URL Generated by AWS Presign function does not work - amazon-web-services

Question

Whenever I try to generate a Presign URL using AWS API I get something like this:
https://{OBJECT_PATH}?X-Amz-Algorithm=AWS4-HMAC-SHA256\\u0026X-Amz-Credential=AKIAJMALZY6GKVGFVOCQ%2F20191003%2Fus-east-1%2Fs3%2Faws4_request\\u0026X-Amz-Date=20191003T111419Z\\u0026X-Amz-Expires=300\\u0026X-Amz-SignedHeaders=host\\u0026X-Amz-Signature=c72a66c249fe2dada4c3925388efc62cbc734c84e01ffbf4748a5f6be9a99026\
When I try to enter it, I get the following message:
<Error>
<Code>AuthorizationQueryParametersError</Code>
<Message>X-Amz-Algorithm only supports "AWS4-HMAC-SHA256"</Message
<RequestId>7236615A79C34A4B</RequestId>
<HostId>PHoX1otuX6apJrXRTOMM/8GvgiajrNPdElrnfSzAZCzpLzMG8NFu9RIJEiyEYHWAls91n882QNE=</HostId>
</Error>
I tried to replace \\u0026 with & because I saw on documentation (https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html) that this is how presign URL should be structured, I get:
<Error>
<Code>SignatureDoesNotMatch</Code>
<Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>
<AWSAccessKeyId>AKIAJMALZY6GKVGFVOCQ</AWSAccessKeyId>
<StringToSign>AWS4-HMAC-SHA256
20191003T112220Z
20191003/us-east-1/s3/aws4_request
a1d8f89ff0472249afb8f1320314eef950bcef423f05fe98420f53cc7f7d8e8f</StringToSign>
<SignatureProvided>a1b2b7080c67e6456cbd2ab678565e5f3857483378e69ca03e35cc83232b2844\</SignatureProvided>
<StringToSignBytes>{SEQUENCE_OF_BYTES}</StringToSignBytes>
<CanonicalRequest>GET/{OBJECT_KEY}?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJMALZY6GKVGFVOCQ%2F20191003%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20191003T112220Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host host:{BUCKET_NAME} host UNSIGNED-PAYLOAD</CanonicalRequest>
<CanonicalRequestBytes>{SEQUENCE_OF_BYTES}</CanonicalRequestBytes>
<RequestId>F3A0303ADD62D8FD</RequestId
<HostId>yU7FdXLoEO+j+KpZtQH1YjF6l3RnVugBi6rzCRJOgVYk7FEQqreobMuFdSiYtzIKUgl0Qr2GcAQ=</HostId>
</Error>
Finally, here is the code I use in order to generate these URLs:
var accessableURLs []string
for _, fileName := range fileNames {
objectKey := filepath.Join(fileDir, fileName)
req, _ := s3Obj.Client.GetObjectRequest(&s3.GetObjectInput{
Bucket: aws.String(s3Obj.Bucket),
Key: aws.String(objectKey),
})
urlStr, err := req.Presign(expireAfter)
if err != nil {
glog.Errorf("Failed during generating pre-signed S3 url, reason -%v ", err)
return nil, err
}
accessableURLs = append(accessableURLs, urlStr)
}

Answer 1

The following works with the v1 aws sdk. I'm not sure why your solution fails:
package main
import (
"fmt"
"time"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/session"
"github.com/aws/aws-sdk-go/service/s3"
)
func main() {
MyBucketName := "myAwesomeBucket"
MyKeyName := "/path/filename.txt"
days := 5
session, err := session.NewSession(&aws.Config{
Region: aws.String("us-east-1")},
)
s := s3.New(session)
r, _ := s.GetObjectRequest(&s3.GetObjectInput{
Bucket: aws.String(MyBucketName),
Key: aws.String(MyKeyName),
})
url, err := r.Presign(time.Duration(days) * 24 * time.Hour)
if err != nil {
fmt.Println("failure")
}
fmt.Println(url)
}
One thing to note is that the IAM creds used to sign the url must be valid for as long as the signed url is intended to be valid for. This ends up being an issue with ec2 machines that use temporary creds. A workaround is for the application to have a permanent IAM cred that it uses to sign the url with.