0002-00000004

Problem description

The security token and temporary AccessKey pair used to authenticate an OSS request do not match the credentials returned by the AssumeRole operation.

Causes

Each AssumeRole call returns a credential set with three fields that must be used together:

• AccessKey ID — the temporary access key ID (prefixed with STS.)

• AccessKey secret — the temporary access key secret

• Security token — the session token associated with this credential set

If any of these fields comes from a different AssumeRole response, authentication fails.

Examples

URL-signed requests: The OSSAccessKeyId parameter in the URL uses an AccessKey ID from one STS call, but the security-token parameter uses a token from a different STS call.

Header-authenticated requests: The AccessKey ID used in the headers of the request to access OSS comes from one STS call, but the x-oss-security-token header uses a token from a different STS call.

Solutions

1. Call the AssumeRole operation or use an STS SDK to get temporary access credentials. The response includes all three fields: AccessKey ID, AccessKey secret, and security token. For more information, see Use temporary credentials provided by STS to access OSS.

2. Use an SDK or call the RESTful API operation to initiate a request using all three fields from that single AssumeRole response. For example, a presigned URL with all three fields from the same AssumeRole response:

      https://examplebucket.oss-cn-hangzhou.aliyuncs.com/oss-api.pdf?OSSAccessKeyId=STS.nz2pc56s936****&Expires=1141889120&Signature=vjbyPxybdZaNmGa%2ByT272YEAiv****&security-token=CAISowJ1q6Ft5B2yfSjIr5bgIOz31blR9oWmWBfCs3kDR/xm3Imc1zz2IHxMdHJsCeAcs/Q0lGFR5/sflqJIRoReREvCUcZr8szfWcsZos2T1fau5Jko1be0ewHKeQKZsebWZ+LmNpy/Ht6md1HDkAJq3LL+bk/Mdle5MJqP+/kFC9MMRVuAcCZhDtVbLRcYgq18D3bKMuu3ORPHm3fZCFES2jBxkmRi86+ysIP+phPVlw/90fRH5dazcJW0Zsx0OJo6Wcq+3+FqM6DQlTNM6hwNtoUO1fYUommb54nDXwQIvUjfbtC5qIM/cFVLAYEhALNBofTGkvl1h/fejYyfyWwWYbkFCHiPFNr9kJCUSbr4a4sjF6zyPnPWycyCLYXleLzhxPWd/2kagAGaXG69BqwYNvrKKI3W8weP3bNc1wQDMXQfiHpFCRG6lYhh3iXFtpwH90A3sTlxzRGvi8+9p63JwrluOHWs+Fj6S6s0cOhKvKRWYE8UuWeXIvv4l6DAGwHDE8BLjLC11f5prUJgI2wb+3hwuBod32Jx+us/1p996Glao725orcb****