使用Go HTTP客户端调用AWS实例接口遇AuthFailure凭证验证错误

我用Go Fiber HTTP服务器结合AWS Go SDK v1.44.156开发了一款启停AWS实例的自动化工具，服务监听端点/csm/aws/:region/:instance_id/powerOn。用Postman发送请求时运行正常，但用Go HTTP客户端发送请求时，AWS返回错误：AuthFailure: AWS was not able to validate the provided access credentials。

正常请求（Postman）日志 #

2022/12/23 16:26:12 Request came :#0000000100000003 - 127.0.0.1:7000 <-> 127.0.0.1:34976 - POST http://127.0.0.1:7000/csm/aws/us-east-1/i-0f9c5fe6b5c7b0a87/powerOn
Params: map[instance_id:i-0f9c5fe6b5c7b0a87 region:us-east-1]
Request: POST /csm/aws/us-east-1/i-0f9c5fe6b5c7b0a87/powerOn HTTP/1.1
User-Agent: PostmanRuntime/7.30.0
Host: 127.0.0.1:7000
Content-Type: application/json
Content-Length: 136
Accept: */*
Postman-Token: e27b899f-5125-497a-b154-61cd3214cd74
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

{"aws_access_key_id":"my-id","aws_secret_access_key":"my-key","account":"","region":""}

错误请求（Go HTTP客户端）日志 #

2022/12/23 16:22:02 Request came :#0000000200000002 - 127.0.0.1:7000 <-> 127.0.0.1:34278 - POST http://127.0.0.1:7000/csm/aws/us-east-1/i-0f9c5fe6b5c7b0a87/powerOn
Params: map[instance_id:i-0f9c5fe6b5c7b0a87 region:us-east-1]
Request: POST /csm/aws/us-east-1/i-0f9c5fe6b5c7b0a87/powerOn HTTP/1.1
User-Agent: Go-http-client/1.1
Host: 127.0.0.1:7000
Content-Type: application/json
Content-Length: 136
Accept-Encoding: gzip

{"aws_access_key_id":"my-id","aws_secret_access_key":"my-key","account":"","region":""}

已设置系统自动同步时间，但问题依旧，代码几天前可正常运行。

1. 检查请求体处理差异 #

Go客户端请求带Accept-Encoding: gzip，若服务端自动对请求体做了解压处理，会导致AWS签名验证时的请求体与原始不一致。需确认服务端解析请求体的逻辑在两种场景下是否完全相同，打印解析后的密钥值，确保无空格、大小写错误或字符转义差异。

2. 验证AWS SDK初始化逻辑 #

• 确认服务端是使用URL路径中的region参数还是请求体中的空region值初始化AWS客户端，两种请求场景下的region配置必须一致。
• 检查Go客户端运行环境是否存在AWS_ACCESS_KEY_ID等环境变量，AWS SDK会优先读取环境变量，可能覆盖请求体传入的密钥。

3. 消除请求头差异 #

两种请求的请求头存在不同，尝试让Go客户端复用Postman的请求头，看是否能绕过签名问题：

req, _ := http.NewRequest("POST", url, body)
req.Header.Add("Accept", "*/*")
req.Header.Add("Connection", "keep-alive")
req.Header.Set("Content-Type", "application/json")

4. 开启AWS SDK调试日志 #

通过SDK调试日志对比两种请求的签名生成细节，定位差异点：

import "github.com/aws/aws-sdk-go/aws/request"

// 在创建AWS请求后添加调试日志
awsReq := ec2Client.StartInstancesRequest(&ec2.StartInstancesInput{
    InstanceIds: []*string{aws.String(instanceID)},
})
awsReq.LogLevel = request.LogDebugWithSigning

5. 检查密钥特殊字符编码 #

若密钥包含特殊字符，对比Go客户端序列化的JSON与Postman发送的原始JSON是否完全一致，避免因转义规则不同导致密钥解析错误。

内容的提问来源于stack exchange，提问作者DevAbdurrahman