如何使用 PHP 生成 AWS SP-API 签名？

Question

当我使用 POSTMAN 从 Amazon SP-API 获取数据时，它总是返回正确的结果。但是，我在使用 PHP 代码生成 AWS 签名时遇到了一些问题。

我已按照 [AWS DOCS](https://docs.aws.amazon.com/general/latest/gr/sigv4signing.html) 中的说明进行操作，但它始终返回以下错误。

SignatureDoesNotMatch The computed request signature does not match the signature you gave. Examine your AWS Secret Access Key and signature technique. Details can be found in the service documentation.

不存在凭据不匹配的问题，因为所有凭据都是准确的。我相信HASH有问题。我正在使用“SHA256”散列技术。

有人可以帮助我确定 AWS SP-API 签名创建的正确参考吗？

先感谢您。

------------------------- 1: Create a Canonical Request for Signature ----------------------------

echo $query_string = 'Action=AssumeRole&Version=2011-06-15&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=' . urlencode($access_key . '/' . $sDate . '/us-east-1/sts/aws4_request') . '&X-Amz-Date=' . $sTime . '&X-Amz-SignedHeaders=' . urlencode('content-type;host;x-amz-date');


$canonicalrequest = "";
$canonicalrequest .= "GET" . "\n";
$canonicalrequest .= "/" . "\n";
$canonicalrequest .= $query_string . "\n";
$canonicalrequest .= "Content-Type:application/x-www-form-urlencoded; charset=utf-8" . "\n";
$canonicalrequest .= "host:sts.amazonaws.com" . "\n";
$canonicalrequest .= "x-amz-date:" . $sTime . "\n";
$canonicalrequest .= "\n";
$canonicalrequest .= "content-type;host;x-amz-date" . "\n";
$canonicalrequest .= strtolower(bin2hex(hash('sha256', '', true)));


------------------------- 2: Create a String to Sign for Signature ------------------------------

$Algorithm = 'AWS4-HMAC-SHA256';
$RequestDateTime = $sTime;
$CredentialScope = $sDate . '/us-east-1/sts/aws4_request';
$HashedCanonicalRequest = strtolower(bin2hex(hash('sha256', $canonicalrequest, true)));
$StringToSign = $Algorithm . "\n" . $RequestDateTime . "\n" . $CredentialScope . "\n" . $HashedCanonicalRequest;


-------------------------------- 3: Calculate the AWS Signature -----------------------------------

$kSecret = "AWS4" . $secret_access_key;
$kDate = hash_hmac('sha256', $sDate, $kSecret, true);
$kRegion = hash_hmac('sha256', 'us-east-1', $kDate, true);
$kService = hash_hmac('sha256', 'sts', $kRegion, true);
$kSigning = hash_hmac('sha256', 'aws4_request', $kService, true);

$notHexSignature = hash_hmac('sha256', $StringToSign, $kSigning, true);
$signature = strtolower(bin2hex($notHexSignature));

-------------------------- 4: Add the AWS Signature to the Request --------------------------------

$session_token_url = 'https://sts.amazonaws.com?Version=2011-06-15&Action=AssumeRole&RoleSessionName=SessionToken&RoleArn=' . $role_ARN;
echo $session_token_url;

$session_token_header = ['X-Amz-Date: ' . $sTime, 'Authorization: AWS4-HMAC-SHA256 Credential=' . $access_key . '/' . $sDate . '/us-east-1/sts/aws4_request, SignedHeaders=host;x-amz-date, Signature=' . $signature];

$session_token = api_call_for_session_token($session_token_url, 'GET', '', $session_token_header);


function api_call_for_session_token(string $url, string $method = 'GET', $body = null, $header)
{
    $curl = curl_init($url);

    curl_setopt_array($curl, array(
        CURLOPT_URL => $url,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_ENCODING => '',
        CURLOPT_MAXREDIRS => 10,
        CURLOPT_TIMEOUT => 30,
        CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_POSTFIELDS => $body,
        CURLOPT_HTTPHEADER => $header,
        CURLOPT_SSL_VERIFYHOST => false,
        CURLOPT_SSL_VERIFYPEER => false
    ));

    $response = curl_exec($curl);
    $rescode = (int) curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $err = curl_error($curl);
    curl_close($curl);
    $succesRescode = [100, 200, 201, 202, 205, 301];
    if ($err || !in_array($rescode, $succesRescode)) {
        $res = ['status' => false, 'message' => 'api call failed ' . $err, 'rescode' => $rescode, 'data' => json_decode($response, true)];
    } else {
        $res = ['status' => true, 'message' => 'api call success', 'rescode' => $rescode, 'data' => json_decode($response, true)];
    }
    return $response;
}

Answer 1

我也有同样的问题。你找到解决办法了吗？