签署亚马逊请求时获得响应 403

Question

我正在尝试通过没有 SDK 的亚马逊 SES 发送电子邮件，以便我可以在 Python 中异步发送电子邮件。我在他们的网站上使用亚马逊的 v4 签名方法：https://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html，但我没有任何运气在没有 SDK 的情况下发送电子邮件。输出是：

RESPONSE++++++++++++++++++++++++++++++++++++
Response code: 403

<ErrorResponse xmlns="http://ses.amazonaws.com/doc/2010-12-01/">
  <Error>
    <Type>Sender</Type>
    <Code>SignatureDoesNotMatch</Code>
    <Message>The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.</Message>
  </Error>
  <RequestId>a19a5fa1-3228-11e9-b2bc-ddb6d8a1cb1c</RequestId>
</ErrorResponse>


Process finished with exit code 0

这是生成该响应的代码块：

import datetime
import hashlib
import hmac
import urllib.parse
import requests
method = 'GET'
service = 'ses'
host = 'email.us-east-1.amazonaws.com'
region = 'us-east-1'
endpoint = 'https://email.us-east-1.amazonaws.com/'


def sign(key, msg):
    return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest()


def getSignatureKey(key, dateStamp, regionName, serviceName):
    kDate = sign(('AWS4' + key).encode('utf-8'), dateStamp)
    kRegion = sign(kDate, regionName)
    kService = sign(kRegion, serviceName)
    kSigning = sign(kService, 'aws4_request')
    return kSigning


access_key = '<my access_key here>'
secret_key = '<my secret_key here>'
my_email = 'my email here'


t = datetime.datetime.utcnow()
amz_date = t.strftime('%Y%m%dT%H%M%SZ')
datestamp = t.strftime('%Y%m%d')
canonical_uri = '/'
canonical_headers = 'host:' + host + '\n'
signed_headers = 'host'
algorithm = 'AWS4-HMAC-SHA256'
credential_scope = datestamp + '/' + region + '/' + service + '/' + 'aws4_request'

canonical_querystring = '''Action=SendEmail
&Source=%s%40gmail.com
&Destination.ToAddresses.member.1=%s%40gmail.com
&Message.Subject.Data=This%20is%20the%20subject%20line.
&Message.Body.Text.Data=Hello.%20I%20hope%20you%20are%20having%20a%20good%20day''' % (my_email, my_email)

canonical_querystring += '&X-Amz-Algorithm=AWS4-HMAC-SHA256'
canonical_querystring += '&X-Amz-Credential=' + urllib.parse.quote_plus(access_key + '/' + credential_scope)
canonical_querystring += '&X-Amz-Date=' + amz_date
canonical_querystring += '&X-Amz-Expires=30'
canonical_querystring += '&X-Amz-SignedHeaders=' + signed_headers

payload_hash = hashlib.sha256(('').encode('utf-8')).hexdigest()
canonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hash
string_to_sign = algorithm + '\n' +  amz_date + '\n' +  credential_scope + '\n' +  hashlib.sha256(canonical_request.encode('utf-8')).hexdigest()
signing_key = getSignatureKey(secret_key, datestamp, region, service)
signature = hmac.new(signing_key, (string_to_sign).encode("utf-8"), hashlib.sha256).hexdigest()
canonical_querystring += '&X-Amz-Signature=' + signature
request_url = endpoint + "?" + canonical_querystring

print('\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++')
print('Request URL = ' + request_url)
r = requests.get(request_url)

print('\nRESPONSE++++++++++++++++++++++++++++++++++++')
print('Response code: %d\n' % r.status_code)
print(r.text)

这基本上是亚马逊用于生成从他们的文档复制和粘贴的签名的代码。有谁知道我在签署对亚马逊的请求时做错了什么？

编辑* 我将 canonical_querystring 更改为按字母顺序排列，如下所示：

canonical_querystring = '''Action=SendEmail
&Destination.ToAddresses.member.1={}%40gmail.com
&Message.Body.Text.Data=Hello.%20I%20hope%20you%20are%20having%20a%20good%20day
&Message.Subject.Data=This%20is%20the%20subject%20line.
&Source={}%40gmail.com'''.format(my_email, my_email)

它仍然给我同样的错误。查询字符串中的其他所有内容均按字母顺序排列，或“规范排序”。

Answer 1

您的规范查询字符串不规范。

您有Action... Source... Destination... Message，但所有参数都需要按词法排序。

第 3 步：创建规范查询字符串。

[...]

参数必须按名称排序。

这种顺序是该值被称为规范的原因。这是必要的，因为不一定保证查询字符串参数的相对位置。参数不需要在请求附带的实际查询字符串中排序，但它们确实需要在此处排序，以便签名。

由于给定的请求只能有一个可能的有效签名，因此在签名之前对参数进行排序以消除如果用户代理或代理重新排列查询参数或在构建 URL 时任意排序可能出现的歧义（可能例如，如果将参数作为无序散列/字典结构传递给 UA，则可以预期）。