PHP - Delete object from AWS S3 with REST API - php

Question

I am trying to delete object from amazon s3 with REST API.
I create a curl command but I get 403 error: "SignatureDoesNotMatchThe request signature we calculated does not match the signature you provided".
I used in AWS documentation:
https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectDELETE.html
https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
This is my code:
$host = 's3.amazonaws.com';
$url = "https://" . $bucket . '.' . $host . '/' . $file;
$date_full = date('D, d M Y H:i:s \G\M\T');
$date = date('Ymd');
$longDate = gmdate('Ymd\THis\Z');
$shortDate = gmdate('Ymd');
$credential = $accessKeyId . '/' . $shortDate . '/' . $region . '/s3/aws4_request';
$hashed_payload = strtolower(hash("sha256", ""));
$headers = [
'X-Amz-Algorithm' => 'AWS4-HMAC-SHA256',
'X-Amz-Credential' => $credential,
'X-Amz-Date' => $longDate,
'X-Amz-Expires' => 86400,
'X-Amz-SignedHeaders' => 'host',
'x-amz-content-sha256' => $hashed_payload,
'Host' => $bucket . '.' . $host,
];
ksort($headers);
$signed_headers_string = strtolower(implode(';', array_keys($headers)));
// Build canonical request
$canonical_request = "DELETE\n"; // HTTPRequestMethod
$canonical_request .= '/' . urlencode("http://s3.amazonaws.com/" . $bucket . "/" . $file) . "\n"; // CanonicalURI
$canonical_request .= "\n"; // CanonicalQueryString
foreach ($headers as $header => $value) {
$canonical_request .= strtolower($header) . ':' . trim($value) . "\n"; //CanonicalHeaders
}
$canonical_request .= $signed_headers_string . "\n"; // SignedHeaders
$canonical_request .= $hashed_payload; // HashedPayload
// Build string to sign
$string_to_sign = "AWS4-HMAC-SHA256\n";
$string_to_sign .= $date_full . "\n";
$string_to_sign .= $date . '/' . $region. "/s3/aws4_request\n";
$string_to_sign .= hash('sha256', $canonical_request);
// Calculate signature
$signature_date = hash_hmac('sha256', $date, 'AWS4' . $secretKey, true);
$signature_region = hash_hmac('sha256', $region, $signature_date, true);
$signature_service = hash_hmac('sha256', 's3', $signature_region, true);
$signature_request = hash_hmac('sha256', 'aws4_request', $signature_service, true);
// Build Signature
$signature = hash_hmac('sha256', $string_to_sign, $signature_request);
// Calculate final Authorization header
$headers['Authorization'] = 'AWS4-HMAC-SHA256 Credential=' . $credential . ', ';
$headers['Authorization'] .= 'SignedHeaders=' . $signed_headers_string . ', ';
$headers['Authorization'] .= 'Signature=' . $signature;
// Convert headers to key:value strings
$curl_headers = array();
foreach ($headers as $header => $value) {
$curl_headers[] = "{$header}:{$value}";
}
// Init curl
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_VERBOSE, 1);
curl_setopt($curl, CURLOPT_CUSTOMREQUEST, 'PUT');
curl_setopt($curl, CURLINFO_HEADER_OUT, true);
curl_setopt($curl, CURLOPT_HEADER, true);
curl_setopt($curl, CURLOPT_HTTPHEADER, $curl_headers);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_CUSTOMREQUEST, "DELETE");
$result = curl_exec($curl);
Someone can help me please to understand what is the problem?

Answer 1

You are sorting keys that have upper and lower case letters. Use all lower case letters in the keys before calling ksort().
You are also including headers that don't need to be included. The documentation you referred to only asks for x-amz-date, x-amz-content-sha256, and host. Use only those headers.
$headers = [
'x-amz-date' => $longDate,
'x-amz-content-sha256' => $hashed_payload,
'host' => $bucket . '.' . $host,
];
ksort($headers);
Your canonical request should have an extra line break after adding the headers:
foreach ($headers as $header => $value) {
$canonical_request .= strtolower($header) . ':' . trim($value) . "\n"; //CanonicalHeaders
}
$canonical_request .= "\n";
I'm not sure if this change is necessary, but in $string_to_sign, I use the date format provided by $longDate, not $date_full:
// Build string to sign
$string_to_sign = "AWS4-HMAC-SHA256\n";
$string_to_sign .= $longDate . "\n";
$string_to_sign .= $date . '/' . $region. "/s3/aws4_request\n";
$string_to_sign .= hash('sha256', $canonical_request);
You are setting CURLOPT_CUSTOMREQUEST twice, first to PUT and then to DELETE. The last setting is likely the one being used, but I would remove curl_setopt($curl, CURLOPT_CUSTOMREQUEST, 'PUT'); for the sake of clarity.