{"action":"created","issue":{"url":"https://api.github.com/repos/aws/aws-sdk-go/issues/826","repository_url":"https://api.github.com/repos/aws/aws-sdk-go","labels_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/826/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/826/comments","events_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/826/events","html_url":"https://github.com/aws/aws-sdk-go/issues/826","id":175294191,"number":826,"title":"PUT: CloudFront-hosted S3 buckets return \"The request signature we calculated does not match the signature you provided.\"","user":{"login":"ljfranklin","id":1923644,"avatar_url":"https://avatars.githubusercontent.com/u/1923644?v=3","gravatar_id":"","url":"https://api.github.com/users/ljfranklin","html_url":"https://github.com/ljfranklin","followers_url":"https://api.github.com/users/ljfranklin/followers","following_url":"https://api.github.com/users/ljfranklin/following{/other_user}","gists_url":"https://api.github.com/users/ljfranklin/gists{/gist_id}","starred_url":"https://api.github.com/users/ljfranklin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ljfranklin/subscriptions","organizations_url":"https://api.github.com/users/ljfranklin/orgs","repos_url":"https://api.github.com/users/ljfranklin/repos","events_url":"https://api.github.com/users/ljfranklin/events{/privacy}","received_events_url":"https://api.github.com/users/ljfranklin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aws/aws-sdk-go/labels/Question","name":"Question","color":"cc317c"},{"url":"https://api.github.com/repos/aws/aws-sdk-go/labels/Service%20API","name":"Service API","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"xibz","id":1964445,"avatar_url":"https://avatars.githubusercontent.com/u/1964445?v=3","gravatar_id":"","url":"https://api.github.com/users/xibz","html_url":"https://github.com/xibz","followers_url":"https://api.github.com/users/xibz/followers","following_url":"https://api.github.com/users/xibz/following{/other_user}","gists_url":"https://api.github.com/users/xibz/gists{/gist_id}","starred_url":"https://api.github.com/users/xibz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xibz/subscriptions","organizations_url":"https://api.github.com/users/xibz/orgs","repos_url":"https://api.github.com/users/xibz/repos","events_url":"https://api.github.com/users/xibz/events{/privacy}","received_events_url":"https://api.github.com/users/xibz/received_events","type":"User","site_admin":false},"assignees":[{"login":"xibz","id":1964445,"avatar_url":"https://avatars.githubusercontent.com/u/1964445?v=3","gravatar_id":"","url":"https://api.github.com/users/xibz","html_url":"https://github.com/xibz","followers_url":"https://api.github.com/users/xibz/followers","following_url":"https://api.github.com/users/xibz/following{/other_user}","gists_url":"https://api.github.com/users/xibz/gists{/gist_id}","starred_url":"https://api.github.com/users/xibz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xibz/subscriptions","organizations_url":"https://api.github.com/users/xibz/orgs","repos_url":"https://api.github.com/users/xibz/repos","events_url":"https://api.github.com/users/xibz/events{/privacy}","received_events_url":"https://api.github.com/users/xibz/received_events","type":"User","site_admin":false}],"milestone":null,"comments":19,"created_at":"2016-09-06T16:38:37Z","updated_at":"2016-09-20T15:07:43Z","closed_at":null,"body":"When PUT'ing to a CloudFront-hosted S3 bucket with authentication, it fails with `The request signature we calculated does not match the signature you provided.`\r\n\r\n```go\r\npackage main\r\n\r\nimport (\r\n\t\"fmt\"\r\n\t\"github.com/aws/aws-sdk-go/aws\"\r\n\t\"github.com/aws/aws-sdk-go/aws/credentials\"\r\n\t\"github.com/aws/aws-sdk-go/aws/session\"\r\n\t\"github.com/aws/aws-sdk-go/service/s3\"\r\n\t\"strings\"\r\n)\r\n\r\nfunc main() {\r\n\tawsConfig := &aws.Config{\r\n\t\tRegion:      aws.String(\"us-east-1\"),\r\n\t\tCredentials: credentials.NewEnvCredentials(),\r\n\t}\r\n\r\n\tawsConfig.Endpoint = aws.String(\"https://cloudfront.net\")\r\n\r\n\tsess := session.New(awsConfig)\r\n\tclient := s3.New(sess, awsConfig)\r\n\r\n\tputObject, err := client.PutObject(&s3.PutObjectInput{\r\n\t\tBucket: aws.String(\"dy5fxXX7XXXX\"),\r\n\t\tKey:    aws.String(\"foo\"),\r\n\t\tBody:   strings.NewReader(\"bar\"),\r\n\t})\r\n\r\n\tif err != nil {\r\n\t\tpanic(err.Error())\r\n\t}\r\n\tfmt.Printf(\"%#v\", putObject)\r\n}\r\n```\r\nOutput:\r\n```bash\r\npanic: SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.\r\n       \tstatus code: 403, request id:\r\n```\r\n\r\nWe set up our CloudFront distribution to forward all query params and whitelisted headers. If we temporarily allow anonymous users to PUT objects, the uploads succeeds when we change `credentials.NewEnvCredentials()` to `credentials.AnonymousCredentials`. The upload also succeeds with credentials if we specify the real bucket name rather than going through CloudFront."},"comment":{"url":"https://api.github.com/repos/aws/aws-sdk-go/issues/comments/248330358","html_url":"https://github.com/aws/aws-sdk-go/issues/826#issuecomment-248330358","issue_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/826","id":248330358,"user":{"login":"ljfranklin","id":1923644,"avatar_url":"https://avatars.githubusercontent.com/u/1923644?v=3","gravatar_id":"","url":"https://api.github.com/users/ljfranklin","html_url":"https://github.com/ljfranklin","followers_url":"https://api.github.com/users/ljfranklin/followers","following_url":"https://api.github.com/users/ljfranklin/following{/other_user}","gists_url":"https://api.github.com/users/ljfranklin/gists{/gist_id}","starred_url":"https://api.github.com/users/ljfranklin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ljfranklin/subscriptions","organizations_url":"https://api.github.com/users/ljfranklin/orgs","repos_url":"https://api.github.com/users/ljfranklin/repos","events_url":"https://api.github.com/users/ljfranklin/events{/privacy}","received_events_url":"https://api.github.com/users/ljfranklin/received_events","type":"User","site_admin":false},"created_at":"2016-09-20T15:07:43Z","updated_at":"2016-09-20T15:07:43Z","body":"@xibz while giving upload permission to anyone with the CloudFront URL might be usable in certain environments, we're looking to solve this in the general case. We'd like users with proper access keys and permissions to be able to upload, everyone can download and list. Is there no way to fix the Signing Error?"}}
{"actor":{"display_login":"ljfranklin"}}