[Ask] "InvalidSignatureException: Signature expired" still exist

[knightazura]

Hello everyone.

I think this is a quite old issue but I decide to create a discussion thread instead to not populated issues with same problem again and again. I've read about this, especially in this issue report #527.

So basically, I've done applied AWS.config.correctClockSkew = true; but this issue still occurs. It happened when I request invocation to SageMaker endpoint. It quite confuses me, as my application deployed on ECS Fargate which is in AWS infrastructure, and why this issue still occurs.

Any help or information would be appreciated. Thank you.

Details
Node version 16
AWS SDK version 2.1194.0
Deployed on ECS Fargate (platform version 1.3.0)

Example error

InvalidSignatureException: Signature expired: 20220812T015006Z is now earlier than 20220812T015006Z (20220812T015506Z - 5 min.)
    at Object.extractError (/usr/src/app/node_modules/aws-sdk/lib/protocol/json.js:52:27)
    at Request.extractError (/usr/src/app/node_modules/aws-sdk/lib/protocol/rest_json.js:55:8)
    at Request.callListeners (/usr/src/app/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
    at Request.emit (/usr/src/app/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
    at Request.emit (/usr/src/app/node_modules/aws-sdk/lib/request.js:688:14)
    at Request.transition (/usr/src/app/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/usr/src/app/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /usr/src/app/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/usr/src/app/node_modules/aws-sdk/lib/request.js:38:9)
    at Request.<anonymous> (/usr/src/app/node_modules/aws-sdk/lib/request.js:690:12)

[ajredniwja]

@knightazura thanks for opening the discussion. This error occurs when signature generated is no longer valid coz of the timestamp created with signature does not match that on the machine. Can you also share some of the code you are using to reproduce?

[knightazura]

Hi @ajredniwja
Thanks for reply and information.

Sure, here's part of the code.

const AWS = require('aws-sdk');

AWS.config.correctClockSkew = true;

const getRecommendation = async (user_id) => {
  try 
    // attempt to get recommendation from cache

    const sagemakerruntime = new AWS.SageMakerRuntime({region: 'eu-west-1'});
    const data = await sagemakerruntime
      .invokeEndpoint({
        Body: Buffer.from(`{"user_id":"${user_id}","top_n":200}`),
        EndpointName: 'personalized-feed',
        Accept: 'application/json',
        ContentType: 'application/json',
      })
      .promise();
    const str_body = Buffer.from(data.Body).toString('utf8');
    
    // return output;
  } catch (error) {
    throw error;
  }
};

module.exports = {
  getRecommendation,
  ...
}

Basically, above code called from GraphQL resolver. It just simple resolver, only called that method and return to user. No other processes involved.

Let me know if you need more information.

---

This error occurs when signature generated is no longer valid

@ajredniwja may I know, when exactly was this signature generated? Creation time of signature taken from host machine or from anywhere else?

Is there any possibilities that signature generated first and then it's invalid because that signature not used immediately? Let say, it's blocked by other processes for some time before it's used.