Pre-signed URL for PUT object request with canned-acl contains query parameter x-amz-acl

[JigarJoshi]

While constructing the PUT object presigned URL with canned-acl in PHP AWS SDK (3.335.0) the presigned URL contains query parameter x-amz-acl and thus the canonical request contains this canned ACL twice (header and raw query param, line# 3 and line#5)

Other SDKs (Atleast Java & Go) when asked to do same thing, they don't include the query param x-amz-acl. Technically to restrict user to certain canned ACL having it in one place is enough to bind them via signature.

I couldn't find any official documentation on what is the right behavior, should query param also contain the canned-acl in addition to the request header?

[yenfryherrerafeliz]

Hi @JigarJoshi, sorry to hear about this issue. Can you please provide a simple code example that I can use to reproduce the error you are seeing?. Also, quick question, did this start happening to you on/after version 3.335.0?

I look forward to your response.

Thanks!

[JigarJoshi]

Hi @yenfryherrerafeliz

Here is the minimal code to reproduce this PUT presigned URL that includes x-amz-acl in query param and also expects it as part of signed headers

<?php
require 'vendor/autoload.php';

use Aws\S3\S3Client;
use Aws\Exception\AwsException;
use Aws\Credentials\CredentialProvider;

try {
    // Initialize the S3 Client
    $s3Client = new S3Client([
        'version' => 'latest',
        'region'  => 'us-east-1', 
        'credentials' => CredentialProvider::env(), 
    ]);

    // Define the S3 bucket and object key
    $bucket = 'your-bucket-name'; 
    $key = 'path/to/your/object.txt';  

    // Set the expiration time (1 hour = 3600 seconds)
    $expires = 3600;

    $acl = 'public-read';  // Example ACL, can also be 'private', 'authenticated-read', etc.

    $command = $s3Client->getCommand('PutObject', [
        'Bucket' => $bucket,
        'Key'    => $key,
        'ACL'    => 'private', // Specify the ACL here
    ]);

    $presignedUrl = $s3Client->createPresignedRequest($command, '+' . $expires . ' seconds');

    $url = (string) $presignedUrl->getUri();

    echo "Presigned Upload URL with ACL '$acl': " . $url . "\n";

} catch (AwsException $e) {
    echo "Error generating presigned URL: " . $e->getMessage() . "\n";
}

composer.json has following

    "require": {
        "aws/aws-sdk-php": "^3.336"
    }

I was able to reproduce it also on 3.0.0. So this is more of a question - is this expected behavior because the other language SDKs don't follow the same behavior. Also I couldn't find any official document detailing this.

[yenfryherrerafeliz]

Hi @JigarJoshi, thanks for bringing this up. I am not sure why our current implementation kept this header as to be signed, but, even when our current behavior works with not issue, I will create a backlog item to look into this and if this is not kept for backward compatibility reason then I will provide a small fix for it.

Thanks!

[JigarJoshi]

Hi @yenfryherrerafeliz can you provide an update on your findings here? I am trying to understand what is the right behavior.

[yenfryherrerafeliz]

Hi @JigarJoshi, sorry for not being more clear. The more appropiate behavior should be keeping this header as a query parameter. Actually, I checked with the JavaScript SDK, and it does it in that way. It is also actually what makes more sense, because, otherwise if this parameter is provided just as a signed header then, this parameter would need to be provided as part of the headers when executing the presigned url request, otherwise an invalid signature error will be returned by the service. Our current implementation however, works fine, because even when this header is provided as part of the signature, its value is also provided in the query parameter and this avoid the signature mismatch error from the service.

Please let me know if this answers your question.

Thanks!

[JigarJoshi]

Thanks for clarification @yenfryherrerafeliz