Pre-signed url generated by S3Presigner not working

[afjlee]

When I use aws CLI (aws s3 presign s3://{bucket-name}/{object-key}) to generate PreSigned url, the output is: "https://s3.us-east-1.amazonaws.com/{bucket-name}/{object-key}?X-Amz-Security-Token={other info}".
Accessing this presigned URL from browser works OK.

When I use S3Presigner with Java (https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/s3/presigner/S3Presigner.html) to generate PreSigned url, the output is in format of "https://s3.amazonaws.com/{bucket-name}/{object-key}?X-Amz-Security-Token={other info}".

Accessing this generated url from browser returns below error:
<Error> <Code>SignatureDoesNotMatch</Code> <Message> The request signature we calculated does not match the signature you provided. Check your key and signing method. </Message> <AWSAccessKeyId>...

What was wrong with S3Presigner generated presigned url in Java? Does it matter that Java generated url doesn't have region in host name?

Thanks for any help!

[afjlee]

After closer examination, it looks like token content is missing from presigned url from Java. Not sure whether it is due to local user is using 2FA and assuming roles.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[kgignatyev]

have same issue

[debora-ito]

@kgignatyev

s3.amazonaws.com is a legacy global endpoint. Requests made with the legacy global endpoint go to us-east-1 by default.

If your bucket is in us-east-1, using s3.amazonaws.com or s3.us-east-1.amazonaws.com should work the same.