ActionTrail:Request signatures

Overview

You must add the signature to the Resource Management API request in the following format:

https://Endpoint/?SignatureVersion=1.0&SignatureMethod=HMAC-SHA1&Signature=CT9X0VtwR86fNWSnsc6v8YGOjuE%3D&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf

Signature = Base64( HMAC-SHA1( AccessKey Secret, UTF-8-Encoding-Of(StringToSign)) )

Step 1: Compose and encode a string-to-sign

1. Create a canonicalized query string by arranging the request parameters.
   1. Arrange the request parameters (including all common and operation-specific parameters except Signature) in alphabetical order.
      Note When you use the GET method to submit a request, these parameters constitute the parameter field of the request URL. These parameters are placed after the question mark (?) in the request URI and connected by ampersands (&).
   2. Encode the names and values of the arranged request parameters in the request URL by using the UTF-8 character set. The following table describes the encoding rules.

      Character	Encoding rule
      Uppercase letters, lowercase letters, digits, hyphens (-), underscores (_), periods (.), and tildes (~)	These characters do not need to be encoded.
      Other characters	These characters must be percent encoded in the %XY format. XY represents the ASCII code of the characters in hexadecimal notation. For example, double quotation marks (") are encoded as %22.
      Extended UTF-8 characters	These characters must be encoded in the %XY%ZA… format.
      Spaces	Spaces must be encoded as %20. Do not encode spaces as plus signs (+). This encoding method is different from the Multipurpose Internet Mail Extensions (MIME) encoding algorithm application/x-www-form-urlencoded, such as the java.net.URLEncoder class that is provided by the Java standard library. However, you can apply the MIME encoding algorithm and then replace the plus sign (+) in the encoded string with %20, the asterisk (*) with %2A, and %7E with the tilde (~). You can use the following percentEncode method to implement the algorithm: private static final String ENCODING = "UTF-8"; private static String percentEncode(String value) throws UnsupportedEncodingException { return value != null ? URLEncoder.encode(value, ENCODING).replace("+", "%20").replace("*", "%2A").replace("%7E", "~") : null; }

   3. Connect the encoded parameter names and values by using equal signs (=).
   4. Sort the connected parameter name and value pairs in the specified order and connect the pairs by using ampersands (&) to obtain the canonicalized query string.
2. Create a string-to-sign from the encoded canonicalized query string in the following way:

   StringToSign=
         HTTPMethod + "&" +
         percentEncode("/") + "&" +
         percentEncode(CanonicalizedQueryString)

   The following list describes the parameters:

   • HTTPMethod: specifies the HTTP method used to submit a request, such as GET.
   • percentEncode("/"): specifies the encoded value (%2F) of a forward slash (/). The encoding follows the URL encoding rules.
   • percentEncode(CanonicalizedQueryString): specifies the encoded canonicalized query string based on the URL encoding rules.

Step 2: Calculate the signature string

1. Calculate the HMAC value of the string-to-sign based on RFC 2104.
   Note Use the SHA1 algorithm to calculate the HMAC value of the string-to-sign. The combination of your AccessKey secret and an ampersand (&) (ASCII code 38) is used as the key for the HMAC calculation.
2. Encode the HMAC value in Base64 to obtain the signature string.
3. Add the signature string to the request as the Signature parameter.
   Note When the obtained signature value is submitted as the final request parameter value, the value must be URL-encoded like other parameters based on rules defined in RFC 3986.

Signature example

Take a CreateTrail API request as an example, where the following sample request URL is to be signed:

https://actiontrail.cn-hangzhou.aliyuncs.com/?AccessKeyId=testid&Action=CreateTrail&Format=JSON&Name=test&RegionId=cn-hangzhou&RoleName=AliyunServiceRoleForActionTrail&SignatureMethod=HMAC-SHA1&SignatureNonce=d7730860-e66f-11ea-a3a5-d5f3b52e66a1&SignatureVersion=1.0&Timestamp=2020-08-25T01%3A11%3A01Z&Version=2017-12-04

The following string is the string-to-sign:

POST&%2F&AccessKeyId%3Dtestid%26Action%3DCreateTrail%26Format%3DJSON%26Name%3Dtest%26RegionId%3Dcn-hangzhou%26RoleName%3DAliyunServiceRoleForActionTrail%26SignatureMethod%3DHMAC-SHA1%26SignatureNonce%3Dd7730860-e66f-11ea-a3a5-d5f3b52e66a1%26SignatureVersion%3D1.0%26Timestamp%3D2020-08-25T01%25253A11%25253A01Z%26Version%3D2017-12-04

Assume that the AccessKey ID is testid and the AccessKey secret is testsecret. The key that is used to calculate the HMAC value of the string-to-sign is testsecret&.

The calculated signature string is d15sJSZ0cc+y6a6FHlWxGK/qcUA=.

In this example, the following signed request URL is generated:

https://actiontrail.cn-hangzhou.aliyuncs.com/?Signature=d15sJSZ0cc+y6a6FHlWxGK/qcUA=&AccessKeyId=testid&Action=CreateTrail&Format=JSON&Name=test&RegionId=cn-hangzhou&RoleName=AliyunServiceRoleForActionTrail&SignatureMethod=HMAC-SHA1&SignatureNonce=d7730860-e66f-11ea-a3a5-d5f3b52e66a1&SignatureVersion=1.0&Timestamp=2020-08-25T01%3A11%3A01Z&Version=2017-12-04