Getting this error while trying to use boto3 with ssm

[st3fus]

Hey there, so basically I'm trying to use boto3 with ssm module so I can obtain credentials in runtime from AWS Parameter Store. My python/django backend is being deployed with AWS App Runner service (at least i'm still trying to deploy it for the first time). I've spent around 40hrs battling with this and I can't get past this error:

09-28-2023 05:56:11 PM [28/Sep/2023 15:56:11] "GET /ht HTTP/1.1" 301 0
09-28-2023 05:56:10 PM health_check.exceptions.ServiceUnavailable: unavailable: Unknown exception
09-28-2023 05:56:10 PM     raise ServiceUnavailable("Unknown exception") from e
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/health_check/storage/backends.py", line 67, in check_status
09-28-2023 05:56:10 PM     self.check_status()
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/health_check/backends.py", line 30, in run_check
09-28-2023 05:56:10 PM Traceback (most recent call last):
09-28-2023 05:56:10 PM The above exception was the direct cause of the following exception:
09-28-2023 05:56:10 PM botocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the PutObject operation: The request signature we calculated does not match the signature you provided. Check your key and signing method.
09-28-2023 05:56:10 PM     raise error_class(parsed_response, operation_name)
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/botocore/client.py", line 980, in _make_api_call
09-28-2023 05:56:10 PM     return self._make_api_call(operation_name, kwargs)
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/botocore/client.py", line 535, in _api_call
09-28-2023 05:56:10 PM     client.put_object(Bucket=bucket, Key=key, Body=body, **extra_args)
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/s3transfer/upload.py", line 758, in _main
09-28-2023 05:56:10 PM     return_value = self._main(**kwargs)
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/s3transfer/tasks.py", line 162, in _execute_main
09-28-2023 05:56:10 PM     return self._execute_main(kwargs)
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/s3transfer/tasks.py", line 139, in __call__
09-28-2023 05:56:10 PM     raise self._exception
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/s3transfer/futures.py", line 266, in result
09-28-2023 05:56:10 PM     return self._coordinator.result()
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/s3transfer/futures.py", line 103, in result
09-28-2023 05:56:10 PM     return future.result()
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/boto3/s3/inject.py", line 636, in upload_fileobj
09-28-2023 05:56:10 PM     return self.meta.client.upload_fileobj(
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/boto3/s3/inject.py", line 725, in object_upload_fileobj
09-28-2023 05:56:10 PM     obj.upload_fileobj(content, ExtraArgs=params, Config=self._transfer_config)
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/storages/backends/s3boto3.py", line 445, in _save
09-28-2023 05:56:10 PM     name = self._save(name, content)
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/django/core/files/storage/base.py", line 38, in save
09-28-2023 05:56:10 PM     file_name = storage.save(file_name, ContentFile(content=file_content))
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/health_check/storage/backends.py", line 42, in check_save
09-28-2023 05:56:10 PM     file_name = self.check_save(file_name, file_content)
09-28-2023 05:56:10 PM   File "/usr/local/lib/python3.10/site-packages/health_check/storage/backends.py", line 63, in check_status
09-28-2023 05:56:10 PM Traceback (most recent call last):
09-28-2023 05:56:10 PM unavailable: Unknown exception

Here is my code from settings.py:

ssm_client = boto3.client('ssm', region_name='eu-central-1', config=boto3.session.Config(signature_version='v4', role_arn='redacted'))

def get_ssm_parameter(parameter_name):
    response = ssm_client.get_parameter(Name=parameter_name, WithDecryption=True)
    return response['Parameter']['Value']

These are just few secrets, got about 20 of them

AWS_SECRET_ACCESS_KEY_ID = get_ssm_parameter('SECRET_ACCESS_KEY_ID')
AWS_ACCESS_KEY_ID = get_ssm_parameter('ACCESS_KEY_ID')
AWS_STORAGE_BUCKET_NAME = get_ssm_parameter('STORAGE_BUCKET_NAME')
DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'

I got all middleware and apps installed required for this. If you need anything else provided, please tell me, my brain is swollen at this moment, i've spent way too much time on trying to solve this :)

[aBurmeseDev]

Hi @st3fus - thank you for reaching out and I'm really sorry to hear that you're running into this error.

Let me first try to understand your workflow. I understand that you're using boto3 with SSM client method get_paremeter and I see that you're running into SignatureDoesNotMatch client error.

That's likely due to incorrect aws_secret_access_key or aws_access_key_id. There are also other possible root causes like your secret key has special character (regenerate a new pair in this case) or if you're in a virtual machine, the system time being off as mentioned by a user here. I would also make sure you're using recent version of boto3.

I hope one of those suggestions fixes the issue for you. If the issue persists, please share full debug logs as it would give me more insights into it. You can get boto3 logs by adding boto3.set_stream_logger('') to your code snippet.

Hope it helps,
John

[st3fus]

Sorry, I totally forgot to reply. I solved it, in my case it wasn't incorrect env value, it was incorrect env name...

I had aws_access_key set as env name instead of aws_access_key_id

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.