diff --git a/.changelog/39bec3d624bb499baf58012de54829f1.json b/.changelog/39bec3d624bb499baf58012de54829f1.json new file mode 100644 index 00000000000..2d340c95607 --- /dev/null +++ b/.changelog/39bec3d624bb499baf58012de54829f1.json @@ -0,0 +1,9 @@ +{ + "id": "39bec3d6-24bb-499b-af58-012de54829f1", + "type": "bugfix", + "description": "Do not sign Transfer-Encoding header in Sigv4[a]. Fixes a signer mismatch issue with S3 Accelerate.", + "modules": [ + ".", + "internal/v4a" + ] +} \ No newline at end of file diff --git a/aws/signer/internal/v4/headers.go b/aws/signer/internal/v4/headers.go index 734e548bd64..d99b32ceb07 100644 --- a/aws/signer/internal/v4/headers.go +++ b/aws/signer/internal/v4/headers.go @@ -4,10 +4,11 @@ package v4 var IgnoredHeaders = Rules{ ExcludeList{ MapRule{ - "Authorization": struct{}{}, - "User-Agent": struct{}{}, - "X-Amzn-Trace-Id": struct{}{}, - "Expect": struct{}{}, + "Authorization": struct{}{}, + "User-Agent": struct{}{}, + "X-Amzn-Trace-Id": struct{}{}, + "Expect": struct{}{}, + "Transfer-Encoding": struct{}{}, }, }, } diff --git a/aws/signer/v4/v4_test.go b/aws/signer/v4/v4_test.go index 44bfe86a145..738eb36e2cd 100644 --- a/aws/signer/v4/v4_test.go +++ b/aws/signer/v4/v4_test.go @@ -162,6 +162,11 @@ func TestPresignBodyWithArrayRequest(t *testing.T) { func TestSignRequest(t *testing.T) { req, body := buildRequest("dynamodb", "us-east-1", "{}") + // test ignored headers + req.Header.Set("User-Agent", "foo") + req.Header.Set("X-Amzn-Trace-Id", "bar") + req.Header.Set("Expect", "baz") + req.Header.Set("Transfer-Encoding", "qux") signer := NewSigner() err := signer.SignHTTP(context.Background(), testCredentials, req, body, "dynamodb", "us-east-1", time.Unix(0, 0)) if err != nil { diff --git a/internal/v4a/internal/v4/headers.go b/internal/v4a/internal/v4/headers.go index 3487dc3352d..688f834742c 100644 --- a/internal/v4a/internal/v4/headers.go +++ b/internal/v4a/internal/v4/headers.go @@ -4,9 +4,10 @@ package v4 var IgnoredHeaders = Rules{ DenyList{ MapRule{ - "Authorization": struct{}{}, - "User-Agent": struct{}{}, - "X-Amzn-Trace-Id": struct{}{}, + "Authorization": struct{}{}, + "User-Agent": struct{}{}, + "X-Amzn-Trace-Id": struct{}{}, + "Transfer-Encoding": struct{}{}, }, }, } diff --git a/internal/v4a/v4a_test.go b/internal/v4a/v4a_test.go index ea2f021e3d3..89ee836e629 100644 --- a/internal/v4a/v4a_test.go +++ b/internal/v4a/v4a_test.go @@ -57,6 +57,11 @@ func TestDeriveECDSAKeyPairFromSecret(t *testing.T) { func TestSignHTTP(t *testing.T) { req := buildRequest("dynamodb", "us-east-1") + // test ignored headers + req.Header.Set("User-Agent", "foo") + req.Header.Set("X-Amzn-Trace-Id", "bar") + req.Header.Set("Transfer-Encoding", "qux") + signer, credProvider := buildSigner(t, true) key, err := credProvider.RetrievePrivateKey(context.Background())