AWS SDK JavaScript - 我们计算的请求签名与您提供的签名不匹配答案

【问题标题】：AWS SDK JavaScript - The request signature we calculated does not match the signature you providedAWS SDK JavaScript - 我们计算的请求签名与您提供的签名不匹配
【发布时间】：2023-03-23 17:11:01
【问题描述】：

我正在尝试签署来自我的 Lambda 函数的 HTTP 请求，以访问我的 Elasticsearch 端点，如 here 所述。我不知道是否有更好的方法来执行此操作，但我收到 status 403 错误，并显示以下响应。如何解决此错误并确定我的签名问题？

{
"message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."

}

我的 Lambda 函数具有具有以下权限的 IAM 角色 (ROLE_X)。

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "es:ESHttpPost",
            "es:ESHttpPut",
            "dynamodb:DescribeStream",
            "dynamodb:GetRecords",
            "dynamodb:GetShardIterator",
            "dynamodb:ListStreams",
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
        ],
        "Resource": "*"
    }
]

}

通过提供 ROLE_X 的 arn 作为自定义访问策略，我还允许访问我的 Elasticsearch 域中的此角色。

这是我用 NodeJS 编写的 lambda 函数

'use strict';
var AWS = require('aws-sdk');
var region = 'eu-central-1';
var domain = 'search-mydomain-XXXX.eu-central-1.es.amazonaws.com';
var index = 'images';
var type = 'image';
var credentials = new AWS.EnvironmentCredentials('AWS');

exports.handler = (event, context, callback) => {
    var endpoint = new AWS.Endpoint(domain);
    var request = new AWS.HttpRequest(endpoint, region);

    request.headers['host'] = domain;
    request.headers['Content-Type'] = 'application/json';
    // Content-Length is only needed for DELETE requests that include a request
    // body, but including it for all requests doesn't seem to hurt anything.
    request.headers['Content-Length'] = Buffer.byteLength(request.body);
    request.path += index + '/' + type + '/';
   
    let count = 0;
    event.Records.forEach((record) => {
        const id = JSON.stringify(record.dynamodb.Keys.id.S);
        request.path += id;
        if (record.eventName == 'REMOVE') {
            request.method = 'DELETE';
            console.log('Deleting document');
        }
        else { // record.eventName == 'INSERT'
            request.method = 'PUT';
            request.body = JSON.stringify(record.dynamodb.NewImage);
            console.log('Adding document' + request.body);
        }
        // Signing HTTP Requests to Elasticsearch Service
        var signer = new AWS.Signers.V4(request, 'es');
        signer.addAuthorization(credentials, new Date());
        
        // Sending HTTP Request to Elasticsearch Service
        var client = new AWS.HttpClient();
        client.handleRequest(request, null, function(response) {
            console.log('sending request to ES');
            console.log(response.statusCode + ' ' + response.statusMessage);
            var responseBody = '';
            response.on('data', function(chunk) {
                responseBody += chunk;
            });
            response.on('end', function(chunk) {
                console.log('Response body: ' + responseBody);
            });
        }, function(error) {
            console.log('ERROR: ' + error);
            callback(error);
        });
        request.path = request.path.replace(id, "");
        count += 1;
        console.log("COUNT :" + count);
    });
    
    callback(null, `Successfully processed ${count} records.`);
};

【问题讨论】：

一件会让你受益的事情（尽管它不是你的问题），是event.Records.forEach() 没有在其块中被异步请求阻塞（即你的client.handleRequest() 调用），所以你不会处理所有记录。在这里使用 async/await 或 Promise 会有所帮助。 sig4 签名是一件令人头疼的事情......
感谢您对@LostJon 的宝贵反馈。你是对的，我必须重构那个 for 循环。你能给我任何建议或任何有用的资源来使用 NodeJS/lambda 进行 sig4 签名吗？
有可用的第三方 ES 客户端，例如 http-aws-es 和 @acuris/aws-es-connection。

标签： amazon-web-services aws-lambda aws-elasticsearch aws-sdk-nodejs

【解决方案1】：

您可以使用http-aws-es 库。它使用 aws-sdk 在访问您的 ES 端点之前处理请求的签名。您可以使用 http-aws-es 尝试对您的代码进行以下更改。

var es = require('elasticsearch');
var AWS = require('aws-sdk');
    
AWS.config.update({
    credentials: new AWS.EnvironmentCredentials('AWS'),
    region: 'yy-region-1'
});
const client = es.Client({
    hosts: ['https://xxxx.yy-region-1.es.amazonaws.com/'],
    connectionClass: require('http-aws-es'),
    awsConfig: new AWS.Config({region: 'yy-region-1'})
});    

await client.search(....)

【讨论】：