Error 403 using GetObjectAttributes or GetObjectMetadata

Question

Hi,
I'm using nuget packages AWSSDK.Core and AWSSDK.S3 in .net for integrating S3 in my application.
Until version 3.7.106.45 of AWSSDK.Core I can use this two pieces of code to verify the existence of a resource in S3:

IAmazonS3 client = new AmazonS3Client();
/*Verification using GetObjectMetadata*/
GetObjectMetadataRequest metaDataRequest = new GetObjectMetadataRequest()
{
	BucketName = bucket,
	Key = fileName,
	VersionId = null,
};
var responseObjectMetadata = client.GetObjectMetadata(metaDataRequest);

/*Verification using GetObjectAttributes*/
var request = new GetObjectAttributesRequest()
{
	BucketName = bucket,
	Key = fileName,
	VersionId = null,
	ObjectAttributes = new List { new ObjectAttributes("ObjectSize") },
};
var response = client.GetObjectAttributes(request);

From version 3.7.107 I get the following exceptions using the above code:
/*Verification using GetObjectMetadata*/
Amazon.S3.AmazonS3Exception: 'Error making request with Error Code Forbidden and Http Status Code Forbidden. No further error information was returned by the service.'
/*Verification using GetObjectAttributes*/
Amazon.S3.AmazonS3Exception: 'The request signature we calculated does not match the signature you provided. Check your key and signing method.'

I've check the documentation but everything seems fine regarding permissions: https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/S3/MS3GetObjectAttributesGetObjectAttributesRequest.html

We use a general purpose bucket with no versioning  and the used credentials have these permissions:

"s3:DeleteObjectTagging",
"s3:ListBucketMultipartUploads",
"s3:GetBucketTagging",
"s3:DeleteObjectVersion",
"s3:ReplicateTags",
"s3:RestoreObject",
"s3:PutObjectVersionTagging",
"s3:ListBucket",
"s3:ReplicateObject",
"s3:PutObject",
"s3:GetObjectAcl",
"s3:GetObject",
"s3:AbortMultipartUpload",
"s3:GetObjectVersionAcl",
"s3:GetObjectTagging",
"s3:PutObjectTagging",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:PutObjectAcl",
"s3:ReplicateDelete",
"s3:GetObjectVersion"
"s3:GetObjectAttributes"

We already tried both the standard call and the async call but the exceptions raised are the same.

Thank you in advance for the info you can provide to help me resolve this issue.

Accepted Answer

A change was made [in Core 3.7.107.0](https://github.com/aws/aws-sdk-net/blob/master/changelogs/SDK.CHANGELOG.2023.md#375600-2023-06-02-1359-utc)

[A side-effect of this change](https://github.com/aws/aws-sdk-net/issues/2622) was that before, it was possible to include a path as part of "BucketName", and get a success, but this no longer works.  It was never intended for "BucketName" to support inputs other than the Bucket itself.  It's not possible to tell from your example above if you might be encountering this, but I'd suggest investigating as that's the primary change for Core 3.7.107.0.

The error you received for GetObjectAttributes, "The request signature we calculated does not match the signature you provided. Check your key and signing method." indicates that the authorization header is malformed.

GetObjectMetadata might be the same root cause, but with a less specific error message.  GetObjectMetadata calls the [S3 API HeadObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html#API_HeadObject_ResponseSyntax), whereas GetObjectAttributes calls the [S3 API GetObjectAttributes](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAttributes.html).  The key difference here, is that HeadObject does not have a response body, so detailed error messages are not part of the response, only HTTP header codes like 403.

There are multiple possible causes of invalid request signature, but the one that would apply to the above would be if the Canonical URI did not match what was in the request or the URI encoding was different.

Since I'm not sure that's the cause of your error, I'll mention another common cause is signing a request for one AWS region, but sending the request to another AWS region.  Usually this can be resolved by explicitly stating the region for a bucket.

For reference see the [AWS SigV4 signing method](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html), and see it includes the target region in the "Scope" signed into the signature, as well as the previously mentioned CanonicalURI and specific URIEncode() specification.

Answer

Hi, Giovanni.
I created a console app on a dev machine and was able to get the code to work without a problem.
- I tried it with the following versions: AWSSDK.Core v3.7.107 and AWSSDK.S3 v3.7.104.26.
- I also tried it with the current versions and they were also fine.

I did notice that you are missing a comma in your list of permissions.
Is that just a copy/paste error, or is it possible that your policy is actually missing the comma?

(I can share the code and policy that I used if you think it would be helpful. (Properly scrubbed, of course.))

Error 403 using GetObjectAttributes or GetObjectMetadata

Relevant content