SignatureDoesNotMatch cloud auth_error ai_generated true

我们计算的请求签名与您提供的签名不匹配。请检查您的密钥和签名方法。（状态：403）

The request signature we calculated does not match the signature you provided. Check your key and signing method. (Status: 403)

ID: cloud/aws-s3-presigned-url-expired-before-use

其他格式: JSON · Markdown 中文 · English
90%修复率
85%置信度
1证据数
2024-02-28首次发现

版本兼容性

版本状态引入弃用备注
AWS S3 (Standard) active — — —
AWS CLI v2.15.0 active — — —
boto3 1.34.0 active — — —

根因分析

预签名 URL 的过期时间非常短（例如 1 秒），或者客户端的时钟偏差导致签名在请求到达 S3 时已无效。

English

The presigned URL was generated with a very short expiration time (e.g., 1 second) or the client's clock is skewed, causing the signature to be invalid by the time the request reaches S3.

generic

官方文档

https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html

解决方案

  1. Generate the presigned URL with a longer expiration time, e.g., 3600 seconds (1 hour): `aws s3 presign s3://mybucket/myfile --expires-in 3600`
  2. If clock skew is suspected, synchronize the client's system clock using NTP: `sudo ntpdate -u time.google.com` on Linux, or enable 'Set time automatically' on Windows/macOS.

无效尝试

常见但无效的做法:

  1. 85% 失败

    The error is about signature mismatch, not permissions; this policy change does not help.

  2. 90% 失败

    The signature algorithm is correct by default; the issue is timing, not algorithm selection.

  3. 95% 失败

    The expiration is set during URL generation; adding a header cannot extend it.