How can I calculate an AWS API signature (v4) in python?

Question

I'm attempting to generate a signature for an Amazon Glacier upload request, using the example requests and example functions provided by the AWS documentation, but I can't make it work. At this point, I'm certain I'm missing something incredibly obvious: ``` #!/bin/env python import hmac import hashlib # This string to sign taken from: http://docs.amazonwebservices.com/amazonglacier/latest/dev/amazon-glacier-signing-requests.html#example-signature-calculation sts = """AWS4-HMAC-SHA256 20120525T002453Z 20120525/us-east-1/glacier/aws4_request 5f1da1a2d0feb614dd03d71e87928b8e449ac87614479332aced3a701f916743""" # These two functions taken from: http://docs.amazonwebservices.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python def sign(key, msg): return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).hexdigest() # The fake secret key is provided by the referenced docs def getSignatureKey(): kDate = sign(("AWS4" + "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY").enco…

Accepted Answer

Your function differs from theirs in one respect. You're doing

```
def sign(key, msg):
  return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).hexdigest()
```

but they're doing

```
def sign(key, msg):
  return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest()
```

So your derived key is wrong. You only want to be using hexdigest at the last step of the process, not when calculating the signing key.

How can I calculate an AWS API signature (v4) in python?

Solution

Problem