Net::Amazon::S3::Signature::V4 does not support session tokens.

[galenhuntington]

They appear to never be included in the request, which means that (e.g.) use_iam_role requests always fail with a "forbidden" error whenever V4 is used.

My workaround is to force use of V2 for all requests. Maybe until this is fixed that should be done throughout Net::Amazon::S3, as the current configuration breaks any workflow that requires security tokens.

[branislav-zahradnik-gdc]

Thank you for report.

Fixing this may take a while :-( To be honest I have no idea how these security tokens work so lot of googling / reading ahead.

[ranguard]

Hi @galenhuntington maybe try using https://metacpan.org/pod/Paws::S3 ?

@branislav-zahradnik-gdc other than size and interface design (which I like much better), is there any specific advantage this package has over Paws::S3? - should we consider just wrapping it? - just throwing ideas out there.

[ranguard]

Oh! not sure https://metacpan.org/pod/Paws::S3 support session tokens either?

[galenhuntington]

Paws::S3 is not ready for production, or at least it emits this warning:

Paws::S3 is not stable / supported / entirely developed.

See pplu/aws-sdk-perl#244. I don't know if it supports tokens, but I assume it does.

Anyway, Paws has potential, but it does lack object-oriented abstraction. E.g., there is no "bucket object", but rather a bunch of flat API calls each of which includes the bucket name.

As for this project, it seems best to disable V4 until it is fully implemented.

[branislav-zahradnik-gdc]

@ranguard in long run maybe. For now Paws says not stable, is way too complex, and it doesn't support signed uri operations (minor but crucial)

[ranguard]

All good points - thanks thought it was actually further along !

[CWallace-dealersocket]

Amazon is dropping support for requests using the V2 signature method on June 24th 2019. So in a couple of months, using the workaround by forcing the V2 method will no longer work.

[branislav-zahradnik-gdc]

@galenhuntington Fix created but solely based on documentation. I never used IAM roles before so I'm not sure whether I tested it properly.

[edencrane]

This fix works for me. Thank you!

[galenhuntington]

@branislav-zahradnik-gdc it is working for me too. Awesome, thanks!

[ranguard]

I'll do a release in next couple of days