如何在 AWS 中从 Java 生成签名

Question

当我从 REST 客户端调用 API 端点时，我遇到了与签名有关的错误。

请求：

主持人：https://xxx.execute-api.ap-southeast-1.amazonaws.com/latest/api/name

授权：AWS4-HMAC-SHA256 Credential={AWSKEY}/20160314/ap-southeast-1/execute-api/aws4_request,SignedHeaders=host;range;x-amz-date,Signature ={signature}

X-Amz-日期：20160314T102915Z

回复：

{
"message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details. The Canonical String for this request should have been 'xxx' "
}

从 Java 代码，我遵循 AWS 参考如何生成签名。

    String secretKey = "{mysecretkey}";
    String dateStamp = "20160314";
    String regionName = "ap-southeast-1";
    String serviceName = "execute-api";

    byte[] signature = getSignatureKey(secretKey, dateStamp, regionName, serviceName);
    System.out.println("Signature : " + Hex.encodeHexString(signature));

    static byte[] HmacSHA256(String data, byte[] key) throws Exception  {
         String algorithm="HmacSHA256";
         Mac mac = Mac.getInstance(algorithm);
         mac.init(new SecretKeySpec(key, algorithm));
         return mac.doFinal(data.getBytes("UTF8"));
    }

    static byte[] getSignatureKey(String key, String dateStamp, String regionName, String serviceName) throws Exception  {
         byte[] kSecret = ("AWS4" + key).getBytes("UTF8");
         byte[] kDate    = HmacSHA256(dateStamp, kSecret);
         byte[] kRegion  = HmacSHA256(regionName, kDate);
         byte[] kService = HmacSHA256(serviceName, kRegion);
         byte[] kSigning = HmacSHA256("aws4_request", kService);
         return kSigning;
    }

我可以知道我在生成签名时出了什么问题吗？

参考如何生成签名：http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-java

Answer 1

您可以使用 aws-java-sdk-core 中的类：https://github.com/aws/aws-sdk-java/tree/master/aws-java-sdk-core

更具体地说，Request、Aws4Signer 和其他一些：

//Instantiate the request
Request<Void> request = new DefaultRequest<Void>("es"); //Request to ElasticSearch
request.setHttpMethod(HttpMethodName.GET);
request.setEndpoint(URI.create("http://..."));

//Sign it...
AWS4Signer signer = new AWS4Signer();
signer.setRegionName("...");
signer.setServiceName(request.getServiceName());
signer.sign(request, new AwsCredentialsFromSystem());

//Execute it and get the response...
Response<String> rsp = new AmazonHttpClient(new ClientConfiguration())
    .requestExecutionBuilder()
    .executionContext(new ExecutionContext(true))
    .request(request)
    .errorResponseHandler(new SimpleAwsErrorHandler())
    .execute(new SimpleResponseHandler<String>());

如果你想要一个更简洁的设计，你可以使用装饰器模式来组合一些优雅的类并隐藏上面的混乱。这里有一个例子：http://www.amihaiemil.com/2017/02/18/decorators-with-tunnels.html

Answer 2

从上面的代码示例看来，您没有创建规范请求并将其包含在按照 http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html 签名的字符串中

您没有自己实现，而是考虑使用第三方库。

aws-v4-signer-java 是一个轻量级的零依赖库，可以轻松生成 AWS V4 签名。

String contentSha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
HttpRequest request = new HttpRequest("GET", new URI("https://examplebucket.s3.amazonaws.com?max-keys=2&prefix=J"));
String signature = Signer.builder()
        .awsCredentials(new AwsCredentials(ACCESS_KEY, SECRET_KEY))
        .header("Host", "examplebucket.s3.amazonaws.com")
        .header("x-amz-date", "20130524T000000Z")
        .header("x-amz-content-sha256", contentSha256)
        .buildS3(request, contentSha256)
        .getSignature();

免责声明：我是图书馆的作者。

Answer 3

这可以使用 100% java 库而无需额外依赖，只需使用此处生成的query parameters：

import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SignatureException;
import java.util.Formatter;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

...

private static final String ACCESS_KEY = "...";
private static final String SECRET_KEY = "...";
private static final int expiresTime = 1 * 24 * 60 * 60;
private static final String HMAC_SHA1_ALGORITHM = "HmacSHA1";

public void sign(String protocol, String bucketName, String contentPath) throws Exception {
    Calendar cal = Calendar.getInstance();
    cal.add(Calendar.HOUR_OF_DAY, 24);

    String host = bucketName + ".s3-us-west-2.amazonaws.com";
    long expireTime = cal.getTimeInMillis() / 1000;

    String signString = "GET\n" +
        "\n" +
        "\n" +
        expireTime + "\n" +
        "/" + bucketName + contentPath;

    SecretKeySpec signingKey = new SecretKeySpec(SECRET_KEY.getBytes(), HMAC_SHA1_ALGORITHM);
    Mac mac = Mac.getInstance(HMAC_SHA1_ALGORITHM);
    mac.init(signingKey);
    String signature = URLEncoder.encode(new String(Base64.getEncoder().encode(mac.doFinal(signString.getBytes()))));

    System.out.println(signature);
    String fullPayload = "?AWSAccessKeyId=" + ACCESS_KEY +
        "&Expires=" + expireTime + 
        "&Signature=" + signature;

    System.out.println(protocol + "://" + host + contentPath + fullPayload);
}

...

Answer 4

签名过程冗长且容易出错，这里有一些提示

• 确保你的access key和secret是正确的，首先尝试使用Postman测试请求，简单快速，见Use Postman to Call a REST API
• 确保使用 UTC 时间
• 签名过程同时使用时间戳 (YYYYMMDD'T'HHMMSS'Z') 和日期时间 (YYYYMMDD)，因此请仔细检查您的实现
• 使用任何在线哈希工具来验证您的哈希算法是否符合预期
• 仔细阅读python实现，见Examples of the Complete Version 4 Signing Process (Python)
• 在 Github 上查看我完整的 java 实现 - A Java(SpringBoot) template for Java and AWS SageMaker DeepAR model endpoint invocation integration

Answer 5

您可以调查 AWS 网站共享的代码示例。我使用了一些 util 类和一些我需要的 java 类。所以你不必使用所有的类和其他东西。我留下了下面的链接。

AWS Java Samples in doc of Amazon