在Visual Basic中手动计算AWS S3预签名URL：验证签名相关字符串

AI 小北

2026-8-13

手动实现AWS S3预签名URL签名的问题

问题背景

需要计算AWS S3预签名URL以访问存储桶，不能使用Chilkat等外部库或AWS SDK for .NET，只能手动实现签名计算。

已完成的验证

已验证get_HASH_SHA256、ConvToHexString、HmacSHA256函数功能正常（经第三方工具校验）；
通过Postman生成预签名URL并对比查询参数，参数无问题，使用Postman生成的签名可正常发起请求。

我的VB代码

' 参考文档：AWS S3 SigV4查询字符串认证规范
  CanonicalRequest = "GET" & vbLf
  CanonicalRequest = CanonicalRequest & "/reports/XXXXXXX" & vbLf
  CanonicalRequest = CanonicalRequest & "X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=MYACCESSKEY%2F20221109%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20221109T075928Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host" & vbLf
  CanonicalRequest = CanonicalRequest & "host:mybucket.s3.eu-west-1.amazonaws.com" & vbLf & vbLf
  CanonicalRequest = CanonicalRequest & "host" & vbLf & "UNSIGNED-PAYLOAD"
  
  Debug.Print "CanonicalRequest:"
  Debug.Print CanonicalRequest
  
  stringToSign = "AWS4-HMAC-SHA256" & vbLf
  stringToSign = stringToSign & "20221109T075928Z" & vbLf
  stringToSign = stringToSign & "20221109/eu-west-1/s3/aws4_request" & vbLf
  stringToSign = stringToSign & get_HASH_SHA256(CanonicalRequest)
  
  Debug.Print "StringToSign:"
  Debug.Print stringToSign
   
  
  SigningKey = HmacSHA256(HmacSHA256(HmacSHA256(HmacSHA256("AWS4" & SecretKey, "20221109"), "eu-west-1"), "s3"), "aws4_request")
  
  Debug.Print "SigningKey:"
  Debug.Print SigningKey
  
  ' 尝试过不做十六进制转换的情况
  Signature = ConvToHexString(HmacSHA256(SigningKey, stringToSign))
  ' 预期结果应为 ****003a740
  ' 实际得到 ***6e9502