SignatureDoesNotMatch cloud auth_error ai_generated true

The request signature we calculated does not match the signature you provided. Check your key and signing method. (Status: 403)

ID: cloud/aws-s3-presigned-url-expired-before-use

Also available as: JSON · Markdown · 中文
90%Fix Rate
85%Confidence
1Evidence
2024-02-28First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
AWS S3 (Standard) active — — —
AWS CLI v2.15.0 active — — —
boto3 1.34.0 active — — —

Root Cause

The presigned URL was generated with a very short expiration time (e.g., 1 second) or the client's clock is skewed, causing the signature to be invalid by the time the request reaches S3.

generic

中文

预签名 URL 的过期时间非常短（例如 1 秒），或者客户端的时钟偏差导致签名在请求到达 S3 时已无效。

Official Documentation

https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html

Workarounds

  1. 95% success Generate the presigned URL with a longer expiration time, e.g., 3600 seconds (1 hour): `aws s3 presign s3://mybucket/myfile --expires-in 3600` 
    Generate the presigned URL with a longer expiration time, e.g., 3600 seconds (1 hour): `aws s3 presign s3://mybucket/myfile --expires-in 3600`
  2. 80% success If clock skew is suspected, synchronize the client's system clock using NTP: `sudo ntpdate -u time.google.com` on Linux, or enable 'Set time automatically' on Windows/macOS. 
    If clock skew is suspected, synchronize the client's system clock using NTP: `sudo ntpdate -u time.google.com` on Linux, or enable 'Set time automatically' on Windows/macOS.

中文步骤

  1. Generate the presigned URL with a longer expiration time, e.g., 3600 seconds (1 hour): `aws s3 presign s3://mybucket/myfile --expires-in 3600`
  2. If clock skew is suspected, synchronize the client's system clock using NTP: `sudo ntpdate -u time.google.com` on Linux, or enable 'Set time automatically' on Windows/macOS.

Dead Ends

Common approaches that don't work:

  1. 85% fail

    The error is about signature mismatch, not permissions; this policy change does not help.

  2. 90% fail

    The signature algorithm is correct by default; the issue is timing, not algorithm selection.

  3. 95% fail

    The expiration is set during URL generation; adding a header cannot extend it.