Sign UploadPartRequest for MultipartUpload with ChecksumAlgorithm

[WolfgangVogl]

Hello all,

I am trying to generate a Presigned URL for an UploadPartRequest of a MultipartUpload.
This works as long as I just create a MultipartUploadRequest without setting the checksum algorithm.

Aws::S3::Model::CreateMultipartUploadRequest createMultipartRequest;
      createMultipartRequest.SetBucket(bucketName);
      createMultipartRequest.SetKey(objectKey);
      // createMultipartRequest.SetChecksumAlgorithm(Aws::S3::Model::ChecksumAlgorithm::SHA256);
...

then this way I can create the given URL to the part with the part number :

 Aws::S3::Model::UploadPartRequest uploadPartRequest;
         uploadPartRequest.SetBucket(data.bucket);
         uploadPartRequest.SetKey(data.key);
         uploadPartRequest.SetUploadId(data.id);
         uploadPartRequest.SetPartNumber(number);

         return s3Client.Aws::Client::AWSClient::GeneratePresignedUrl(
           uploadPartRequest,
           accessUrl,
           Aws::Http::HttpMethod::HTTP_PUT,
           Aws::Http::QueryStringParameterCollection(),
           expirationInSeconds);

But If I set the ChecksumAlgorithm when starting the MultipartUpload I get trouble:
createMultipartRequest.SetChecksumAlgorithm(Aws::S3::Model::ChecksumAlgorithm::SHA256);

If I generate the presigned the same way I created it before and try to make a PUT to the generated signed URL I get
<Message>Checksum Type mismatch occurred, expected checksum Type: sha256, actual checksum Type: null</Message>

Adding the Header
x-amz-checksum-sha256 produces
<Message>There were headers present in the request which were not signed</Message>
So I tried to generate the presigned by another way:

      Aws::Http::HeaderValueCollection headers;
      headers.try_emplace("x-amz-checksum-sha256", "UNSIGNED-PAYLOAD");
      accessUrl.AddQueryStringParameter("partNumber", std::to_string(number));
      accessUrl.AddQueryStringParameter("uploadId", data.id);
return s3Client.Aws::Client::AWSClient::GeneratePresignedUrl(
            accessUrl,
            Aws::Http::HttpMethod::HTTP_PUT,
            headers,
            expirationInSeconds);

But using this presiged url produces another error:

<Error>
	<Code>SignatureDoesNotMatch</Code>
	<Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>
...

In the request headers a set the
x-amz-checksum-sha256 header to the base64 encoded value of the sha256 of the file I tried to PUT to s3.
x-amz-checksum-sha256: MjZjNmIzMWY1MDY4OTQ0OGM0NDc0ODllMzcyNGM3Njk4ZjE5ODQ5Y2Y5MTRjYTU4ZmM5M2RiOGZmY2E1Yjk2Nw==

I use the aws-sdk-cpp/1.11.51 to start the multipart upload and generate the predefined URL, and Insomnia to send the PUT request.

[jmklix]

Check out our tests to see how this can be used. I think this test is similar to what you are trying:

        static void DoPresignedUrlTest(const Aws::String& bucketName, std::shared_ptr<HttpRequest>& putRequest)
        {
            std::shared_ptr<Aws::IOStream> objectStream = Aws::MakeShared<Aws::StringStream>("BucketAndObjectOperationTest");
            *objectStream << "Test Object";
            objectStream->flush();

            putRequest->AddContentBody(objectStream);
            Aws::StringStream intConverter;
            intConverter << objectStream->tellp();
            putRequest->SetContentLength(intConverter.str());
            putRequest->SetContentType("text/plain");
            std::shared_ptr<HttpResponse> putResponse = m_HttpClient->MakeRequest(putRequest);

            ASSERT_EQ(HttpResponseCode::OK, putResponse->GetResponseCode());

            ASSERT_TRUE(WaitForObjectToPropagate(bucketName, TEST_OBJ_KEY));

            // GetObject with presigned url
            Aws::String presignedUrlGet = Client->GeneratePresignedUrl(bucketName, TEST_OBJ_KEY, HttpMethod::HTTP_GET);
            std::shared_ptr<HttpRequest> getRequest = CreateHttpRequest(presignedUrlGet, HttpMethod::HTTP_GET, Aws::Utils::Stream::DefaultResponseStreamFactoryMethod);
            std::shared_ptr<HttpResponse> getResponse = m_HttpClient->MakeRequest(getRequest);

            ASSERT_EQ(HttpResponseCode::OK, getResponse->GetResponseCode());
            Aws::StringStream ss;
            ss << getResponse->GetResponseBody().rdbuf();
            ASSERT_STREQ("Test Object", ss.str().c_str());

            Aws::S3::Model::GetObjectRequest getObjectRequest;
            getObjectRequest.WithBucket(bucketName).WithKey(TEST_OBJ_KEY);
            auto outcome = Client->GetObject(getObjectRequest);
            AWS_ASSERT_SUCCESS(outcome);
            if (putRequest->HasHeader(Aws::S3::SSEHeaders::SERVER_SIDE_ENCRYPTION))
            {
                ASSERT_STREQ(Aws::S3::Model::ServerSideEncryptionMapper::GetNameForServerSideEncryption(outcome.GetResult().GetServerSideEncryption()).c_str(), putRequest->GetHeaderValue(Aws::S3::SSEHeaders::SERVER_SIDE_ENCRYPTION).c_str());
            }
        }

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.