I am trying to create a Google App Script which will allow users to upload a spreadsheet to S3. Since I couldn’t find an AWS library for App Script that had been updated recently, I’ve been writing the AWS request code myself following this official guide for AWS Signature V4.

I keep getting an error that my signature doesn’t match what AWS expected, and from the response it seems like this is because the hash of the Canonical Request String from step 1 of the guide is different on my end than AWS’. I’ve double-checked with online calculators and they verify my hash.

This is the string I’m hashing:

PUT
/google-sheets-to-s3/Test_171RLxS8MIlbge87d97jhelAawuadxQ3stAeYMrDdb-4/Test_0.json
content-type:application/json
host:s3.ap-southeast-2.amazonaws.com
x-amz-content-sha256:e62b1de6ef3840adb4dae65f5412d15202ddc241c6ba39e5b73dd51ae5613559
x-amz-date:20240508T211604Z
x-amz-target:PutObject

content-type;host;x-amz-content-sha256;x-amz-date;x-amz-target
e62b1de6ef3840adb4dae65f5412d15202ddc241c6ba39e5b73dd51ae5613559

The hash on my end (and according to online tools) is 89aa70c68b8b9f5fc19ebb4e390ff90a654bf638aa2ce4bceb9863753409941d. However, the response from AWS seems to imply they think the hash should be 3903b5152c9165b7c4044faa3dc84c0f4e0b1177665b821bdac234dc2fc71038.

For reference, the function I’m using to generate the hash strings is

const byte_array_to_string = (v) => v.map(byte => {
    if (byte < 0) {
        byte += 256;
    }

    return byte.toString(16).padStart(2, '0');
}).join('');

const SHA256 = (v) => {
    return byte_array_to_string(Utilities.computeDigest(Utilities.DigestAlgorithm.SHA_256, v));
};

...
const StringToSign = [
    'AWS4-HMAC-SHA256',
    RequestDateTime,
    CredentialScope,
    SHA256(CanonicalRequest)
].join('n');

I’ve tried converting the string to different encodings to no avail and have also triple-checked that I’m following the guide. I’ve searched and can’t seem to find anything addressing this problem so any help would be appreciated.