PROBLEM WITH RECREATION OF AWS SIGNATURE

Question

I have used AWS AssumeRole to access S3 bucket objects using the access key, secret key, and ID token. I am making API calls via Postman using AWS signature. The problem we are facing is that whenever a new API call is made using these credentials, Postman will create a new signature each time. Is there any similar token available that doesn't recreate the signature each time?

Answer

Hi, the SigV4 used to access AWS services is anyway usable for only 15 min: see https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html

```
Protect against reuse of the signed portions of the request – The signed portions 
(using AWS Signatures) of requests are valid within 15 minutes of the timestamp 
in the request. An unauthorized party who has access to a signed request can modify 
the unsigned portions of the request without affecting the request's validity in the 15 
minute window. Because of this, we recommend that you maximize protection by signing
 request headers and body, making HTTPS requests to Amazon S3, and by using 
the s3:x-amz-content-sha256  condition key (see Amazon S3 Signature Version 4 Authentication 
Specific Policy Keys) in AWS policies to require users to sign Amazon S3 request bodies.
```

This will help you in generating those signatures for Postman: https://blog.knoldus.com/how-to-generate-aws-signature-with-postman/

Best,

Didier

PROBLEM WITH RECREATION OF AWS SIGNATURE

Relevant content