title: Is there a way to use an AWS signed URL to perform a multipart upload?
body: <p>I'm writing a client for a service that provides a signed url for uploads. This works just fine for smaller uploads, but fails for larger uploads that would be benefit from using a multipart upload.</p>
  
  <p>The authorization docs suggest that I can use the provided signature and access key id in both the URL or via the Authorization header. I"ve tried using the header approach to start the multipart upload, but I get an access denied. When I use the query string approach, I get a method not allowed (POST in this case). </p>
  
  <p>I'm using boto to generate the URL. For example:</p>
  
  <pre><code>import boto
  
  c = boto.connect_s3()
  bucket = c.get_bucket('my-bucket')
  key = boto.s3.key.Key(bucket, 'my-big-file.gz')
  signed_url = key.generate_url(60 * 60, 'POST')  # expires in an hour
  </code></pre>
  
  <p>Then when trying to start the multipart upload using the signed URL, I'm doing the following:</p>
  
  <pre><code>import requests
  
  url = signed_url + '&amp;uploads'
  resp = requests.post(url)
  </code></pre>
  
  <p>This returns a method not allowed. </p>
  
  <p>Is this strategy possible? Is there a better way to provide limited credentials to a specific resource in order to allow large multipart uploads?</p>
  
  <p><strong>Update</strong></p>
  
  <p>I've managed to find a slightly more specific error that makes me think this isn't possible. Unfortunately, I get a 403 saying that the signature doesn't match the request.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;
    &lt;Code&gt;SignatureDoesNotMatch&lt;/Code&gt;
    &lt;Message&gt;The request signature we calculated does not match the signature you
    provided. Check your key and signing method.&lt;/Message&gt;
    &lt;StringToSignBytes&gt;.../StringToSignBytes&gt;
    &lt;RequestId&gt;...&lt;/RequestId&gt;
    &lt;HostId&gt;...&lt;/HostId&gt;
    &lt;SignatureProvided&gt;...&lt;/SignatureProvided&gt;
    &lt;StringToSign&gt;POST
  
  
    1402941975
    /my-sandbox/test-mp-upload.txt?uploads&lt;/StringToSign&gt;
    &lt;AWSAccessKeyId&gt;...&lt;/AWSAccessKeyId&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p>This makes me think that I won't be able to use the signed URL because the signature won't match.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I've decided that it is not reasonable to use a signed URL for a multipart upload. While I suspect it is technical possible, it is not practical. The reason being is that a signed URL requires the URL, headers and request method all match exactly in order to work as expected. As a multipart upload needs to initialize the upload, upload each part and finalize (or cancel) the upload, it would be some what painful to generate URLs for each step. </p>
  
  <p>Instead, I found can create a federated token to provide read / write access to a specific key in a bucket. This ends up being more practical and simple because I can immediately use boto as though I had credentials. </p>