s3 put_object SignatureDoesNotMatch even though most of the time it succeeds

[Jun711]

Describe the bug

I noticed this error in my lambda Cloudwatch log. Most of the time, it can uploads successfully to an S3 bucket. AWS configuration is managed by AWS Lambda so signature shouldn't be incorrect.

This is the error message. Did the signature expire?

An error occurred (SignatureDoesNotMatch) when calling the PutObject operation: 
The request signature we calculated does not match the signature you provided. 
Check your key and signing method.

This shows the total number of requests

This shows the number of requests that failed

Code that I used to upload

import boto3

class S3Utils():
    s3Client = boto3.client('s3')
    
    def put_object(key, body, filename, acl):
        contentDisposition = 'attachment; filename=\"' + filename + '.txt\"'
        try:
             S3Utils.s3Client.put_object(
                            ACL=acl,
                            Body=body,
                            Bucket='myBucket',
                            Key=key,
                            ContentDisposition=contentDisposition
                        )
        except Exception as e:
            print('err ', e)

I am saving text in s3 as txt file. I am not sure if the put object body matters but this is one of them that failed. The body mainly consists of HTML paragraphs with some inline css class

<p><span nr-s="0" class="highlight-text">&nbsp;but due to ecological reasons most of this are</span></p>

Expected Behavior

I expect it to be able to upload successfully for every upload

Current Behavior

occasionally, it fails to upload with SignatureDoesNotMatch error

Reproduction Steps

I have this in lambda to upload text to an s3 bucket. It can upload to s3 successfully most of the time but it fails sometimes. Is it because the signature expired?

Can I set boto3 client as a static class variable?

import boto3

class S3Utils():
    s3Client = boto3.client('s3')
    
    def put_object(key, body, name=fileName, acl):
        contentDisposition = 'attachment; filename=\"' + name + '.txt\"'
        try:
             S3Utils.s3Client.put_object(
                            ACL=acl,
                            Body=body,
                            Bucket='myBucket',
                            Key=key,
                            ContentDisposition=contentDisposition
                        )
        except Exception as e:
            print('err ', e)

Possible Solution

No response

Additional Information/Context

No response

SDK version used

boto3 installed by aws lambda

Environment details (OS name and version, etc.)

python3.8

[tim-finnigan]

Hi @Jun711 thanks for reaching out. The SignatureDoesNotMatch error has come up in several prior issues. Have you tried looking through any of those?

[Jun711]

@tim-finnigan Thanks for replying. I forgot to add more information. It doesn't throw SignatureDoesNotMatch error anymore after I set the Content Type. Without setting the Content Type, it throws SignatureDoesNotMatch error sometimes. Do you know what the underlying issue is?

[tim-finnigan]

Hi @Jun711 I'm not aware of cases where setting Content Type causes a SignatureDoesNotMatch error. And I didn't see that mentioned in this AWS troubleshooting guide on signing errors either. What are you setting the Content Type to?

[Jun711]

@tim-finnigan I set the Content Type to 'text/plain' as my files are uploaded with .txt extension without any file headers.

    S3Utils.s3Client.put_object(
                ACL=acl,
                Body=body,
                Bucket='myBucket',
                Key=key,
                ContentDisposition=contentDisposition,
                ContentType='text/plain'
                )

[tim-finnigan]

Hi @Jun711 I haven't been able to reproduce this but I'm not sure if the ContentType is the issue here. Have you tried removing the ContentDisposition? I also saw some similar issues in other SDK repositories that may overlap here such as this one: https://github.com/aws/aws-sdk-js/issues/1703

It looks like you originally uploaded ~40k objects and received ~200 failed requests. Are those numbers relatively consistent in your other attempts? And can you confirm that all of the failed requests were due to SignatureDoesNotMatch errors?

[Jun711]

@tim-finnigan I haven't tried removing ContentDisposition but I had previously encountered ContentDisposition issue before as there were some characters which were not allowed to be in the filename and the error looked like this. It didn't cause SignatureDoesNotMatch error

Yes, all of them failed with SignatureDoesNotMatch as I filtered using that message. I will give it another test and see.

[tim-finnigan]

@Jun711 do you have any updates as far as what you've tried? Are you still encountering this issue?

[tim-finnigan]

Since we haven't heard back in a few weeks I'm going to close this issue. If you are still affected by this please refer to the comment above and follow up here. Thanks!