AuthorizationHeaderMalformed when using credentials.NewStaticCredentialsProvider

[snebel29]

Hi,
We have a requirement to provide configuration to the SDK, such as Access and Secret key programatically, read from our own internal configuration instead of from ~/.aws/config and ~/.aws/credentials and/or from AWS environment variables.

The following client, using a StaticCredentialsProvider seems to be working fine with S3 services from other vendors, except AWS one.

func NewAWSClient() (*AWSClient, error) {
	endpoint := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
		return aws.Endpoint{
			URL: "https://s3.us-west-2.amazonaws.com",
		}, nil
	})
	cfg := aws.Config{
		Region:  "us-west-2",
		Credentials:  credentials.NewStaticCredentialsProvider("accessKey", "secretKey", ""),
		EndpointResolverWithOptions: endpoint,
	}
	return &AWSClient{Client: s3.NewFromConfig(cfg)}, nil
}

When hitting AWS endpoint, this client return the following error:

api error AuthorizationHeaderMalformed: The authorization header is malformed; a non-empty region must be provided in the credential.

Of course if you load the configuration from the environment using LoadDefaultConfig instead, everything works fine.

func NewAWSClient() (*AWSClient, error) {
	endpoint := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
		return aws.Endpoint{
			URL: "https://s3.us-west-2.amazonaws.com",
		}, nil
	})
	cfg, err := config.LoadDefaultConfig(context.TODO())
	if err != nil {
		return nil, fmt.Errorf("couldn't load default configuration. Have you set up your AWS account?")
	}
	return &AWSClient{Client: s3.NewFromConfig(cfg)}, nil
}

I also tried to create the default with aStaticCredentialsProvider with the same result

	cfg, err := config.LoadDefaultConfig(context.TODO(),
		config.WithRegion("us-west-2"),
		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(opts.AccessKey, opts.SecretKey, "")),
		config.WithEndpointResolverWithOptions(endpoint),
	)

As I said we have a requirement to provide config from our own sources, which have a different format.

Is there a work around to this issue?

Thanks in advance.

[snebel29]

Oh, I think I found where the problem was, I was missing SigningRegion in the custom endpoint resolver.

	endpoint := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
		return aws.Endpoint{
			URL: "https://s3.us-west-2.amazonaws.com",
                         SigningRegion:    "us-west-2",
		}, nil
	})

Cheers.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.