Google cloud storage Interoperability with S3 interface failed with SignatureDoesnotmatch

1
votes

Basically, i try to test GET call to access the bucket ACL by HTTPS url using Developer Keys from S3 browser. Here is the url: https://mybucket1.storage.googleapis.com/?acl

But I am getting following error:

SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. 
Check your Google secret key and signing method. TaskID: 108

I just following the simple migration process from S3 to GCS found here but I am still facing issues. Can any one of you explain why the above steps are not working with S3 browser? The above link says it will work. To make it work, should I change any HTTP/custom headers here?

Below is my GET call

GET /?acl HTTP/1.1

 Host: mybucket1.storage.googleapis.com

 User-Agent: curl/7.55.1

 Accept: */*

 Authorization: AWS4-HMAC-SHA256 
Credential=GOOGCMZOMXVFOS2EJ4PUP7YR/20190531/us-east1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=5e3c9d4df679b0ea847ff2216842d34ea43c1366e67d6d36b338e59b3c515f73

 x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

 x-amz-date: 20190531T042146Z
1
google-cloud-storage
That error message should be immediately followed by a <StringToSign> section that includes the full content of what was signed by the server to verify your signature. Please take a look at it and make sure there's nothing surprising there. - Brandon Yarbrough
Hi Lakshmikantha, as asked by Brandon, is there a <StringToSign> value in the error response? It will help us debug your issue. - Frank Natividad
ErrMsg: <?xml version='1.0' encoding='UTF-8'?><Error><Code>SignatureDoesNotMatch</Code><Message>The request signature we calculated does not match the signature you provided. Check your Google secret key and signing method.</Message><StringToSign>AWS4-HMAC-SHA25620190531T092930Z20190531/us-east1/s3/aws4_request401997af89a550b9cf7b215edb141f72a15bcc3707dbc13f49088690de958618</StringToSign><CanonicalRequest>GET/mybucket1/acl=host:storage.googleapis.comx-amz-content-sha256:UNSIGNED-PAYLOADx-amz-date:20190531T092930Zhost;x-amz-content-sha256;x-amz-dateUNSIGNED-PAYLOAD</CanonicalRequest></Error> - Lakshmikantha Reddy
Sorry for late response. - Lakshmikantha Reddy
The same GET request works, if I use X-GOOG* headers in Authorization Header. - Lakshmikantha Reddy

1 Answers

0
votes

In your call you still using the AWS keys, you need to replace your Authorization header according this doc Authenticating in a simple migration scenario