使用雲端的訪問被拒絕簽名 URL Python3

Question

我正在嘗試為我的 s3 存儲桶創建簽名的 url，只有 select 人可以訪問，直到時間到期。

我無法在我的代碼中找到問題。 請幫忙

import boto
from boto.cloudfront import CloudFrontConnection
from boto.cloudfront.distribution import Distribution
import base64
import json 
import rsa
import time                                                                                                                                                              

def lambda_handler(event, context):
    
    url = "https://notYourUrl.com/example.html"                                                                                                                                                                      
    expires = int(time.time() + 36000)
    
    pem = """-----BEGIN RSA PRIVATE KEY-----
               myKey
    -----END RSA PRIVATE KEY-----"""

Cloudfront console
    key_pair_id = 'myKey'    
    
    policy = {
        "Statement": [
            {
                "Resource":url,
                "Condition":{
                    "DateLessThan":{"AWS:EpochTime":expires},
                }
            }
        ]
    }
    
    policy = json.dumps(policy)
    private_key = rsa.PrivateKey.load_pkcs1(pem)
    
    policy = policy.encode("utf-8")
    signed = rsa.sign(policy, private_key, 'SHA-1')
    policy = base64.b64encode(policy)
    policy = policy.decode("utf-8")
    signature = base64.urlsafe_b64encode(signed)
    signature = signature.decode("utf-8")
    
    policy = policy.replace("+", "-")
    policy = policy.replace("=", "_")
    policy = policy.replace("/", "~")
    
    signature = signature.replace("+", "-")
    signature = signature.replace("=", "_")
    signature = signature.replace("/", "~")

    print("%s?Expires=%s&Signature=%s&Key-Pair-Id=%s" % (url,expires, signature, key_pair_id))

When I test the file on lambda I am able to produce and print a URL but when I access the URL I receive an access denied error message from the XML file.

我不確定我在這一點上做錯了什么。 為了測試我是否能夠生成任何 SignedUrl，我創建了一個 node.js lambda 在其中我能夠成功生成 URL 甚至訪問我的頁面。

<Error>
<Code>AccessDenied</Code>
<Message>Access denied</Message>
</Error>

Answer 1

在多次嘗試使我的代碼工作失敗后，我決定用不同的方法 go 並使用 node.js 來滿足我的需求。 下面的代碼完美運行，我能夠生成簽名的 url

現在我使用硬編碼的時間值來測試我的代碼，稍后將使用 datetime 動態獲取它。

var AWS = require('aws-sdk');
var keyPairId = 'myKeyPairId';
var privateKey = '-----BEGIN RSA PRIVATE KEY-----' + '\n' +

    '-----END RSA PRIVATE KEY-----';
var signer = new AWS.CloudFront.Signer(keyPairId, privateKey);

exports.handler = function(event, context) {
    var options = {url: "https://notYourUrl.com/example.html", expires: 1621987200, 'Content-Type': 'text/html'};
    //console.log(options);
    const cookies = signer.getSignedCookie(options);
    const url = signer.getSignedUrl(options);
    
    console.log("Printing URL "+url);
    console.log(cookies);
  
};