PreSignedUrl of createImportJob cant upload file .csv

[khanwilson]

Describe the issue

i have downloaded template.csv and include some row data in.
i want create job import users by aws sdk, by that step:

• create CognitoIdentityServiceProvider
• use provider.createUserImportJob(params) with params: JobName, UserPoolId, CloudWatchLogsRoleArn.
• get PreSignedUrl from response createUserImportJob.
  call Put (by axios, postman) with header 'Content-Type': 'text/csv'. when time has valid but i always got 403

<Code>SignatureDoesNotMatch</Code>
   <Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>

• got that error so i cant run startImportJob.

---

With params of createUserImportJob, i have do manually on Amazon Cognito>User pools>my pool>Create import job. It run oke.
beside, i have check is my S3, i dont see any bucket name like https://aws-cognito-idp-user-import-lhr.s3.eu-west-2.amazonaws.com of first part in url PreSignedUrl. Why, createUserImportJob created link like that.

Please explain this problem, and help me solve it :(

Links

https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CognitoIdentityServiceProvider.html#createUserImportJob-property

[aBurmeseDev]

Hi @khanwilson - thanks for reaching out.

• create CognitoIdentityServiceProvider
• use provider.createUserImportJob(params) with params: JobName, UserPoolId, CloudWatchLogsRoleArn.
• get PreSignedUrl from response createUserImportJob.

When you call the createUserImportJob method, Amazon Cognito generates a pre-signed URL for you to upload the CSV file to an S3 bucket. This pre-signed URL includes a signature that is calculated based on your AWS credentials and other request parameters.

• call Put (by axios, postman) with header 'Content-Type': 'text/csv'. when time has valid but i always got 403 SignatureDoesNotMatch
• The request signature we calculated does not match the signature you provided. Check your key and signing method.

When you try to upload the CSV file using a tool like Postman or Axios, you need to ensure that the request is sent exactly as specified in the pre-signed URL, including the headers and the request body. Any deviation from the expected request format will result in a SignatureDoesNotMatch error as the signature calculated by AWS will not match the signature you provided.

• beside, i have check is my S3, i dont see any bucket name like "https://aws-cognito-idp-user-import-lhr.s3.eu-west-2.amazonaws.com/" of first part in url PreSignedUrl. Why, createUserImportJob created link like that.

Regarding the S3 bucket name in the pre-signed URL, Amazon Cognito uses an internal S3 bucket managed by the service for user import jobs. This bucket is not visible in your AWS account and you cannot access it directly. The pre-signed URL includes a bucket name like aws-cognito-idp-user-import-lhr.s3.eu-west-2.amazonaws.com which is a bucket used by the Cognito service.

Here are a few suggestions:

• Check the pre-signed URL expiration: Pre-signed URLs have a limited validity period typically a few hours. If the URL has expired, you will receive a SignatureDoesNotMatch error.
• Verify the request headers: Ensure that you're sending the Content-Type: text/csv header exactly as specified in the pre-signed URL. Any deviation in the header name or value will cause a signature mismatch.
• Use the AWS SDK or AWS CLI: Instead of using a third-party tool like Postman or Axios, you can try uploading the CSV file using AWS SDK or AWS CLI. We handle the signature calculation automatically reducing the chances of errors.
• Check the AWS credentials: Ensure that you're using the correct AWS credentials (access key and secret key) when creating the Cognito Identity Provider client. Incorrect or expired credentials can cause signature mismatches.

Hope it helps.
Best,
John

[khanwilson]

Hi @khanwilson - thanks for reaching out.

• create CognitoIdentityServiceProvider
• use provider.createUserImportJob(params) with params: JobName, UserPoolId, CloudWatchLogsRoleArn.
• get PreSignedUrl from response createUserImportJob.

When you call the createUserImportJob method, Amazon Cognito generates a pre-signed URL for you to upload the CSV file to an S3 bucket. This pre-signed URL includes a signature that is calculated based on your AWS credentials and other request parameters.

• call Put (by axios, postman) with header 'Content-Type': 'text/csv'. when time has valid but i always got 403 SignatureDoesNotMatch
• The request signature we calculated does not match the signature you provided. Check your key and signing method.

When you try to upload the CSV file using a tool like Postman or Axios, you need to ensure that the request is sent exactly as specified in the pre-signed URL, including the headers and the request body. Any deviation from the expected request format will result in a SignatureDoesNotMatch error as the signature calculated by AWS will not match the signature you provided.

• beside, i have check is my S3, i dont see any bucket name like "https://aws-cognito-idp-user-import-lhr.s3.eu-west-2.amazonaws.com/" of first part in url PreSignedUrl. Why, createUserImportJob created link like that.

Regarding the S3 bucket name in the pre-signed URL, Amazon Cognito uses an internal S3 bucket managed by the service for user import jobs. This bucket is not visible in your AWS account and you cannot access it directly. The pre-signed URL includes a bucket name like aws-cognito-idp-user-import-lhr.s3.eu-west-2.amazonaws.com which is a bucket used by the Cognito service.

Here are a few suggestions:

• Check the pre-signed URL expiration: Pre-signed URLs have a limited validity period typically a few hours. If the URL has expired, you will receive a SignatureDoesNotMatch error.
• Verify the request headers: Ensure that you're sending the Content-Type: text/csv header exactly as specified in the pre-signed URL. Any deviation in the header name or value will cause a signature mismatch.
• Use the AWS SDK or AWS CLI: Instead of using a third-party tool like Postman or Axios, you can try uploading the CSV file using AWS SDK or AWS CLI. We handle the signature calculation automatically reducing the chances of errors.
• Check the AWS credentials: Ensure that you're using the correct AWS credentials (access key and secret key) when creating the Cognito Identity Provider client. Incorrect or expired credentials can cause signature mismatches.

Hope it helps. Best, John

• i have checked my case, my Pre-signed has not expired, header like img i was attached above it has Content-Type: text/csv.
  i tried with axios or https like

const csvContent = file.buffer;
const response = await axios.put(preSignedUrl, csvContent, {
        headers: {
          'Content-Type': 'text/csv',
        },
      });

but, i still got the same SignatureDoesNotMatch error.

• i check AWS credentials, my project has use accessKeyId and secretAccessKey of IAM>Users account has that permissions below, im not sure that is enough for this case: createImportJob > uploadCsvToS3 > startImportJob.

[aBurmeseDev]

Can you share your code to help us understand the issue better?

[bk-harish]

@aBurmeseDev
I am also getting this error and still unable to resolve it.
Did you find any solution to this problem?

[zshzbh]

Hey @bk-harish,

The AWS SDK for JavaScript v2 has entered maintenance mode on September 8, 2024 and will be reaching end-of-support on September 8, 2025. During maintenance mode, AWS will limit SDK releases to address critical bug fixes and security issues only. The SDK will not receive API updates for new or existing services, or be updated to support new regions.

We recommend that you migrate to AWS SDK for JavaScript v3.

The AWS SDK for JavaScript v3 is the latest and recommended version, which has been GA since December 2020. Here is why and how you should use AWS SDK for JavaScript v3. You can try our migration scripts in aws-sdk-js-codemod to migrate your application from v2 to v3.

To get help with your migration, please follow our general guidelines to open an issue and choose guidance. To give feedback on and report issues in the v3 repo, please refer to Giving feedback and contributing.

If you are facing this issue in js sdk v3, please open a ticket in https://github.com/aws/aws-sdk-js-v3.