Golang AWS SDK v2对接Supabase Storage S3协议遇SignatureDoesNotMatch错误

背景 #

尝试在Golang中通过S3协议与Supabase Storage交互，参照Supabase官方的JavaScript示例转写Go代码，但始终触发SignatureDoesNotMatch错误。

环境配置 #

• 创建了名为uploads的存储桶
• 在Supabase项目设置中生成新的访问密钥（access key和secret key），并存入.env文件的AWS_ACCESS_KEY_ID和AWS_SECRET_ACCESS_KEY变量中

代码实现 #

存储提供者代码（providers包） #

package providers

import (
    "context"
    "io"
    "log"

    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/service/s3"
)

type S3ProviderImpl interface {
    Upload(fileName string, data io.ReadCloser, bucket string) (string, error)
}

type StorageProvider struct {
    s3cl *s3.Client
}

func NewStorageProvider() *StorageProvider {
    endpoint := "https://sldogsqddfisyaxbeujt.supabase.co/storage/v1/s3"

    cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithRegion("ap-southeast-1"))
    if err != nil {
        log.Printf("error: %v", err)
        return nil
    }

    client := s3.NewFromConfig(cfg, func(o *s3.Options) {
        o.BaseEndpoint = aws.String(endpoint)
        o.UsePathStyle = true
    })

    return &StorageProvider{
        s3cl: client,
    }
}

// 测试函数
func (provider *StorageProvider) List() {
    res, err := provider.s3cl.ListBuckets(context.TODO(), &s3.ListBucketsInput{})
    if err != nil {
        log.Println(err)
    }
    for _, object := range res.Buckets {
        log.Printf("key=%s ", aws.ToString(object.Name))
    }
}

主程序代码（main.go） #

package main

import (
    "amelia/internal/providers"
    "log"

    "github.com/joho/godotenv"
    _ "github.com/lib/pq"
    "github.com/rs/zerolog"
)

func startup() {
    log.Println("Loading .env")
    err := godotenv.Load(".env")
    if err != nil {
        log.Panic(err)
    }
}

func main() {
    startup()
    storage := providers.NewStorageProvider()
    storage.List()
}

参考示例 #

Supabase仅提供JavaScript版本的S3协议使用示例，转写Go代码时参照了该示例：

import { S3Client } from '@aws-sdk/client-s3';

const client = new S3Client({
  forcePathStyle: true,
  region: 'project_region',
  endpoint: 'https://project_ref.supabase.co/storage/v1/s3',
  credentials: {
    accessKeyId: 'your_access_key_id',
    accessSecretKey: 'your_secret_access_key',
  }
})

已尝试的解决方案 #

错误信息 #

调用List函数时始终返回以下错误：

024/05/21 18:27:53 operation error S3: ListBuckets, https response error StatusCode: 403, RequestID: , HostID: , api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.

验证情况 #

使用AWS CLI执行相同配置的请求可以成功：

PS C:\Users\josti> aws s3 ls uploads --endpoint=https://sldogsqddfisyaxbeujt.supabase.co/storage/v1/s3
2024-05-20 16:49:24       8269 abc.jpg

尝试过的无效操作 #

• 添加桶名后缀斜杠
• 重新验证密钥正确性
• 修改文件名前缀

环境信息 #

• 操作系统：Windows 11 24h2
• Go版本：1.22
• AWS SDK v2相关依赖版本：

github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.3 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.7 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.7 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.7 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.9 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.9 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.7 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.20.8 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.2 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.28.9 

内容的提问来源于stack exchange，提问作者Jostimian