I have to invoke a webservice of our client. I have the end URL and the secret key. I passed the secret key in the header section. I invoked the webservice. Response from the
service is "Your Authorization secret was not set" and response status is "400 Bad Request". So I strongly suspect that syntax is an issue. I only have the end url
and the secret key. So I tried passing secret key in header section and parameters section but I am getting the same response.
Client has given an example of how to do this on shell script.
(Key and URL are changed for privacy)
*curl -s --data-urlencode 'secret_key=nJ2RoMRYKzBVQz0AAn1Gvnw5Zb41PE0Wgf4buXKYh9t7ebicC9P1L1Spxx911Rbj4khhhhhhhhhhhgfddssreser'
'https://xyz.corp.yyyy.com/aws/api/getAWSCreds.php?userId=xyz&request=xyz'*
So I executed it on power shell and the response is:
*vphp?userId=isoauto&request=getRoleCreds'
Invoke-WebRequest : A positional parameter cannot be found that accepts argument
'https://xyz.corp.yyyy.com/aws/api/getAWSCreds.php?userId=xyz&request=xyz'
At line:1 char:1
+ curl -s --data-urlencode 'secret_key=nJ2RoMRYKzBVQz0AAn1Gvnw5Zb41PE0Wgf4buXKY...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Invoke-WebRequest], ParameterBindingException
+ FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell.Commands.InvokeWebRequestCommand*
How to fix this?
Related
I have an GET based API gateway set up pointing to a Lambda with Lambda Proxy integration enabled
The API has AWS IAM as the auth method.
On my local, I have AWS Auth setup with temp session token
The following works without issue
curl -s GET "https://<ID>.execute-api.us-west-2.amazonaws.com/dev" \
--header "x-amz-security-token: ${SESSION_TOKEN}" \
--user $ACCESS_KEY:$SECRET_KEY \
--aws-sigv4 "aws:amz:us-west-2:execute-api" | jq .
But when I add query params to the url, it fails
curl -s GET "https://<ID>.execute-api.us-west-2.amazonaws.com/dev?a=${v1}&b=${v2}" \
--header "x-amz-security-token: ${SESSION_TOKEN}" \
--user $ACCESS_KEY:$SECRET_KEY \
--aws-sigv4 "aws:amz:us-west-2:execute-api" | jq .
This is the response that I get is
{
"message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'GET\n/dev\nb=def&a=abc\nhost:<ID>.execute-api.us-west-2.amazonaws.com\nx-amz-date:20230104T112344Z\n\nhost;x-amz-date\<date-token>'\n\nThe String-to-Sign should have been\n'AWS4-HMAC-SHA256\n20230104T112344Z\n20230104/us-west-2/execute-api/aws4_request\<token>'\n"
}
Looks like I need to add the query params part to the signature part. How do I do that ? Or is there something else that I'm missing ?
I'm running the below command to connect to vCloud Director using PowerShell
Connect-CIServer -Server "company.com.au" -User "username" -Password "password" -Org "testorg"
However, it is giving me error like below:
Connect-CIServer : 20/09/2019 2:13:12 PM Connect-CIServer
Unable to connect to vCloud Server 'https://company.com.au:443/api/'. The
server returned the following: Unauthorized: ''.
At line:1 char:1
+ Connect-CIServer -Server "company.com.au" -User "username" -Pas ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Connect-CIServer], CIException
+ FullyQualifiedErrorId : Cloud_ConnectivityServiceImpl_ConnectCloudServer_ConnectError,VMware.VimAutomation.Cloud.Commands.Cmdlets.ConnectCIServer
Unfortunately, not much information is given, I can login to the UI by the same credentials but not on command line?
I had similar issue when I was trying to login to VCentre, I got it working by ignoring certificates. Not sure if for VCloud Server,I am facing same issue?
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false
Works well when I drop -Org parameter! so the command which worked for me to login to Cloud Director is as below:
Connect-CIServer -Server "company.com.au" -User "username" -Password "password"
I am trying to create a bash script to upload files to my s3 bucket. I am having difficulty generating the correct signature.
I get the following error message:
The request signature we calculated does not match the signature you provided. Check your key and signing method.
Here is my script:
Thanks for your help!
#!/usr/bin/env bash
#upload to S3 bucket
sourceFilePath="$1"
#file path at S3
folderPathAtS3="packages";
#S3 bucket region
region="eu-central-1"
#S3 bucket name
bucket="my-bucket-name";
#S3 HTTP Resource URL for your file
resource="/${bucket}/${folderPathAtS3}";
#set content type
contentType="gzip";
#get date as RFC 7231 format
dateValue="$(date +'%a, %d %b %Y %H:%M:%S %z')"
acl="x-amz-acl:private"
#String to generate signature
stringToSign="PUT\n\n${contentType}\n${dateValue}\n${acl}\n${resource}";
#S3 key
s3Key="my-key";
#S3 secret
s3Secret="my-secret-code";
#Generate signature, Amazon re-calculates the signature and compares if it matches the one that was contained in your request. That way the secret access key never needs to be transmitted over the network.
signature=$(echo -en "${stringToSign}" | openssl sha1 -hmac ${s3Secret} -binary | base64);
#Curl to make PUT request.
curl -L -X PUT -T "${sourceFilePath}" \
-H "Host: ${bucket}.${region}.amazonaws.com" \
-H "Date: ${dateValue}" \
-H "Content-Type: ${contentType}" \
-H "$acl" \
-H "Authorization: AWS ${s3Key}:${signature}" \
https://s3.amazonaws.com/${bucket}/${folderPathAtS3}
Your signature seems fine, but your request is wrong and consequently does not match.
-H "Host: ${bucket}.${region}.amazonaws.com" \ is incorrect.
The correct value is ${bucket}.s3 ${region}.amazonaws.com. You're overlooking the s3. in the hostname... but even if correct, this is still invalidj because your URL https://s3.amazonaws.com/${bucket}/... also includes the bucket, which means your bucket name is being implicitly added to the beginning of the object key because it appears twice.
Additionally, https://s3.amazonaws.com is us-east-1. To connect to the correct region, your URL needs to be one of these variants:
https://${region}.s3.amazonaws.com/${bucket}/${folderPathAtS3}
https://${bucket}.${region}.s3.amazonaws.com/${folderPathAtS3}
https://${bucket}.s3.amazonaws.com/${folderPathAtS3}
Use one of these formats, and eliminate -H "Host: ..." because it will then be redundant.
The last of the 3 URL formats will only start to work after the bucket is more than a few minutes or hours old. S3 creates these automatically but it takes some time.
Curl successfully uploads the file to S3 using a signed url:
curl -v -k -X PUT \
-H "x-amz-server-side-encryption: AES256" \
-H "Content-Type: application/pdf" \
-T "__tests__/resources/test.pdf" \
"http://mybucket.s3.amazonaws.com/test.pdf?AWSAccessKeyId=IDKEY&Expires=1489458783&Signature=SIGNATURE
I've tried replicating this in Grails using the REST client plugin:
String url = "http://mybucket.s3.amazonaws.com/test.pdf?AWSAccessKeyId=IDKEY&Expires=1489458783&Signature=SIGNATURE"
RestResponse resp = rest.put(url){
header "x-amz-server-side-encryption", "AES256"
header "Content-Type", "application/pdf"
body pdf
}
But Amazon rejects the upload, saying the arguments are incorrect...probably due to the pdf being sent as a "body" parameter. Any ideas?
Instead of using a rest client to upload it would be simpler to use the AWS Java SDK in your Grails app.
See an example here of using a pre-signed url to upload http://docs.aws.amazon.com/AmazonS3/latest/dev/PresignedUrlUploadObjectJavaSDK.html
I'm using this kind of URI to remotely stop my instances:
.to("aws-ec2://stopInstances?operation=stopInstances" +
"&accessKey=" + accessKey +
"&secretKey=" + secretKey)
secretKey contains + sign. I've found that I should encode + sign as it's treated as space. Tried w/ and w/o encoding and still getting:
AWS was not able to validate the provided access credentials (Service: AmazonEC2; Status Code: 401; Error Code: AuthFailure; Request ID: XXXXX)
Anyone have some suggestions?
IMPORTANT Dates on both client and server are NTP synchronized.
Solved through using:
...
.to("aws-ec2://stopInstances?operation=stopInstances&amazonEc2Client=#ec2Client")
...
and
AmazonEC2Client amazonEC2Client = new AmazonEC2Client(new BasicAWSCredentials(accessKey, secretKey));
amazonEC2Client.setEndpoint("ec2.us-east-1.amazonaws.com");
main.bind("ec2Client", amazonEC2Client);