title: AWS signature v4 authentication succeeds for EU bucket but fails for US bucket?
body: <p>I recently implemented AWS Signature version 4 using the REST API.  This is verified by an extensive regression test working perfectly.</p>
  
  <p>The problem I'm experiencing is that the regression test succeeds when run against a bucket residing in the <code>eu-central-1</code> region, but consistently fails with the <code>Accessed Denied</code> error message for buckets residing in <code>us-east-1</code> or <code>us-west-2</code>.</p>
  
  <p>Here are snippets from successful and failed attempts.</p>
  
  <hr>
  
  <p><strong>eu-central-1 : successful</strong></p>
  
  <p>HTTP request:</p>
  
  <pre>
  GET./
  host:s3.eu-central-1.amazonaws.com.x-amz-content-sha256:e3b0...b855.x-amz-date:Wed, 25 May 2016 03:13:21 +0000
  host;x-amz-content-sha256;x-amz-date.e3b0...b855
  </pre>
  
  <p>Signed string:</p>
  
  <pre>
  AWS4-HMAC-SHA256
  Credential=AKIAJZN7UY6XHIZPWIKQ/20160525/eu-central-1/s3/aws4_request,
  SignedHeaders=host;x-amz-content-sha256;x-amz-date,
  Signature=cf5f...4dc8
  </pre>
  
  <p>Server response:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;ListAllMyBucketsResult
      xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
      &lt;Owner&gt;
          &lt;ID&gt;100a...a575&lt;/ID&gt;
      &lt;/Owner&gt;
      &lt;Buckets&gt;
          &lt;Bucket&gt;
              . . .
          &lt;/Bucket&gt;
      &lt;/Buckets&gt;
  &lt;/ListAllMyBucketsResult&gt;
  </code></pre>
  
  <hr>
  
  <p><strong>us-east-1 : failed</strong></p>
  
  <p>HTTP request:</p>
  
  <pre>
  GET./
  host:s3.us-east-1.amazonaws.com.x-amz-content-sha256:e3b0...b855.x-amz-date:Wed, 25 May 2016 03:02:27 +0000
  host;x-amz-content-sha256;x-amz-date.e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  </pre>
  
  <p>Signed string:</p>
  
  <pre><code>AWS4-HMAC-SHA256
  Credential=AKIAJZN7UY6XHIZPWIKQ/20160525/us-east-1/s3/aws4_request,
  SignedHeaders=host;x-amz-content-sha256;x-amz-date,
  Signature=01e97...4d00
  </code></pre>
  
  <p>Server response:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;
      &lt;Code&gt;AccessDenied&lt;/Code&gt;
      &lt;Message&gt;Access Denied&lt;/Message&gt;
      &lt;RequestId&gt;92EEF2A86ECA88EF&lt;/RequestId&gt;
      &lt;HostId&gt;i3wTU6OzBrlX89xR4KnnezBx1Tb2IGN2wtgPJMRtKLjHxF/B6VdCQqPz1279J7e5&lt;/HostId&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <hr>
  
  <p><strong>us-west-2 : failed</strong></p>
  
  <p>HTTP request:</p>
  
  <pre>
  GET./
  host:s3.us-west-2.amazonaws.com.x-amz-content-sha256:e3b0...b855.x-amz-date:Wed, 25 May 2016 07:04:47 +0000
  host;x-amz-content-sha256;x-amz-date.e3b0...b855
  </pre>
  
  <p>Signed string:</p>
  
  <pre><code>AWS4-HMAC-SHA256
  Credential=AKIAJZN7UY6XHIZPWIKQ/20160525/us-west-2/s3/aws4_request,
  SignedHeaders=host;x-amz-content-sha256;x-amz-date,
  Signature=cf70...36b9
  </code></pre>
  
  <p>Server response:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;
      &lt;Code&gt;AccessDenied&lt;/Code&gt;
      &lt;Message&gt;Access Denied&lt;/Message&gt;
      &lt;RequestId&gt;DB143DBF0F316EB8&lt;/RequestId&gt;
      &lt;HostId&gt;5hWJ0AHM466QcT+BK4UaEFpqXFNaJFEuAPlN/ZZPBhL+NDYBoGaySRkXQ3BRdyfy9PBDuSb0oHA=&lt;/HostId&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <hr>
  
  <p>Attempts made to date include:</p>
  
  <ul>
  <li><p>I found references (<a href="https://stackoverflow.com/a/26622229/562242">like here</a>) where when using US Standard (i.e., us-east-1) the REST endpoint should <em>not</em> include "us-east-1".  I have not yet found this written officially.  I therefore created a us-west-2 bucket, in the hope that the REST endpoint needs to contain "us-west-2", but that also fails.</p></li>
  <li><p>I searched on Google and StackOverflow for possible reasons for "Access Denied", which led me to adding a bucket policy that gives permissions to all -- to no avail.</p></li>
  <li><p>The permissions of the EU and US accounts in the AWS console look the same, so no hint there, yet.</p></li>
  <li><p>I added logging to the buckets in the hope of seeing a failure entry, but nothing is logged until authentication is completed.</p></li>
  </ul>
  
  <p>Does anyone have an idea why AWS v4 authentication will consistently succeed for an eu-central-1 bucket, but equally fail for us-east-1 and us-east-2 buckets?</p>