estou tentando atender arquivos estáticos e de mídia do bucket amazon S3, mas o nginx não consegue se conectar a ele
Aqui está o erro que recebo
<Error>
<Code>AccessDenied</Code>
<Message>
AWS authentication requires a valid Date or x-amz-date header
</Message>
<RequestId></RequestId>
<HostId></HostId>
</Error>
e minha configuração Nginx
server {
listen 80;
server_name my_elastic_ip;
location = /favicon.ico { access_log off; log_not_found off; }
location / {
try_files $uri @s3;
}
location @s3 {
set $s3_bucket 'my_bucket.s3.amazonaws.com';
set $url_full '$1';
set $aws_access_key 'my_access_key';
set $aws_secret_key 'my_secret_key';
proxy_http_version 1.1;
proxy_set_header Host $s3_bucket;
proxy_set_header x-amz-date $date_gmt;
proxy_set_header Authorization 'AWS $aws_access_key:$aws_secret_key';
proxy_hide_header x-amz-id-2;
proxy_hide_header x-amz-request-id;
proxy_hide_header Set-Cookie;
proxy_ignore_headers "Set-Cookie";
proxy_buffering off;
proxy_intercept_errors on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
proxy_pass http://$s3_bucket/$url_full;
}
}
Editar 1:
Eu resolvi o problema ao substituir a data x-amz por:
set_by_lua $now "return ngx.cookie_time(ngx.time())";
proxy_set_header x-amz-date $now;
Você precisa de pacotes extras nginx, instale-o com:
sudo apt-get install nginx-extras
agora recebo este erro:
<Error>
<Code>SignatureDoesNotMatch</Code>
<Message>
The request signature we calculated does not match the signature you provided. Check your key and signing method.
</Message>
Editar 2:
Para criar assinatura eu adicionei o módulo set-misc-nginx ( link ) para nginx ( instalar o módulo opcional nginx )
Em seguida, atualize minha configuração do nginx para:
server {
listen 80;
server_name my_ip;
location = /favicon.ico { access_log off; log_not_found off; }
location / {
try_files $uri @s3;
}
location @s3 {
set $s3_bucket 'my_bucket';
set $key 'my_file';
set $aws_access_key 'my_access_key';
set $aws_secret_key 'my_secret_key';
set_by_lua $now "return ngx.cookie_time(ngx.time())";
set $aws_signature '';
set $string_to_sign "$request_method\n\n\n\nx-amz-date:$now\n/$s3_bucket/$key";
set_hmac_sha1 $aws_signature $aws_secret_key $string_to_sign;
set_encode_base64 $aws_signature $aws_signature;
proxy_http_version 1.1;
proxy_set_header x-amz-date $now;
proxy_set_header Authorization 'AWS $aws_access_key:$aws_signature';
proxy_set_header Host $s3_bucket.s3.amazonaws.com;
proxy_hide_header x-amz-id-2;
proxy_hide_header x-amz-request-id;
proxy_hide_header Set-Cookie;
proxy_ignore_headers "Set-Cookie";
proxy_buffering off;
proxy_intercept_errors on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
proxy_pass http://s3.amazonaws.com;
}
}
recebendo este erro:
Status: HTTP / 1.1 403 Proibido
<Code>AccessDenied</Code>
<Message>Access Denied</Message>