I have set up a Named Credential for AWS Signature Version 4 to access the AWS ElasticSearch service. I have double checked all settings and values and ensured 'Generate Authorization Header' is set. The IAM policy works in AWS policy checker.

Named Credential:

Label: AWS ES
Name: AWS_ES
Url: https://xxx.us-east-1.es.amazonaws.com/_search/
Identity Type: Named Principal
Auth. Protocol: AWS Signature Version 4
AWS Access Key ID: xxx
AWS Secret: xxx
AWS Region: us-east-1
AWS Service: es
Generate Auth. Header: True
Allow Header Merge Fields: False
Allow Body Merge Fields: False

Apex Code:

@future (callout=true)
public static void sendRequest(String jsonString){

    HttpRequest req = new HttpRequest();
    String asdf = '?q=name:ford';
    req.setEndpoint('callout:AWS_ES' + asdf);


    Http http = new Http();
    HTTPResponse res = http.send(req);                


However, before sending the requests, the logs show that the Authorization Header is not set:

NAMED_CREDENTIAL_REQUEST NamedCallout[Name=AWS_ES, Endpoint=https://xxx.xxx.es.amazonaws.com/_search?q=name:ford, Method=GET, External Credential Type=EXTERNAL, HTTP Header Authorization=Not Set, Retry on 401=True]

The response is a 403 with the error:

{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."}
  • Post your code + Named Cred config + the same request/response from Postman/curl/etc that shows you have this whole thing working outside of Salesforce
    – identigral
    Commented Mar 23, 2020 at 16:34
  • Thanks @identigral - just updated
    – alanhh
    Commented Mar 23, 2020 at 18:22
  • Try _search?q=name:ford (no trailing slash after search)
    – identigral
    Commented Mar 23, 2020 at 18:33
  • I have - same error
    – alanhh
    Commented Mar 23, 2020 at 18:36
  • Named Credential acts as a runtime proxy. You won't be able to see headers before the request is sent. That said, a 403 means something is wrong.
    – identigral
    Commented Mar 23, 2020 at 18:43

2 Answers 2


It turns out that the colon in the search query was breaking the authentication handshake. Once the colon in '?q=name:ford' was encoded to '?q=name%3Aford', the handshake worked and the query executed correctly.


I was having a similar error message being returned and after following the example in amzAwsConnectorTest() method in this GitHub repo, I was able to get through my issue.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .