Putting objects in S3 from Java application complains about missing AWS Signature

0

Hello,

I am trying to write to S3 bucket from my Java application. My application is running in EKS. I have provided AWS credentials using system propertiesaws.accessKeyId and aws.secretAccessKey.

When sending put request, I get this error - com.amazonaws.services.s3.model.AmazonS3Exception: Put Object requests with Object Lock parameters require AWS Signature Version 4 (Service: Amazon S3; Status Code: 400; Error Code: InvalidArgument

Java SDK should automatically authenticate using the credentials and I should not need to compute the signature. Am I missing anything here?

  • Can you share the code to put the object, including client initialization?

  • Here is my code for creating the client

        final AwsClientBuilder.EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(
                s3Endpoint,
                s3Region
        );
    
        final AmazonS3 s3client = AmazonS3ClientBuilder
                .standard()
                .withEndpointConfiguration(endpoint)
                .enablePathStyleAccess()
                .withClientConfiguration(new ClientConfiguration().withSignerOverride("AWSS3V4SignerType"))
                .build();
    

    And then I make a call for writing object into the bucket

            PutObjectRequest request = new PutObjectRequest(s3Bucket, fileName, new ByteArrayInputStream(content_bytes), metadata);
            s3client.putObject(request);
    
已提问 2 年前870 查看次数
1 回答
0
已接受的回答

The error message indicates that you need to use AWS Signature Version 4 to authenticate your requests to Amazon S3 with Object Lock parameters. This is because Object Lock is a feature that provides WORM (Write Once Read Many) functionality, and as such, requires a higher level of security.

You can enable Signature Version 4 by removing the .withClientConfiguration(new ClientConfiguration().withSignerOverride("AWSS3V4SignerType")) line from your code. The AWS SDK for Java will automatically use Signature Version 4 if it's required for the API you're calling.

Here's an updated version of your code:

final AwsClientBuilder.EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(
            s3Endpoint,
            s3Region
    );

final AmazonS3 s3client = AmazonS3ClientBuilder
            .standard()
            .withEndpointConfiguration(endpoint)
            .enablePathStyleAccess()
            .build();

Note that it's recommended to use IAM roles or instance profiles to provide AWS credentials to applications running on EC2 or EKS, rather than using explicit access keys. This approach can help improve security and simplify credential management.

profile pictureAWS
已回答 2 年前
  • Thanks, I updated my code to use SDK v2 and that solved the problem.

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则