hatoo/oha · error · anyhow::Error

Invalid AWS signing params format. Expected…

Error message

Invalid AWS signing params format. Expected aws:amz:region:service

What it means

AwsSignatureConfig::new parses an AWS SigV4 signing-params string that must have the form `aws:amz:<region>:<service>`. The prefix is stripped, the remainder is split on ':', and if it does not yield exactly two parts (region and service) the constructor fails. This guards against malformed region/service input before any request signing happens.

Solutions

  1. Format the parameter exactly as `aws:amz:<region>:<service>` (e.g. `aws:amz:us-east-1:s3`).
  2. Ensure there are no extra colon-separated segments after region and service.
  3. Check for accidental whitespace or typos in the `aws:amz:` prefix.

Example fix

// before
AwsSignatureConfig::new(ak, sk, "us-east-1:s3", None)?
// after
AwsSignatureConfig::new(ak, sk, "aws:amz:us-east-1:s3", None)?
Defensive patterns

Strategy: validation

Validate before calling

fn is_valid_signing_params(s: &str) -> bool {
    match s.strip_prefix("aws:amz:") {
        Some(rest) => rest.split(':').count() == 2,
        None => false,
    }
}

Type guard

fn valid_signing_params(s: &str) -> Option<(&str, &str)> {
    let rest = s.strip_prefix("aws:amz:")?;
    let mut it = rest.splitn(3, ':');
    let region = it.next()?;
    let service = it.next()?;
    if it.next().is_some() { return None; }
    Some((region, service))
}

Try / catch

match AwsSignatureConfig::new(ak, sk, params, token) {
    Ok(cfg) => /* use cfg */,
    Err(e) if e.to_string().contains("Invalid AWS signing params format") => {
        eprintln!("Expected format: aws:amz:<region>:<service>, got: {params}");
    }
    Err(e) => return Err(e),
}

Prevention

When it happens

Trigger: Calling AwsSignatureConfig::new with a signing_params string that is missing the `aws:amz:` prefix, or whose remainder splits into more or fewer than two colon-separated parts (e.g. `us-east-1` alone, or `aws:amz:region:service:extra`).

Common situations: Copy-pasting a SigV4 string from documentation with the wrong prefix; including a colon-bearing extra segment such as a service suffix or profile name; forgetting the prefix entirely and passing just `region:service`.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of hatoo/oha@4efba2d113 (2026-09-09). Data as JSON: /api/errors/81659659bc67916d. Report an issue: GitHub.

Appendix: source

Thrown at src/aws_auth.rs:127

                .map_err(|_| AwsSignatureError::InvalidAuthorization(signature.to_string()))?,
        );

        Ok(())
    }

    pub fn new(
        access_key: &str,
        secret_key: &str,
        signing_params: &str,
        session_token: Option<String>,
    ) -> Result<Self, anyhow::Error> {
        let parts: Vec<&str> = signing_params
            .strip_prefix("aws:amz:")
            .unwrap_or_default()
            .split(':')
            .collect();
        if parts.len() != 2 {
            anyhow::bail!("Invalid AWS signing params format. Expected aws:amz:region:service");
        }

        Ok(Self {
            access_key: access_key.into(),
            secret_key: secret_key.into(),
            session_token,
            region: parts[0].to_string(),
            service: parts[1].to_string(),
        })
    }
}

View on GitHub (pinned to 4efba2d113)