2

I have to use canned ACL header 'x-amz-acl' as described in AWS S3 documentation

Callout with Named Credentials without header works fine

HttpRequest request = new HttpRequest();
request.setEndpoint('callout:MY_S3/path');
request.setMethod('PUT');
request.setBody(content);

Http http = new Http();
HttpResponse response = http.send(request);

But if I add header to request

request.setHeader('x-amz-acl', 'bucket-owner-full-control');

it fails with SignatureDoesNotMatch error. Actually, any header with prefix 'x-amz-' causes signature mismatch.

If there any way to use Named Credentials authentication with canned ACL for S3?

5
  • I know this doesn't directly answer your question, but give the bigassforce/aws-sdk for Salesforce a look. It simplifies a lot of AWS API interactions.
    – nbrown
    Mar 18 at 15:22
  • The header must be part of the signature, this sounds like a bug in Named Credentials implementation of AWS V4 sig. You should open a support case with Salesforce and let them know. In a vanilla S3 implementation, the bucket owner has full control so bucket-owner-full-control is not needed. If this is a made-up example and you have some other setup, you can still work around this on AWS side with (for example) a bucket policy.
    – identigral
    Mar 18 at 15:25
  • @nbrown, thank you for suggestion. I sow this project but it's not completely open source - at least, I can't find implementation of SDK class. Also, it didn't pass security review. So I don't think I can use it in our project. Mar 18 at 15:56
  • @identigral, unfortunately, I have no control of S3 bucket. It's configured for cross-account access and bucket owner require this ACL in request. I'll try to raise ticket as you suggested. Thank you! Mar 18 at 16:02
  • Haven't tried this but worth a shot: if you check Allow Merge Fields in HTTP Header and then merge your value into the header, it might force the header into the signature. It might even work without the actual merge, a mere check might do it.
    – identigral
    Mar 18 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.