używać interfejsów API AWS z Pythonem do korzystania z usług Polly

Question

Ponieważ nie udało mi się zintegrować Boto3 z Google App Engine, staram się używać interfejsów API bezpośrednio przy użyciu dokumentów: jako że Polly (text to speech API) używa procesu Signature Version 4 , ja skieruję do:

http://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html

Oto dany skrypt:

#http://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html 

# AWS Version 4 signing example 

# EC2 API (DescribeRegions) 

# See: http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html 
# This version makes a GET request and passes the signature 
# in the Authorization header. 
import sys, os, base64, datetime, hashlib, hmac 
sys.path.append('../') 
import requests # pip install requests 

# Read AWS access key from env. variables or configuration file. Best practice is NOT 
# to embed credentials in code. 
access_key = os.environ.get('AWS_ACCESS_KEY_ID') 
secret_key = os.environ.get('AWS_SECRET_ACCESS_KEY') 
if access_key is None or secret_key is None: 
    print 'No access key is available.' 
    sys.exit() 

# ************* REQUEST VALUES ************* 
method = 'GET' 
##service = 'ec2' 
##host = 'ec2.amazonaws.com' 
##region = 'us-east-1' 
##endpoint = 'https://ec2.amazonaws.com' 
##request_parameters = 'Action=DescribeRegions&Version=2013-10-15' 
##### START MODIFIED VALUES ####### 
service='polly' 
host='polly.eu-west-1.amazonaws.com' 
region='eu-west-1' 
endpoint='https://'+host+'/v1/voices' 
request_parameters='LanguageCode=en-US' 
####### END MODIFIED VALUES ####### 

# Key derivation functions. See: 
# http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python 
def sign(key, msg): 
    return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest() 

def getSignatureKey(key, dateStamp, regionName, serviceName): 
    kDate = sign(('AWS4' + key).encode('utf-8'), dateStamp) 
    kRegion = sign(kDate, regionName) 
    kService = sign(kRegion, serviceName) 
    kSigning = sign(kService, 'aws4_request') 
    return kSigning 

# Create a date for headers and the credential string 
t = datetime.datetime.utcnow() 
amzdate = t.strftime('%Y%m%dT%H%M%SZ') 
datestamp = t.strftime('%Y%m%d') # Date w/o time, used in credential scope 


# ************* TASK 1: CREATE A CANONICAL REQUEST ************* 
# http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html 

# Step 1 is to define the verb (GET, POST, etc.)--already done. 

# Step 2: Create canonical URI--the part of the URI from domain to query 
# string (use '/' if no path) 
canonical_uri = '/' 

# Step 3: Create the canonical query string. In this example (a GET request), 
# request parameters are in the query string. Query string values must 
# be URL-encoded (space=%20). The parameters must be sorted by name. 
# For this example, the query string is pre-formatted in the request_parameters variable. 
canonical_querystring = request_parameters 

# Step 4: Create the canonical headers and signed headers. Header names 
# must be trimmed and lowercase, and sorted in code point order from 
# low to high. Note that there is a trailing \n. 
canonical_headers = 'host:' + host + '\n' + 'x-amz-date:' + amzdate + '\n' 

# Step 5: Create the list of signed headers. This lists the headers 
# in the canonical_headers list, delimited with ";" and in alpha order. 
# Note: The request can include any headers; canonical_headers and 
# signed_headers lists those that you want to be included in the 
# hash of the request. "Host" and "x-amz-date" are always required. 
signed_headers = 'host;x-amz-date' 

# Step 6: Create payload hash (hash of the request body content). For GET 
# requests, the payload is an empty string (""). 
payload_hash = hashlib.sha256('').hexdigest() 

# Step 7: Combine elements to create create canonical request 
canonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hash 


# ************* TASK 2: CREATE THE STRING TO SIGN************* 
# Match the algorithm to the hashing algorithm you use, either SHA-1 or 
# SHA-256 (recommended) 
algorithm = 'AWS4-HMAC-SHA256' 
credential_scope = datestamp + '/' + region + '/' + service + '/' + 'aws4_request' 
string_to_sign = algorithm + '\n' + amzdate + '\n' + credential_scope + '\n' + hashlib.sha256(canonical_request).hexdigest() 


# ************* TASK 3: CALCULATE THE SIGNATURE ************* 
# Create the signing key using the function defined above. 
signing_key = getSignatureKey(secret_key, datestamp, region, service) 

# Sign the string_to_sign using the signing_key 
signature = hmac.new(signing_key, (string_to_sign).encode('utf-8'), hashlib.sha256).hexdigest() 


# ************* TASK 4: ADD SIGNING INFORMATION TO THE REQUEST ************* 
# The signing information can be either in a query string value or in 
# a header named Authorization. This code shows how to use a header. 
# Create authorization header and add to request headers 
authorization_header = algorithm + ' ' + 'Credential=' + access_key + '/' + credential_scope + ', ' + 'SignedHeaders=' + signed_headers + ', ' + 'Signature=' + signature 

# The request can include any headers, but MUST include "host", "x-amz-date", 
# and (for this scenario) "Authorization". "host" and "x-amz-date" must 
# be included in the canonical_headers and signed_headers, as noted 
# earlier. Order here is not significant. 
# Python note: The 'host' header is added automatically by the Python 'requests' library. 
headers = {'x-amz-date':amzdate, 'Authorization':authorization_header} 


# ************* SEND THE REQUEST ************* 
request_url = endpoint + '?' + canonical_querystring 

print '\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++' 
print 'Request URL = ' + request_url 
print 'Header' 
print headers 

r = requests.get(request_url, headers=headers) 

print '\nRESPONSE++++++++++++++++++++++++++++++++++++' 
print 'Response code: %d\n' % r.status_code 
print r.text 

I pojawia się komunikat o błędzie:

BEGIN REQUEST++++++++++++++++++++++++++++++++++++ 
Request URL = https://polly.eu-west-1.amazonaws.com/v1/voices?LanguageCode=en-US 

RESPONSE++++++++++++++++++++++++++++++++++++ 
Response code: 403 

{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'GET\n/v1/voices\nLanguageCode=en-US\nhost:polly.eu-west-1.amazonaws.com\nx-amz-date:20170122T160127Z\n\nhost;x-amz-date\ne3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'\n\nThe String-to-Sign should have been\n'AWS4-HMAC-SHA256\n20170122T160127Z\n20170122/eu-west-1/polly/aws4_request\n6e1004fbcc11a73baa0c7fe9ff8d5629bada5061fdc8b03fbf307696ea41728d'\n"} 

Jak mogę to debugować? Podejrzewam, że nie jest to tajny problem z kluczami, ponieważ działają w boto3

Answer 1

Gorąco odradzam tworzenie własnych żądań HTTP ręcznie w celu interakcji z usługami AWS. Sam zbudujesz sygnaturę AWS, wkroczysz w niekończący się świat 403 błędów, bólu i nędzy.

Korzystanie z to naprawdę jedyny sposób na to, aby przejść do środowiska Python.

(nawiasem mówiąc, this might help you coraz boto3 pracować wewnątrz lokalnego serwera dev)

Answer 2

I wreszcie naprawił. Ten kod jest teraz bardziej ogólny niż przykład podany w dokumencie. To pozwoli ci zaoszczędzić 20Mb z boto3 SDK dla samej usługi zamiany tekstu na mowę!

# From AWS Version 4 signing example 

# IAM API (CreateUser) adapted to Polly service 

# See: http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html 
# This version makes a GET request and passes request parameters 
# and authorization information in the query string 
import sys, os, base64, datetime, hashlib, hmac, urllib 
sys.path.append('../') 
import requests # pip install requests 

# Read AWS access key from env. variables or configuration file. Best practice is NOT 
# to embed credentials in code. 
access_key = os.environ.get('AWS_ACCESS_KEY_ID') 
secret_key = os.environ.get('AWS_SECRET_ACCESS_KEY') 
if access_key is None or secret_key is None: 
    print 'No access key is available.' 
    sys.exit() 

# ************* REQUEST VALUES ************* 
method = 'GET' 
service='polly' 
region='eu-west-1' 
host=service+'.'+region+'.amazonaws.com' 
api='/v1/voices' 
endpoint='https://'+host+api 
request_parameters='LanguageCode=en-US' # urlencoded and if several should be sorted by aplphabetical order 

# Key derivation functions. See: 
# http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python 
def sign(key, msg): 
    return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest() 

def getSignatureKey(key, dateStamp, regionName, serviceName): 
    kDate = sign(('AWS4' + key).encode('utf-8'), dateStamp) 
    kRegion = sign(kDate, regionName) 
    kService = sign(kRegion, serviceName) 
    kSigning = sign(kService, 'aws4_request') 
    return kSigning 



# Create a date for headers and the credential string 
t = datetime.datetime.utcnow() 
amz_date = t.strftime('%Y%m%dT%H%M%SZ') # Format date as YYYYMMDD'T'HHMMSS'Z' 
datestamp = t.strftime('%Y%m%d') # Date w/o time, used in credential scope 


# ************* TASK 1: CREATE A CANONICAL REQUEST ************* 
# http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html 

# Because almost all information is being passed in the query string, 
# the order of these steps is slightly different than examples that 
# use an authorization header. 

# Step 1: Define the verb (GET, POST, etc.)--already done. 

# Step 2: Create canonical URI--the part of the URI from domain to query 
# string (use '/' if no path) 
canonical_uri = api #'/' 

# Step 3: Create the canonical headers and signed headers. Header names 
# must be trimmed and lowercase, and sorted in code point order from 
# low to high. Note trailing \n in canonical_headers. 
# signed_headers is the list of headers that are being included 
# as part of the signing process. For requests that use query strings, 
# only "host" is included in the signed headers. 
canonical_headers = 'host:' + host + '\n' 
signed_headers = 'host' 

# Match the algorithm to the hashing algorithm you use, either SHA-1 or 
# SHA-256 (recommended) 
algorithm = 'AWS4-HMAC-SHA256' 
credential_scope = datestamp + '/' + region + '/' + service + '/' + 'aws4_request' 

# Step 4: Create the canonical query string. In this example, request 
# parameters are in the query string. Query string values must 
# be URL-encoded (space=%20). The parameters must be sorted by name. 
canonical_querystring = request_parameters 
canonical_querystring += '&X-Amz-Algorithm=AWS4-HMAC-SHA256' 
canonical_querystring += '&X-Amz-Credential=' + urllib.quote_plus(access_key + '/' + credential_scope) 
canonical_querystring += '&X-Amz-Date=' + amz_date 
canonical_querystring += '&X-Amz-Expires=30' 
canonical_querystring += '&X-Amz-SignedHeaders=' + signed_headers 

# Step 5: Create payload hash. For GET requests, the payload is an 
# empty string (""). 
payload_hash = hashlib.sha256('').hexdigest() 

# Step 6: Combine elements to create create canonical request 
canonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hash 

# ************* TASK 2: CREATE THE STRING TO SIGN************* 
string_to_sign = algorithm + '\n' + amz_date + '\n' + credential_scope + '\n' + hashlib.sha256(canonical_request).hexdigest() 

# ************* TASK 3: CALCULATE THE SIGNATURE ************* 
# Create the signing key 
signing_key = getSignatureKey(secret_key, datestamp, region, service) 

# Sign the string_to_sign using the signing_key 
signature = hmac.new(signing_key, (string_to_sign).encode("utf-8"), hashlib.sha256).hexdigest() 


# ************* TASK 4: ADD SIGNING INFORMATION TO THE REQUEST ************* 
# The auth information can be either in a query string 
# value or in a header named Authorization. This code shows how to put 
# everything into a query string. 
canonical_querystring += '&X-Amz-Signature=' + signature 


# ************* SEND THE REQUEST ************* 
# The 'host' header is added automatically by the Python 'request' lib. But it 
# must exist as a header in the request. 
request_url = endpoint + "?" + canonical_querystring 

print '\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++' 
print 'Request URL = ' + request_url 
r = requests.get(request_url) 

print '\nRESPONSE++++++++++++++++++++++++++++++++++++' 
print 'Response code: %d\n' % r.status_code 
print r.text 

i tutaj jest wersja dla POST (/ v1/mowy)

# Uses same import and key derivation function as above 
# ************* REQUEST VALUES ************* 
method = 'POST' 
service='polly' 
region='eu-west-1' 
host=service+'.'+region+'.amazonaws.com' 
api='/v1/speech' 
endpoint = 'https://'+host+api 
# POST requests use a content type header. For Polly, 
# the content is JSON. WARNING : not always the case for all AWS services 
content_type = 'application/json' 


request_parameters = '{' 
request_parameters += '"OutputFormat": "mp3",' 
request_parameters += '"Text": "a text to speech test",' 
request_parameters += '"TextType": "text",' 
request_parameters += '"VoiceId": "Brian"' 
request_parameters += '}' 

# Create a date for headers and the credential string 
t = datetime.datetime.utcnow() 
amz_date = t.strftime('%Y%m%dT%H%M%SZ') 
date_stamp = t.strftime('%Y%m%d') # Date w/o time, used in credential scope 


# ************* TASK 1: CREATE A CANONICAL REQUEST ************* 
# http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html 

# Step 1 is to define the verb (GET, POST, etc.)--already done. 

# Step 2: Create canonical URI--the part of the URI from domain to query 
# string (use '/' if no path) 
canonical_uri = api 

## Step 3: Create the canonical query string. In this example, request 
# parameters are passed in the body of the request and the query string 
# is blank. 
canonical_querystring = '' 

# Step 4: Create the canonical headers. Header names must be trimmed 
# and lowercase, and sorted in code point order from low to high. 
# Note that there is a trailing \n. 
#canonical_headers = 'content-type:' + content_type + '\n' + 'host:' + host + '\n' + 'x-amz-date:' + amz_date + '\n' + 'x-amz-target:' + amz_target + '\n' 
canonical_headers = 'content-type:' + content_type + '\n' + 'host:' + host + '\n' + 'x-amz-date:' + amz_date + '\n' 


# Step 5: Create the list of signed headers. This lists the headers 
# in the canonical_headers list, delimited with ";" and in alpha order. 
# Note: The request can include any headers; canonical_headers and 
# signed_headers include those that you want to be included in the 
# hash of the request. "Host" and "x-amz-date" are always required. 

signed_headers = 'content-type;host;x-amz-date' 

# Step 6: Create payload hash. In this example, the payload (body of 
# the request) contains the request parameters. 
payload_hash = hashlib.sha256(request_parameters).hexdigest() 

# Step 7: Combine elements to create create canonical request 
canonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hash 


# ************* TASK 2: CREATE THE STRING TO SIGN************* 
# Match the algorithm to the hashing algorithm you use, either SHA-1 or 
# SHA-256 (recommended) 
algorithm = 'AWS4-HMAC-SHA256' 
credential_scope = date_stamp + '/' + region + '/' + service + '/' + 'aws4_request' 
string_to_sign = algorithm + '\n' + amz_date + '\n' + credential_scope + '\n' + hashlib.sha256(canonical_request).hexdigest() 


# ************* TASK 3: CALCULATE THE SIGNATURE ************* 
# Create the signing key using the function defined above. 
signing_key = getSignatureKey(secret_key, date_stamp, region, service) 

# Sign the string_to_sign using the signing_key 
signature = hmac.new(signing_key, (string_to_sign).encode('utf-8'), hashlib.sha256).hexdigest() 


# ************* TASK 4: ADD SIGNING INFORMATION TO THE REQUEST ************* 
# Put the signature information in a header named Authorization. 
authorization_header = algorithm + ' ' + 'Credential=' + access_key + '/' + credential_scope + ', ' + 'SignedHeaders=' + signed_headers + ', ' + 'Signature=' + signature 

# header, the headers must be included in the canonical_headers and signed_headers values, as 
# noted earlier. Order here is not significant. 
# # Python note: The 'host' header is added automatically by the Python 'requests' library. 
headers = {'Content-Type':content_type, 
      'X-Amz-Date':amz_date, 
      # 'X-Amz-Target':amz_target, # not used by polly 
      'Authorization':authorization_header} 


# ************* SEND THE REQUEST ************* 
print '\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++' 
print 'Request URL = ' + endpoint 

r = requests.post(endpoint, data=request_parameters, headers=headers) 

print '\nRESPONSE++++++++++++++++++++++++++++++++++++' 
print 'Response code: %d\n' % r.status_code 
#print r.content 
f=open('test.mp3','wb') 
f.write(r.content) # r.content for binary otherwise r.text or r.json() 
f.close()