Amplify-android: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

[tendynewbies]

Hello n' Greetings!!

I am using implementation 'com.amplifyframework:aws-api:1.0.0' as suggested for API(REST).

My amplifyconfiguration.json looks like:

"api": {
        "plugins": {
            "awsAPIPlugin": {
                "VODApi": {
                    "endpointType": "REST",
                    "endpoint": "https://p4wfal4mb8.execute-api.ap-south-1.amazonaws.com/POC",
                    "region": "ap-south-1",
                    "authorizationType": "AWS_IAM"
                }
            }
        }
    },
"auth": .........

My Amplify initialisation looks like:

try {
            Amplify.addPlugin(new AWSCognitoAuthPlugin());
            Amplify.addPlugin(new AWSS3StoragePlugin());
            Amplify.addPlugin(new AWSApiPlugin());
            Amplify.configure(getApplicationContext());
            Log.i("Media Analysis", "Initialized Amplify");
        } catch (AmplifyException error) {
            Log.e("Media Analysis", "Could not initialize Amplify", error);
        }

My API call looks like:

 private void fetchPreparedStreams() {
        RestOptions options = RestOptions.builder()
                .addPath("/vod-with-aws/convert?userId="+Amplify.Auth.getCurrentUser().getUserId())
                .build();
        Amplify.API.get("VODApi",
                options,
                response -> Log.i("MyAmplifyApp", response.getData().asString()),
                error -> Log.e("MyAmplifyApp", "GET failed", error));
    }

The Exception, I am facing looks like:

SUCCESS: {"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

    The Canonical String for this request should have been
    'GET
    /POC/vod-with-aws/convert%253FuserId%3Dmy_user_id

    host:p4wfal4mb8.execute-api.ap-south-1.amazonaws.com
    x-amz-date:20200715T102412Z
    x-amz-security-token:IQoJb3JpZ2luX2VjEPv//////////wEaCXVzLWVhc3QtMSJGMEQCIGHXGImFDDgugz84PqFkgNjTulsDFB9NL2MFvFpLLgLyAiB/9fwGv61+XCoeW6WooV1bJCMbv4csNyAGn2JJmxy3QyqHBAik//////////8BEAEaDDYxNzk1OTg5ODU5MCIMRoofG4+wx3KWSRnpKtsDiq8PyIY1YvZy988V5z/eDLM/SD4G/2u9m73p7z5v7tmH1JVKOBSRapr8PnYDl0BvOsMLIA5ViVm+KOfoRcwvOwObKqRE/fomMcix9fF7AQm+cuK9DgxuIvQlAt1eHEGW6NOWZjp3j6gHPYxEnOQsVjS/BvojULICD9mm5NzggQIV94UARkwlYK8GOLVCcBx3Xgvkeu0ZDxmP4Nn8I36oLQ7YqcXwNXM+ple7LbELqgInhZZy6AbUtUclzG1z9cuV8WwQAW/tcyOzTHu33z3WFZwJ6xoQeay4SsWcis6GohRugL0A8oo1QuVoBWzPobjzBs8i6bC/jai0JQoEMkb0vk40W0VBGKL0NqgO0wezck9WUtiuHQAX9pBm/XTYQSEbRRgnZ0cZsamIxOdv5mmC/HpBJEkeViyh1FQDkcbIBlmUcSD6WtRWnnJQqiEya7fxSqZhjdqBD+F7tYtr9H6mTvCvwlMLwynDaOeo/6YBvRBqxcCBPPemwO4qxZf8ET6v9hRkihvFRrTsuOVGoduEvlkXrUk3tOumheCT/gGWT6zE8sgAIENAUgjUYBVW7aYQ+3o/jKniJYEO4k4poN7Zsaq8Q/sW9YXkGLF6Nn5EjJho8yBxPQ84LKaplTDFsrv4BTrMAhAfFZ7fA/yB+C9wpH05qcoeUUCSaD9Rxg/nZjS8PssV77y6IbmPQh+n/cixElFIBXBplU2/T9gaAtLiLGUkWBTuHdIkvMbGvvVHCor+fYLM2KFuh3TwhNcM2IuXIGgcAsKPXPTEM2KdhANURvJil0mu/20DXvoX76bV8jYnHqQGRKGJt9HWbK44m7TH+MfT5VpxHNovz4A8qBU6LaSvEcQDy6lQ8ijn0Lu/UzfbOtp3Fp0VVd28Zgq6JCkZ+ZtofbgnLjleBr8TWgHTJ3auit66RvREvmzyjyeYet8OKunwF3Za2Kof23+9VPqsHUbLaLLi9yzTdFjP7PnIhwUTZvuOvxGGmlAqW0FVf8iE4KUz4APEc1EFQv2rpKrqBs6ik95ZgDKl/OcTRGmq9e3WkRohSA4AphoUv2BXv22boP8UliqiSG8Nr6jLG7kX

    host;x-amz-date;x-amz-security-token
    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'

    The String-to-Sign should have been
    'AWS4-HMAC-SHA256
    20200715T102412Z
    20200715/ap-south-1/execute-api/aws4_request
    c324fbadd6869bef823efb68e1a1501f087d53c493ddb30510877dca873b7848'
    "}

Please help, urgent client-delivery at stake.

[TrekSoft]

Hey, yes sorry this is a bug we found at launch and have a fix committed for here so it should be deployed tomorrow: #600

[TrekSoft]

The workaround in the meantime is to not put the leading slash in your path:

// this works
RestOptions.builder()
    .addPath(“somepath”)
    .build()

// this breaks
RestOptions.builder()
    .addPath(“/somepath”)
    .build()

[tendynewbies]

Hi @TrekSoft ,
Greetings!!

Thanks for your reply. Now when I implemented the suggested work around and converted:

amplifyconfiguration.json

"api": {
        "plugins": {
            "awsAPIPlugin": {
                "VODApi": {
                    "endpointType": "REST",
                    "endpoint": "https://p4wfal4mb8.execute-api.ap-south-1.amazonaws.com/POC/vod-with-aws",
                    "region": "ap-south-1",
                    "authorizationType": "AWS_IAM"
                }
            }
        }
    },
"auth": .........

API call:

 private void fetchPreparedStreams() {
        RestOptions options = RestOptions.builder()
                .addPath("convert?userId="+Amplify.Auth.getCurrentUser().getUserId())
                .build();
        Amplify.API.get("VODApi",
                options,
                response -> Log.i("MyAmplifyApp", response.getData().asString()),
                error -> Log.e("MyAmplifyApp", "GET failed", error));
    }

The response, I am facing from API-gateway looks like:
SUCCESS: {"message":"Forbidden"}

I think, this might be similar to this open issue.

[TrekSoft]

Hmm, well yeah so that open issue indicates it may be returning 403s when it should be returning 404s for incorrect URLs and I see you did more than just take the slash off the beginning of the path, you also removed the vod-with-aws portion and put it in the config. Is that correct? Did you do edit the amplifyconfiguration.json manually? If so perhaps you inadvertently messed it up.

[TrekSoft]

The fix to the original issue this was reporting was just released