`Upload` from '@aws-sdk/lib-storage' doesn't work with multiupload SHA256 checksum

[mat-styler]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

I was working on the simple S3 upload feature using AWS SDK v3 (@aws-sdk/lib-storage).

1. I started with the '@aws-sdk/lib-storage@v3.901.0'
2. Using import { Upload } from '@aws-sdk/lib-storage' I added trigger for a simple multipart upload.

new Upload({
        client: s3Client,
        params: {
            Bucket: bucketName,
            Key: uploadFile.objectKey,
            Body: uploadFile.file,
            ChecksumAlgorithm: ChecksumAlgorithm.SHA256, // I want to see SHA256 checksum in the s3, in the uploaded file details view
        },
        // Upload configuration options
        partSize: MULTIPART_CHECKSUM_SIZE, // 8MB
        queueSize: 1, // one multipart at a time
    });

Unfortunately, using latest package version the upload never works end ends with error:

<Error>
<Code>
InvalidRequest
</Code>
<Message>
The upload was created using a sha256 checksum. The complete request must include the checksum for each part. It was missing for part 1 in the request.
</Message>
<RequestId>
6R9SCSQRBRGRCJZD
</RequestId>
<HostId>
V603PDxU2OHQU8pAaZCNpxRZ0EQCHmMJUBfvNZqfTytrlirIDF4ATG81vFDlabXoqsK4jea69xiQVCEdl8ftKFu++RXr+tfhP6s37oQbHBw=
</HostId>
</Error>

As long as the file is small enough to upload, it is working. If the file require more than one part I always see error:

So I reverted to @aws-sdk/lib-storage@v3.899.0 and it's better now.

As long as the file is small enough to upload, it is working. But multiupload always fails with a missing checksum in the first part, even if it is included:

<Code>
InvalidRequest
</Code>
<Message>
The upload was created using a sha256 checksum. The complete request must include the checksum for each part. It was missing for part 1 in the request.
</Message>
<RequestId>
6R9SCSQRBRGRCJZD
</RequestId>
<HostId>
V603PDxU2OHQU8pAaZCNpxRZ0EQCHmMJUBfvNZqfTytrlirIDF4ATG81vFDlabXoqsK4jea69xiQVCEdl8ftKFu++RXr+tfhP6s37oQbHBw=
</HostId>
</Error>

Even if the checksum is included in the request:

x-amz-checksum-sha256
AC4CTL/a17JqbZWfNnGqbpDEwDEVm7dtQCEq08I32dM=
x-amz-content-sha256
002e024cbfdad7b26a6d959f3671aa6e90c4c031159bb76d40212ad3c237d9d3
x-amz-date
20251003T094243Z
x-amz-sdk-checksum-algorithm
SHA256

So the multipart upload with SHA256 checksum is not working either way.

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/lib-storage@v3.901.0

Which JavaScript Runtime is this issue in?

Browser

Details of the browser/Node.js/ReactNative version

v20.18.0

Reproduction Steps

1. Install '@aws-sdk/lib-storage@latest'
2. Import import { Upload } from '@aws-sdk/lib-storage'
3. Try to trigger multipart upload with SHA256 checksum

new Upload({
        client: s3Client,
        params: {
            Bucket: bucketName,
            Key: uploadFile.objectKey,
            Body: uploadFile.file,
            ChecksumAlgorithm: ChecksumAlgorithm.SHA256, // I want to see SHA256 checksum in the s3, in the uploaded file details view
        },
        // Upload configuration options
        partSize: MULTIPART_CHECKSUM_SIZE, // 8MB
        queueSize: 1, // one multipart at a time
    });

Observed Behavior

Upload never works end ends with error:

<Error>
<Code>
InvalidRequest
</Code>
<Message>
The upload was created using a sha256 checksum. The complete request must include the checksum for each part. It was missing for part 1 in the request.
</Message>
<RequestId>
6R9SCSQRBRGRCJZD
</RequestId>
<HostId>
V603PDxU2OHQU8pAaZCNpxRZ0EQCHmMJUBfvNZqfTytrlirIDF4ATG81vFDlabXoqsK4jea69xiQVCEdl8ftKFu++RXr+tfhP6s37oQbHBw=
</HostId>
</Error>

As long as the file is small enough to upload, it is working. If the file require more than one part I always see error:

So I reverted to @aws-sdk/lib-storage@v3.899.0 and it's better now.

As long as the file is small enough to upload, it is working. But multiupload always fails with a missing checksum in the first part, even if it is included:

<Code>
InvalidRequest
</Code>
<Message>
The upload was created using a sha256 checksum. The complete request must include the checksum for each part. It was missing for part 1 in the request.
</Message>
<RequestId>
6R9SCSQRBRGRCJZD
</RequestId>
<HostId>
V603PDxU2OHQU8pAaZCNpxRZ0EQCHmMJUBfvNZqfTytrlirIDF4ATG81vFDlabXoqsK4jea69xiQVCEdl8ftKFu++RXr+tfhP6s37oQbHBw=
</HostId>
</Error>

Even if the checksum is included in the request:

x-amz-checksum-sha256
AC4CTL/a17JqbZWfNnGqbpDEwDEVm7dtQCEq08I32dM=
x-amz-content-sha256
002e024cbfdad7b26a6d959f3671aa6e90c4c031159bb76d40212ad3c237d9d3
x-amz-date
20251003T094243Z
x-amz-sdk-checksum-algorithm
SHA256

So the multipart upload with SHA256 checksum is not working either way.

Expected Behavior

Successfully complete multipart upload with SHA256 integrity check using { Upload } from '@aws-sdk/lib-storage

Possible Solution

No response

Additional Information/Context

No response

[aBurmeseDev]

Hi @mat-styler - thanks for reaching out and sorry to hear about the issue.

Can you try adding this requestChecksumCalculation: "WHEN_REQUIRED" to your S3 Client instantiation?

const client = new S3Client({
  region: "REGION",
  credentials: {},
  requestChecksumCalculation: "WHEN_REQUIRED",
});

[mat-styler]

Hi @mat-styler - thanks for reaching out and sorry to hear about the issue.

Can you try adding this requestChecksumCalculation: "WHEN_REQUIRED" to your S3 Client instantiation?

const client = new S3Client({
region: "REGION",
credentials: {},
requestChecksumCalculation: "WHEN_REQUIRED",
});

Hi @aBurmeseDev, thank you for the answer. The problem is it is required iny my case. I can see the problem exist only with specific version of package and "Composite" checksum. But what I need to achieve is to use SHA256 checksum in multipart upload which is not woring unfortunately.

[aBurmeseDev]

The reason that I suggested adding requestChecksumCalculation: "WHEN_REQUIRED" is due to when S3 enabled default integrity protection back in January. It's worth a try if you haven't already.

Another suggestion I have is to enable CORS policy with ExposeHeaders with checksum type:

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "PUT",
            "POST",
            "DELETE",
            "GET"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": [
            "x-amz-checksum-sha256"
        ]
    }
]

[mat-styler]

The reason that I suggested adding requestChecksumCalculation: "WHEN_REQUIRED" is due to when S3 enabled default integrity protection back in January. It's worth a try if you haven't already.

Another suggestion I have is to enable CORS policy with ExposeHeaders with checksum type:

[
{
"AllowedHeaders": [
""
],
"AllowedMethods": [
"PUT",
"POST",
"DELETE",
"GET"
],
"AllowedOrigins": [
""
],
"ExposeHeaders": [
"x-amz-checksum-sha256"
]
}
]

Unfortunately non of these solution are helping. The problem is AWS ASK v3 doesn't work as expected with the composite checksum and SHA256 is composite, not a full object checksum.

Just to make sure, how you do include these CORS policies in S3Client?

[aBurmeseDev]

There are a few ways to enable and configure CORS policy, see here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/enabling-cors-examples.html