Spring集成AWS S3图片上传报错：AuthorizationHeaderMalformed

错误核心分析 #

从报错信息Credential== {access-key}/{YYYYMMDD}/{region}/s3/aws4_request可以明确：生成的授权凭证格式异常，accessKey未被正确注入或取值为空，导致Credential部分出现连续的==，违反了AWS签名规范。

具体解决方案 #

1. 验证配置文件中凭证的正确性 #

检查application.properties/application.yml配置文件：

• 确保cloud.aws.credentials.access-key和cloud.aws.credentials.secret-key配置的是实际IAM密钥，而非占位符{access-key}/{secret-key}
• 密钥前后无多余空格、引号或特殊字符
• cloud.aws.region.static是标准区域代码（如us-east-1、ap-northeast-1，不要用区域全称）

2. 确认Spring配置注入是否正常 #

在S3Config类中添加日志校验（注意不要打印完整密钥，避免泄露）：

@Configuration
public class S3Config {
    @Value("${cloud.aws.credentials.access-key}")
    private String accessKey;

    @Value("${cloud.aws.credentials.secret-key}")
    private String secretKey;

    @Value("${cloud.aws.region.static}")
    private String region;

    @PostConstruct
    public void validateCredentials() {
        if (accessKey != null && !accessKey.isEmpty()) {
            System.out.println("Loaded accessKey prefix: " + accessKey.substring(0, 5));
        } else {
            System.err.println("accessKey is empty or not loaded!");
        }
    }

    @Bean
    public AmazonS3 amazonS3(){
        AWSCredentials credentials = new BasicAWSCredentials(accessKey, secretKey);

        return AmazonS3ClientBuilder
                .standard()
                .withCredentials(new AWSStaticCredentialsProvider(credentials))
                .withRegion(region)
                .build();
    }
}

启动服务后查看日志，若输出accessKey is empty or not loaded!，说明配置注入失败，需检查配置文件路径、命名空间是否正确。

3. 排查依赖冲突 #

spring-cloud-starter-aws:3.0.3与aws-java-sdk-s3:1.12.638可能存在版本兼容问题，尝试调整依赖：

• 移除spring-cloud-starter-aws，直接使用AWS SDK核心依赖：

implementation 'com.amazonaws:aws-java-sdk-s3:1.12.638'
implementation 'com.amazonaws:aws-java-sdk-core:1.12.638'

• 或升级Spring Cloud AWS至最新稳定版本，确保与AWS SDK版本匹配

4. 尝试直接使用环境变量加载凭证 #

绕过Spring配置注入，直接从环境变量获取密钥，排除配置注入问题：

@Bean
public AmazonS3 amazonS3(){
    String accessKey = System.getenv("AWS_ACCESS_KEY_ID");
    String secretKey = System.getenv("AWS_SECRET_ACCESS_KEY");
    String region = System.getenv("AWS_REGION");

    AWSCredentials credentials = new BasicAWSCredentials(accessKey, secretKey);

    return AmazonS3ClientBuilder
            .standard()
            .withCredentials(new AWSStaticCredentialsProvider(credentials))
            .withRegion(region)
            .build();
}

设置对应环境变量后重新测试。

5. 检查IAM权限与桶配置 #

确保IAM用户拥有s3:PutObject权限，且S3桶的区域与代码中配置的region一致，桶策略未阻止该用户的上传请求。

代码优化建议 #

上传方法中避免重复读取InputStream，直接使用MultipartFile的原始流：

private String uploadImageToS3(MultipartFile image) throws IOException {
    String originalFileName = image.getOriginalFilename();
    String extension = Objects.requireNonNull(originalFileName).substring(originalFileName.lastIndexOf(".") + 1).toLowerCase();

    String s3FileName = UUID.randomUUID().toString().substring(0, 10) + "_" + originalFileName;

    ObjectMetadata metadata = new ObjectMetadata();
    metadata.setContentType("image/" + extension);
    metadata.setContentLength(image.getSize());

    try{
        PutObjectRequest putObjectRequest = new PutObjectRequest(bucketName, s3FileName, image.getInputStream(), metadata)
                .withCannedAcl(CannedAccessControlList.PublicRead);
        amazonS3.putObject(putObjectRequest);
    }catch(Exception e){
        log.error("上传S3失败: ", e);
        throw new S3ImageException(ErrorCode.PUT_IMAGE_EXCEPTION);
    }

    return amazonS3.getUrl(bucketName, s3FileName).toString();
}

内容的提问来源于stack exchange，提问作者TakeMeH0ME