AWS AmazonS3 low security documentation change
Summary
Added content type specification and region configuration to presigned URL generation examples. Enhanced troubleshooting guidance for signature mismatches.
Security assessment
The change enforces content type matching between URL generation and upload requests, which prevents potential signature mismatches that could lead to upload failures or security issues. The troubleshooting section explicitly addresses SignatureDoesNotMatch errors caused by security-sensitive factors like time synchronization and region configuration. While not fixing a specific vulnerability, these changes document security-adjacent best practices for presigned URL usage.
Diff
diff --git a/AmazonS3/latest/userguide/PresignedUrlUploadObject.md b/AmazonS3/latest/userguide/PresignedUrlUploadObject.md index 9eba0937f..41873dee5 100644 --- a//AmazonS3/latest/userguide/PresignedUrlUploadObject.md +++ b//AmazonS3/latest/userguide/PresignedUrlUploadObject.md @@ -87,0 +88,6 @@ The following Python script generates a `PUT` presigned URL for uploading an obj + parser.add_argument( + "--region", help="The AWS region where the bucket is located.", default="us-east-1" + ) + parser.add_argument( + "--content-type", help="The content type of the file to upload.", default="application/octet-stream" + ) @@ -90,2 +96,5 @@ The following Python script generates a `PUT` presigned URL for uploading an obj - # By default, this will use credentials from ~/.aws/credentials - s3_client = boto3.client("s3") + # Create S3 client with explicit region configuration + s3_client = boto3.client("s3", region_name=args.region) + + # Optionally set signature version if needed for older S3 regions + # s3_client.meta.config.signature_version = 's3v4' @@ -97 +106,5 @@ The following Python script generates a `PUT` presigned URL for uploading an obj - {"Bucket": args.bucket, "Key": args.key}, + { + "Bucket": args.bucket, + "Key": args.key, + "ContentType": args.content_type # Specify content type + }, @@ -109 +122 @@ The following command uses example values. Replace the `user input placeholders` - python put-only-url.py amzn-s3-demo-bucket <object-path> + python put-only-url.py amzn-s3-demo-bucket <object-path> --region us-east-1 --content-type application/octet-stream @@ -115 +128 @@ The script will output a `PUT` presigned URL: - 3. You can now upload the file using the generated presigned URL with curl: + 3. You can now upload the file using the generated presigned URL with curl. Make sure to include the same content type that was used when generating the URL: @@ -117 +130,3 @@ The script will output a `PUT` presigned URL: - curl -X PUT -T "path/to/your/local/file" "generated-presigned-url" + curl -X PUT -T "path/to/your/local/file" -H "Content-Type: application/octet-stream" "generated-presigned-url" + +If you specified a different content type when generating the URL, make sure to use that same content type in the curl command. @@ -123,0 +139,19 @@ For more examples of using the AWS SDKs to generate a presigned URL for uploadin +###### Troubleshooting SignatureDoesNotMatch errors + +If you encounter a `SignatureDoesNotMatch` error when using presigned URLs, check the following: + + * Verify your system time is synchronized with a reliable time server + + * Ensure you're using the URL exactly as generated, without any modifications + + * Check if the URL has expired and generate a new one if needed + + * Make sure the content type in your upload request matches the content type specified when generating the URL + + * Confirm you're using the correct region for the bucket + + * When using curl, enclose the URL in quotes to properly handle special characters + + + +