bash - 如何在 bash 中生成 aws4 签名请求？

Question

我正在尝试连接到 bash 中的 Scaleway S3 api（它是aws s3 api的子集）。签名模型是 aws4_request，并记录在. 在下面的代码中，我正在上传一个文件。我已经查看了每一行，虽然我不是 bash 专家，但我非常有信心我拥有计算正确签名的所有正确部分，但我仍然收到 403 错误作为响应。据我在wireshark捕获中看到的，请求本身似乎很好。任何人都可以在这里找到任何问题吗？

    #!/bin/bash
    set -e

    echo "creds $SCW_ACCESS_KEY/$SCW_SECRET_KEY"

    BUCKET="vni-backups"
    REGION="fr-par"
    HOST="$BUCKET.s3.$REGION.scw.cloud"

    filepath="../import.yml"
    file_sha256=$(sha256sum -b $filepath | head -c64)

    fulldate=$(date +"%Y%m%dT%H%M%SZ" --utc)
    shortdate=$(date +"%Y%m%d" --utc)

    # Assemble canonical url
    canonicalRequest="PUT
    /import.yml

    content-type:text/plain
    host:$HOST
    x-amz-content-sha256:$file_sha256
    x-amz-date:$fulldate
    content-type;host;x-amz-content-sha256;x-amz-date
    $file_sha256"

    canonReqSha=$(echo -n "$canonicalRequest" | openssl dgst -sha256 | awk '{print $2}')

    echo $canonicalRequest
    echo "requestHash: $canonReqSha"

    echo "
    ---------------------------------------
    "

    stringToSign="AWS4-HMAC-SHA256
    $fulldate
    $shortdate/fr-par/s3/aws4_request
    $canonReqSha"

    echo $stringToSign

    dateKey=$(echo -n "$shortdate" | openssl dgst -sha256 -binary -hmac "AWS4$SCW_SECRET_KEY")
    regionKey=$(echo -n "fr-par" | openssl dgst -sha256 -binary -hmac "$dateKey")
    serviceKey=$(echo -n "s3" | openssl dgst -sha256 -binary -hmac "$regionKey")
    signingKey=$(echo -n "aws4_request" | openssl dgst -sha256 -binary -hmac "$serviceKey")

    signature=$(echo -n "$stringToSign" | openssl dgst -sha256 -hmac "$signingKey" | awk '{print $2}')
    echo "signature: $signature"


    echo "
    ---------------------------------------
    "
    # Make request

    curl -X PUT \
     -H "Content-Type: text/plain" \
     -H "x-amz-content-sha256: $file_sha256" \
     -H "x-amz-date: $fulldate" \
     -H "Authorization: AWS4-HMAC-SHA256" \
     -H "Credential: $SCW_ACCESS_KEY/${shortdate}/$REGION/s3/aws4_request" \
     -H "SignedHeaders: content-type;host;x-amz-content-sha256;x-amz-date" \
     -H "Signature: $signature" \
     --data-binary @../import.yml \
     "http://$BUCKET.s3.$REGION.scw.cloud/import.yml"

请求以明文 http 完成只是因为使用网络分析工具（例如，wireshark）比 https 更容易捕获它。

标签： bashhttpauthenticationamazon-s3