When accessing Amazon SQS using Query, SOAP (without using WS-Security), or REST, you must provide the following items so the request can be authenticated:
Below is the series of tasks required to authenticate requests to AWS. It is assumed you have already created an AWS account and received an Access Key ID and Secret Access Key.
You perform the first three tasks.
Process for Authentication: Tasks You Perform
Construct a request to AWS. | |
Calculate a keyed-hash message authentication code (HMAC-SHA1) signature using your Secret Access Key (seehttp://www.faqs.org/rfcs/rfc2104.html for information about HMAC) | |
Include the signature and your Access Key ID in the request, and then send the request to AWS. |
AWS performs the next three tasks.
Process for Authentication: Tasks AWS Performs
AWS uses the Access Key ID to look up your Secret Access Key. | |
AWS generates a signature from the request data and the Secret Access Key using the same algorithm you used to calculate the signature you sent in the request. | |
If the signature generated by AWS matches the one you sent in the request, the request is considered authentic. If the comparison fails, the request is discarded, and AWS returns an error response. |
Each AWS request you send must include an HMAC-SHA1 request signature calculated with your Secret Access Key (except for SOAP requests using WS-Security). The string you use to calculate the signature (the string to sign) varies depending on the API you're using (Query, SOAP, or REST). The details are covered in the following topics:
Tip | |
---|---|
If you're using the Query API, you can use the Amazon SQS scratchpad to help you troubleshoot authentication issues. The scratchpad is a simple HTML and JavaScript application that allows you to explore the 2008-01-01 Amazon SQS API without writing any code. The tool constructs a Query request and shows the string to sign and the final signature (using signature version 1) that you would include in the request. To download the scratchpad, go tohttp://developer.amazonwebservices.com/connect/entry.jspa?externalID=1254&categoryID=30. |
The time stamp (or expiration time) you use in the request must be a dateTime
object (http://www.w3.org/TR/xmlschema-2/#dateTime). Although it is not required, we recommend you provide the time stamp in the Coordinated Universal Time (Greenwich Mean Time) time zone. For example: 2007-01-31T23:59:59.183Z.
If you specify a time stamp (instead of an expiration time), the request automatically expires 15 minutes after the time stamp (in other words, AWS does not process a request if the request time stamp is more than 15 minutes earlier than the current time on AWS servers). Make sure your server's time is set correctly.
Important | |
---|---|
If you are using .NET you must not send overly specific time stamps, due to different interpretations of how extra time precision should be dropped. To avoid overly specific time stamps, manually construct |
The following Java code sample shows how to calculate an HMAC request signature.
package amazon.webservices.common;import java.security.SignatureException;import javax.crypto.Mac;import javax.crypto.spec.SecretKeySpec;/*** This class defines common routines for generating* authentication signatures for AWS Platform requests.*/public class Signature {private static final String HMAC_SHA1_ALGORITHM = "HmacSHA1";/*** Computes RFC 2104-compliant HMAC signature.* * @param data* The data to be signed.* @param key* The signing key.* @return* The Base64-encoded RFC 2104-compliant HMAC signature.* @throws* java.security.SignatureException when signature generation fails*/public static String calculateRFC2104HMAC(String data, String key)throws java.security.SignatureException{String result;try {// get an hmac_sha1 key from the raw key bytesSecretKeySpec signingKey = new SecretKeySpec(key.getBytes(), HMAC_SHA1_ALGORITHM);// get an hmac_sha1 Mac instance and initialize with the signing keyMac mac = Mac.getInstance(HMAC_SHA1_ALGORITHM);mac.init(signingKey);// compute the hmac on input data bytesbyte[] rawHmac = mac.doFinal(data.getBytes());// base64-encode the hmacresult = Encoding.EncodeBase64(rawHmac);} catch (Exception e) {throw new SignatureException("Failed to generate HMAC : " + e.getMessage());}return result;}}
联系客服