"HTTP Header Authorization=Not Set" for AWS signature 4 Named Credential

Question

I have set up a Named Credential for AWS Signature Version 4 to access the AWS ElasticSearch service. I have double checked all settings and values and ensured 'Generate Authorization Header' is set. The IAM policy works in AWS policy checker.

Named Credential:

Label: AWS ES
Name: AWS_ES
Url: https://xxx.us-east-1.es.amazonaws.com/_search/
Identity Type: Named Principal
Auth. Protocol: AWS Signature Version 4
AWS Access Key ID: xxx
AWS Secret: xxx
AWS Region: us-east-1
AWS Service: es
Generate Auth. Header: True
Allow Header Merge Fields: False
Allow Body Merge Fields: False

Apex Code:

@future (callout=true)
public static void sendRequest(String jsonString){
    System.debug('sendRequest');        

    HttpRequest req = new HttpRequest();
    String asdf = '?q=name:ford';
    req.setEndpoint('callout:AWS_ES' + asdf);
    req.setMethod('GET');    
    System.debug(req.getBody()); 
    System.debug(req); 

    System.debug(req.getHeader('Authorization')); 

    Http http = new Http();
    HTTPResponse res = http.send(req);                
    System.debug(res.getBody());        

}

However, before sending the requests, the logs show that the Authorization Header is not set:

NAMED_CREDENTIAL_REQUEST NamedCallout[Name=AWS_ES, Endpoint=https://xxx.xxx.es.amazonaws.com/_search?q=name:ford, Method=GET, External Credential Type=EXTERNAL, HTTP Header Authorization=Not Set, Retry on 401=True]

The response is a 403 with the error:

{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."}

Answer 1

It turns out that the colon in the search query was breaking the authentication handshake. Once the colon in '?q=name:ford' was encoded to '?q=name%3Aford', the handshake worked and the query executed correctly.

Answer 2

I was having a similar error message being returned and after following the example in amzAwsConnectorTest() method in this GitHub repo, I was able to get through my issue.

https://github.com/rruprai/sfdc-aws-sign4/blob/master/classes/AmzAwsSenderTest.cls