AWS S3 DeleteObjects via Named Credentials

Question

I am trying to call AWS S3 DeleteObjects REST API from Apex. I am able to successfully perform this operation in Postman using their Sig4 Auth tool but I am struggling to get this working in Apex.

I have tried a few different approaches,

1.) using Named Credentials (Focus of this question)

2.) using sfdcfox's AWS class (referenced in the answer here.)

For both of these approaches I was able to get basic GET and PUT functionality working but the POST seems to require a different approach. This question is focused on the Named Credential approach as I feel it will be the simplest solution. If I am unable to do this using Named Credentials, I will ask a separate question with more details on approach #2.

This POST method requires a content-MD5 header which is generated from the body of the request. By default, the AWS Sig4 Named Credential does not have this header when working in Apex. After I set the body, I generate the content-md5 header, add it to the request, and send the request. This generates an error saying the following:

There were headers present in the request which were not signed

Here is the code performing the callout:

    HttpRequest req = new HttpRequest();
    String body = '<Delete ><Object><Key>test.png</Key></Object><Object><Key>test1.png</Key></Object></Delete>';
    Blob targetBlob = Blob.valueOf(body);
    Blob md5checksum = Crypto.generateDigest('MD5',targetBlob);
    string ContentMD5 = EncodingUtil.base64Encode(md5checksum);
    
    req.setMethod('POST');
    
    req.setBody(body);
    req.setHeader('content-md5', ContentMD5);
    req.setEndpoint('callout:aws/?delete');
    
    Http http = new Http();
    HTTPResponse res = http.send(req);
    system.debug(res.getBody());

Here is a screenshot of the Named Credential config:

Answer 1

AWS S3 REST API allows one to delete a single or multiple objects via DeleteObject or DeleteObjects API call respectively. DeleteObjects requires Content-MD5 header. S3 uses the value of this header to ensure that your request body has not been altered in transit. This is an "extra" header that is not required by DeleteObject. Content-MD5 is also not required for a number of other typical API calls to S3 such as listing the contents of the bucket or adding an object.

Named Credentials does not emit Content-MD5 header. We've tried this on both legacy and current External Cred-linked flavor of the Named Credential. Speaking with Product Management team, we've been told this is working as designed, it's the expected outcome.

If you don't have many objects to delete, a workaround is to grab the object keys, then delete them one at a time via DeleteObject:

String key = 'TestObject.txt';
HttpRequest request = new HttpRequest();
request.setMethod('DELETE');
request.setEndpoint('callout:aws/' + key);
Http http = new Http();
HTTPResponse res = http.send(request);
Assert.areEqual(204,res.getStatusCode()); 

Note: DeleteObject responds with 204 even if the target object doesn't exist.