Use server-side logic to handle the upload and apply the conditional write checks. This way, you can use SigV4 signing on the server.

2. Use the If-None-Match: * header instead of If-Match, as you've found it works. This will prevent overwrites of existing objects but won't give you the fine-grained control that ETag matching provides.

3. Implement a two-step process where you first check the object's existence and ETag on the server, then generate a pre-signed URL with appropriate conditions.

It would be beneficial to report this discrepancy to AWS support or through their documentation feedback channels to help clarify the requirements for conditional writes with pre-signed URLs.  
**Sources**  
[How to prevent object overwrites with conditional writes - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/conditional-writes.html)  
[Enforce conditional writes on Amazon S3 buckets - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/conditional-writes-enforce.html)  
[PutObject - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html)

S3 conditional writes. PutObject presigned url with "If-match etag" does not work for non sigV4 requests.

Add your answer

Relevant content