Jmeter sometimes failing with a 403 error

Question

I am new to Jmeter; I have only been using it for two weeks, and am running into some issues with a test I have created.

The test is designed to hit a lambda in AWS to generate a pre-sign URL via an API call, which is required for placing an object into a S3 bucket, for this to be successful, a signature is required.

Below is the Jmeter test:

Bzm - Concurrency Thread Group:

User Defined Variables

HTTP Header Manager

Jp@gc- throughput shaping timer

HTTP request:

JSR223 PreProcessor (Generate a random guid for the object)

JSR223 PreProcessor (Generates the required signature)

I am using the above to perform the following load testing, start with a baseline of 1 request per second and every 20 minutes increase the request per second to 30 for two minutes, then return to 1 request per second, this cycle repeats over a 2-hour period.

This test is running across 10 fargate tasks, so the total number of requests, which should be hitting the lambda, is 10 request per second at the baseline and 300 request per second during the burst.

My problem is that when I get to my third burst in the cycle my test is returning a 403 error, when checking Jmeter this reports the following for the 403 error ‘Signature expired is now earlier than’ message.

I am unclear of the reason to why my request suddenly start to fail with this error after successfully running for an hour. The only information I have been able to find relating to the root cause of this was a clock skew issue; however as the test run successfully for an hour before this happens and everything is being hosted in AWS I don’t believe this a clock skew issue and if it is how I resolve this.

Has anyone else run into similar problems?

Dmitri T Dmitri T · Accepted Answer · 2019-07-01T09:45:12

As per Authenticating Requests (AWS Signature Version 4) article:

Protect against reuse of the signed portions of the request – The signed portions (using AWS Signatures) of requests are valid within 15 minutes of the timestamp in the request. An unauthorized party who has access to a signed request can modify the unsigned portions of the request without affecting the request's validity in the 15 minute window. Because of this, we recommend that you maximize protection by signing request headers and body, making HTTPS requests to Amazon S3, and by using the s3:x-amz-content-sha256 condition key (see Amazon S3 Signature Version 4 Authentication Specific Policy Keys) in AWS policies to require users to sign S3 request bodies.

So you need to check the timestamp field of your request and compare it to the current time on the machine.

Also be aware that you can create a GUID using __UUID() function so no need to write custom code.

Make sure to use Groovy language and tick Cache compiled script if available box and avoid inlining of JMeter functions or variables into your script body.

You can see an example of generating an AWS signature in How to Handle Dynamic AWS SigV4 in JMeter for API Testing article

Jmeter sometimes failing with a 403 error

1 Answers