api authentication ai_generated true

SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided

ID: api/s3-presigned-url-clock-skew

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

S3 presigned URLs embed the signing time. If the server generating the URL has clock skew >15 minutes from AWS, URLs are born expired. Docker containers and VMs are common culprits.

generic

Workarounds

  1. 95% success Sync system clock with NTP before generating presigned URLs 
    sudo ntpdate -s time.nist.gov  # or: sudo systemctl restart chronyd
  2. 82% success Use STS to get server time and calculate offset for signing 
    aws_time = boto3.client('sts').get_caller_identity()  # response headers contain Date
  3. 88% success In Docker, mount host clock: -v /etc/localtime:/etc/localtime:ro 
    docker run -v /etc/localtime:/etc/localtime:ro myapp

Dead Ends

Common approaches that don't work:

  1. Increase presigned URL expiry to 24 hours 82% fail

    URLs still fail instantly if clock is ahead by >15 min. Longer expiry doesn't help when the start time is wrong.

  2. Regenerate the URL and retry 78% fail

    Same server generates the same skewed signature. Retrying without fixing clock produces identical failures.