How to access pre-signed urls for AWS Cloudwatch Logs generated with boto3.client?

Question

I am wondering if it is possible to use pre-signed urls with other aws services other than s3. Specifically, the boto3 documentation http://boto3.readthedocs.io/en/latest/reference/services/logs.html#CloudWatchLogs.Client.generate_presigned_url shows that the method generate_presigned_url is available for cloudwatch logs. I've tried using it in the following fashion.

client = boto3.client(
    'logs', 
    aws_access_key_id="<aws_access_key_id>", 
    aws_secret_access_key="<aws_secret_access_key>", 
    region_name='us-east-1'
)
url = client.generate_presigned_url(
    ClientMethod='get_log_events',
    Params={
        'logGroupName':'<logGroupName>',
        'logStreamName':'<logStreamName>'
    },
    ExpiresIn=180
)

The url generates, but when trying to access the url I get the error in the browser:

<InvalidSignatureException>
  <Message>The request signature we calculated does not match the 
signature you provided. Check your AWS Secret Access Key and signing 
method. Consult the service documentation for details.</Message>
</InvalidSignatureException>

For reference, the url is in this format (AWS Signature Version 4):

https://logs.us-east-1.amazonaws.com/
?logGroupName=<logGroupName>&logStreamName=<logStreamName>
?X-Amz-Algorithm=AWS4-HMAC-SHA256
&X-Amz-Credential=<aws_access_key_id>%2F20130721%2Fus-east- 
1%2Fs3%2Faws4_request
&X-Amz-Date=20180531T150510Z
&X-Amz-Expires=180
&X-Amz-SignedHeaders=content-type%3Bhost%3Bx-amz-target
&X-Amz-Signature=<signature-value>

How can I access this url? I noticed this url has a different format than the ones generated for s3, which works with the same method (i.e. generate_presigned_url with get_objects). Is there a way to make this work with Cloudwatch Logs?

It's theoretically possible... but that's an API call that returns machine-readable data, not really intended to be accessed from the browser. You'll notice that the signature indicates that a `Content-Type` and `X-Amz-Target` header, which the browser would not know how to add. What are you actually trying to accomplish with this URL? — Michael - sqlbot, Jun 01 '18 at 01:56
I think I understand the issue now. I was trying to use the presigned url generated by the boto3 api to retrieve logs using the get_event_logs action. I thought this would be in the form of a GET request so I assumed it should be browser accessible, but it turns out it is actually a POST request meaning that I would have to parse the generated url to get the body and headers. — jkhoo, Jun 02 '18 at 19:34

How to access pre-signed urls for AWS Cloudwatch Logs generated with boto3.client?

0 Answers0