AWS S3 Go Sdk - 添加 ACL 時預簽名 url 無法上傳文件

Question

我有一個 go 服務，它生成一個預簽名的 url 來上傳文件：

sess, err := session.NewSession(&aws.Config{
    Region: aws.String(os.Getenv(AwsRegionEnv))},
)
if err != nil {
    return nil, err
}

svc := s3.New(sess)

req, _ := svc.PutObjectRequest(&s3.PutObjectInput{
    Bucket: aws.String(os.Getenv(BucketNameEnv)),
    Key:    aws.String(getFileName(file, customer)),
})

minutesTimeout, err := strconv.Atoi(os.Getenv(TimeoutURL))
if err != nil {
    return nil, err
}

str, err := req.Presign(time.Duration(minutesTimeout) * time.Minute)
if err != nil {
    return nil, err
}

所以，我可以使用 curl 使用這個預簽名的 url 上傳一個文件：

curl -vT test.pdf '<<URL PRESIGNED>>'

但是，當我添加一個 ACL 時，這不起作用，修改是：

req, _ := svc.PutObjectRequest(&s3.PutObjectInput{
    Bucket: aws.String(os.Getenv(BucketNameEnv)),
    Key:    aws.String(getFileName(file, customer)),
    ACL:    aws.String(s3.ObjectCannedACLAuthenticatedRead),
})

當我嘗試使用帶 ACL 的預簽名 url 上傳文件時，出現以下錯誤：

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>SignatureDoesNotMatch</Code>
   <Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>
   <AWSAccessKeyId>ASIAS...</AWSAccessKeyId>
   <StringToSign>AWS4-HMAC-SHA256
20210316T135400Z
20210316/us-east-2/s3/aws4_request
d7ab7d377b719636610b11793e3e68e104a3f41fb9f9f5608138a8c2b19ceaf3</StringToSign>
    <SignatureProvided>bd59fbb080..</SignatureProvided>
    <StringToSignBytes>41 57 53...</StringToSignBytes>
    <CanonicalRequest>PUT
/35527810/sampleVpacheco3.pdf
X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=...%2Fus-east-2%2Fs3%2Faws4_request&amp;X-Amz-Date=20210316T135400Z&amp;X-Amz-Expires=300&amp;X-Amz-Security-Token=IQoJb3JpZ2luX2VjEN7%2F%2F...&amp;X-Amz-SignedHeaders=host%3Bx-amz-acl
host:adl-digital-dev-document-manager.s3.us-east-2.amazonaws.com
x-amz-acl:

host;x-amz-acl
UNSIGNED-PAYLOAD</CanonicalRequest>
    <CanonicalRequestBytes>50 55 54...</CanonicalRequestBytes>
    <RequestId>0V6FWNNGK2QCDA1V</RequestId>
    <HostId>rE4rkv...</HostId>
</Error>

知道如何添加 ACL 並成功上傳文件嗎？

完整的 URL 是：

https://document-manager.s3.us-east-2.amazonaws.com/35527810/sampleVpacheco5.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIASN3IRSVR%2F20210316%2Fus-east-2%2Fs3%2Faws4_request&X-Amz-Date=20210316T143240Z&X-Amz-Expires=300&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEN7%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIGW4j1R7H3wIxUAN8FytKbDTRne4pJGJ9I4ofpXeh%2FcaAiBFTdRNVug9WODzLdCoMcFRVzFZ%2FtGeaweeteSSTY6yMSqtAwgXEAIaDDE2NzE4NjEwOTc5NSIMh1JvraENxW8E5aBqKooDLx39b6Lx1%2Fw6AtGMSzlYRILNIXdB2Ouviq0pUlfPVCSFlZnPzo%2F%2B6%2B8ZcIpHM8E%2FDjEn1NF1lvcz9QKsuXJI94XuVCSRGiBBRvpIdm%2Ff001q3C%2FmZW2I1aMsfV518LTtEQigJ%2Fv80TPVSv7ZozoR9Zae4W3C3efjm2sJ%2BkVkI%2FBm7z6Vd97Q%2BbpVztf8Lp4GImDp1G72wtOP7wq9wSDYzFEzUja91r7g97py1Wzin6%2BXUNX68yAH%2BRePqyW6by4Lht8086B7YQcj6h77kxwE89C1NMYhKPiNl1y%2Ff4NukwWxW%2FTefqSW3Qr26eDfTV%2FVyR7%2FeNCf7OOtpkGZEmOnFbd%2FyY6wVOARcTdixQkPKKu2GAkz%2B8xuNY10uTGoh2vul3gUWBZF4Yl13R7kIq%2FPBb1UVl%2BatCwN%2BDBMj22cM4Pn%2BOJPyqxCjcfyIXwRsiYDTmmtiSIWrTvSEQaWf1Dc95lQVToA2ZsAxB8LO88%2FEz0t3FUpPw0ncgbLbHedcRYqvV62RDRQK%2FI9zjCz78KCBjqnAfzDcfP25%2BIr6ia4elbxSDOWIIv%2FjZOLlRDedHdqLKCDjYbgXoWrTQTt%2BZCRlV7UtJxo%2ByVeJvsjmb3BdI4IjI8wd8XjkV5qMejJbFcmFIQV7df0cdGY7U6nOO8gxGK9fj7Fb1Y0DtZaCxaZU8D0d2iTfUn8kl%2FT0GwSPDZqz1I6oJuG58KLR%2BVKRhuZrhTq8%2Fm98cLg7diuwt%2Bt1RwL%2BK9oonqHqXcE&X-Amz-SignedHeaders=host%3Bx-amz-acl&X-Amz-Signature=27d1fae2f60187dce85b175980c4e91334fe2a0f192d220244aa4a27e798ec9f

我厭倦了這個：

• 添加 header x-amc-acl: -H "x-amc-acl: authenticated-read"
• 添加 header 主機：-H“主機：127.0.0.1”
• 修改URL，修改host%3Bx-amz-acl by host;x-amc-acl

謝謝！

Answer 1

在查詢參數中添加 acl 屬性后它對我有用

req, _ := svc.GetObjectRequest(&s3.GetObjectInput{
  Bucket: aws.String(bucket),
  Key:    aws.String(key),
})
q := req.HTTPRequest.URL.Query()
q.Add("x-amz-acl", "public-read")
q.Add("Content-Type", contentType)
req.HTTPRequest.URL.RawQuery = q.Encode()

presigned, err := req.Presign(5 * time.Minute)
if err != nil {
  fmt.Printf("Error presigning URL: %v\n", err)
}
fmt.Println(presigned)