Anyone tried Summer '19 Named Credentials using AWS Signature Version 4 successfully? Trying again to use External Services and first step is the Credentials.

I created an IAM user with the appropriate perms and tested user successfully. Haven't seen any Salesforce documentation on using this for Named Credentials, Ive seen the Apex examples there and here this is diff. We are using

URL: https://mturk-requester-sandbox.us-east-1.amazonaws.com
Certificate: (blank)
Identity Type: Named Principal
Authentication Protocol: AWS Signature Version 4
AWS Access Key Id: 12345
AWS Secret Access Key: *****
AWS Region: us-east-1
AWS Service: mturk-requester

Was very unsure on these settings

Generate Authorization Header: TRUE
Allow Merge Fields in HTTP Header: TRUE
Allow Merge Fields in HTTP Body: TRUE

Got AWS region and name from https://docs.aws.amazon.com/general/latest/gr/rande.html

When trying to test this in Anonymous Apex getting

CALLOUT_RESPONSE [7]|System.HttpResponse[Status=Forbidden, StatusCode=403]

When trying to run in Flow Debug mode am getting error:

System.CalloutException: Received error response - Invalid parameter value "[hidden]" for parameter "Decryption Exception"..

The JSON isn't correct so don't expect it to work but hoping for a valid connection.

  • Possibly an issue with one of the params in your NamedCredentials definition a la salesforce.stackexchange.com/questions/253985/…
    – identigral
    Jun 4, 2019 at 17:56
  • But I have no idea if the settings I used are correct such as Http merge fields so was hoping someone could confirm that first as callouts are not anything Im versed in and Salesforce isnt overly helpful on callouts since lots can be wrong.
    – ddeve
    Jun 4, 2019 at 17:58
  • Are you using the merge fields in your custom code? If so, then leave them as True. help.salesforce.com/…
    – identigral
    Jun 4, 2019 at 18:09
  • There isn't any custom code. We are trying to use with External Services and then Flow.
    – ddeve
    Jun 5, 2019 at 0:50
  • in that case the merge fields don't matter
    – identigral
    Jun 5, 2019 at 3:54

1 Answer 1


Got a PUT working for s3 today using AWS Signature Version 4 and then did some testing.

Generate authorization header must be checked on the named credential, else you will get access denied error.

The other two options (Allow Merge Fields in HTTP Header.Allow Merge Fields in HTTP Body) did not have any impact on my tests.

For s3, the url in the named credential itself must specify the bucket name, as the path per [the docs] is (https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUT.html) is


I have not used mturk so cant speak to that, but hopefully this is helpful.

Not the answer you're looking for? Browse other questions tagged .