that contains the X.509 certificate (for example: the
URI
attribute equals
#CertId-1064304
in the
preceding example request).
You must include a
wsu:Id
attribute in any message elements that you sign. You can sign any
SOAP header and the entire SOAP
Body
. Do not sign any other elements (such as children of the
Body
element). AWS ignores those elements for the purposes of signature validation, even if you
include a
wsu:ID
attribute in them. If you sign elements that shouldn't be signed, the signature
validation will fail.
Using SOAP without WS-Security
This section describes how to authenticate SOAP requests without using WS-Security. The topics describe
the basic requirements, the required authentication information, and where to place the information in
the SOAP request.
General Requirements
If you plan to use SOAP without WS-Security:
• You can use either SOAP 1.1 or SOAP 1.2
• You must use HTTPS with your requests
Required Authentication Information
Authentication of SOAP requests without WS-Security uses your AWS identifiers and an HMAC-SHA256
signature. The request must include the parameters listed in the following table.
Description
Parameter
Your AWS Access Key ID. For more information, see
Your AWS
Identifiers (p. 54)
.
AWSAccessKeyId
This is a required parameter if you include the Signature parameter. Otherwise
it is optional. There is no default value. The time stamp you use in the request
must be a
dateTime
object, with the complete date plus hours, minutes, and
seconds (for more information, go to
http://www.w3.org/TR/NOTE-datetime
).This is a fixed -length subset of the
format defined by ISO 8601, represented in Universal Time (GMT):
YYYY-MM-DDThh:mm:ssZ
(where T and Z are literals).
Important
If you are using .NET you must not send overly specific time stamps,
due to different interpretations of how extra time precision should be
dropped. To avoid overly specific time stamps, manually construct
dateTime
objects with no more than millisecond precision.
Timestamp
The HMAC-SHA256 signature calculated from the concatenation of the
Action
and
Timestamp
parameters, using your AWS Secret Access Key
as the key (for information about authentication with HMAC signatures, see
HMAC-SHA Signatures for REST Requests (p. 55)
). For example, for a
request to create a queue, the value of the
Signature
element would be
the HMAC-SHA256 digest of a string like this:
ItemLookup2011-09-24T00:00:00Z
Signature
API Version 2011-08-01
71
Product Advertising API Developer Guide
Request Authentication
