api - 我是 API 新手，我正在尝试使用 Shell 脚本中的 curl 发布 AWS API Gateway 请求

Question

我是 API 新手，我正在尝试使用 Shell 脚本中的 curl 发布 AWS API Gateway 的请求。

没有 IAM_AUTH 脚本很好，但是当我尝试使用 AWS Signature V4 连接时，它失败并出现错误“x-amzn-errortype: InvalidSignatureException”。我创建了一个 shell 脚本来在 curl 中创建授权标头。

#!/bin/bash -x

AWS_ACCESS_KEY_ID=ID  
AWS_SECRET_ACCESS_KEY=KEY


method=POST  
service=execute-api  
host=execute-api.ca-central-1.amazonaws.com  
region=ca-central-1  
endpoint=https://${host}/  
contentType=application/json  
amazonTarget=""  
amazonDate="$(date --utc +'%Y%m%dT%H%M%SZ')"  
dateStamp="$(date --utc +'%Y%m%d')"  


key="${AWS_SECRET_ACCESS_KEY}"  
hex=`echo -ne "AWS4${key}" | hexdump | sed -e 's/^[0-9a-f]*//' -e 's/ //g' | tr -d '\n'`





dateStamp1="${dateStamp}"  
regionName="${region}"  
serviceName="${service}"  


kDate1=`echo -ne "${dateStamp1}" | openssl dgst -sha256 -mac hmac -macopt "hexkey:$hex"`  
kDate=${kDate1#*= }  
echo $kDate  
kRegion1=`echo -ne "${regionName}" | openssl dgst -sha256 -mac hmac -macopt "hexkey:$kDate"`  
kRegion=${kRegion1#*= }  
echo $kRegion  
kService1=`echo -ne "${serviceName}" | openssl dgst -sha256 -mac hmac -macopt "hexkey:$kRegion"`  
kService=${kService1#*= }  
kSigning1=`echo -ne "aws4_request" | openssl dgst -sha256 -mac hmac -macopt "hexkey:$kService"`  
kSigning=${kSigning1#*= }  
getSignatureKey="${kSigning}"  

# --- TASK 1: create canonical request ---

canonicalUri="<AWS_API_ID>.execute-api.ca-central-1.amazonaws.com/prod"  
canonicalQueryString=""  
canonicalHeaders="content-type:${contentType}\nhost:${host}\nx-amz-date:${amazonDate}\nx-amz-target:${amazonTarget}\n"  
signedHeaders="content-type;host;x-amz-date;x-amz-target"  
#payloadHash="$(sha256 "${requestParameters}")"  

canonicalRequest="${method}\n${canonicalUri}\n${canonicalQueryString}\n${canonicalHeaders}\n${signedHeaders}\n${payloadHash}"  
sha2561=`echo -ne "$canonicalRequest" | openssl dgst -sha256 -hex`  
sha256=${sha2561#*= }  

# --- TASK 2: create the string to sign ---

algorithm="AWS4-HMAC-SHA256"  
credentialScope="${dateStamp}/${region}/${service}/aws4_request"  

stringToSign="${algorithm}\n${amazonDate}\n${credentialScope}\n${sha256}"  

# --- TASK 3: calculate the signature ---  

signingKey="$getSignatureKey "${AWS_SECRET_ACCESS_KEY}" "${dateStamp}" "${region}" "${service}""  

signature=`echo -ne "${stringToSign}" | openssl dgst -sha256 -hmac -hex -macopt "hexkey:$signingKey" -out /tmp/test.txt /bin/ps`  
signature=`cat /tmp/test.txt`  
signature=${signature#*= }  

# --- TASK 4: add signing information to the request ---  

authorizationHeader="${algorithm} Credential=${AWS_ACCESS_KEY_ID}/${credentialScope},  
 SignedHeaders=${signedHeaders}, Signature=${signature}"

# --- SEND REQUEST ---
CURL="curl --location --request POST 'https://<AWS_API_ID>.execute-api.ca-central-1.amazonaws.com/prod/ingest' --header 'X-Amz-Date:$amazonDate' --header "Authorization:$authorizationHeader' --data 'Hello, from your terminal!'"
--data 'Hello, from your terminal!'"  

`$CURL`

标签： apiaws-api-gateway