Problem description
OSS cannot find the AccessKey ID in a request that uses Security Token Service (STS) temporary credentials for authentication.
Causes
The AccessKey ID in the request does not match the AccessKey ID issued by STS. For example, the request uses STS temporary credentials but includes the permanent AccessKey ID of a RAM user instead of the STS-issued AccessKey ID.
A RAM user's AccessKey ID is used for authentication, but the request also includes a
security-tokenparameter in the signed URL or anx-oss-security-tokenheader. When OSS detects either of these fields, it switches to STS-based authentication and finds that the RAM user's AccessKey ID does not match the STS-issued AccessKey ID.The STS-issued AccessKey ID has expired.
Examples
STS temporary credentials are used in the request, but the AccessKey ID specified in the request is the permanent AccessKey ID of a RAM user, not the AccessKey ID obtained from STS.
The intent is to authenticate as a RAM user, but the
security-tokenfield is included as a parameter in the signed URL, or thex-oss-security-tokenfield is included in the request headers. This causes OSS to authenticate the request using STS credentials instead of RAM user credentials.The AccessKey ID obtained from STS is used to send a request, but the temporary credentials have since expired.
Solutions
Make sure that the AccessKey ID specified in the request is consistent with the AccessKey ID obtained from STS. For more information, see Use temporary credentials provided by STS to access OSS.
To authenticate as a RAM user, remove the
security-tokenparameter from the signed URL and thex-oss-security-tokenheader from the request before sending it. For more information, see Use the AccessKey pair of a RAM user to initiate a request.Obtain new temporary access credentials from STS. For more information, see Use temporary credentials provided by STS to access OSS.