TransferManager doesn't sign request and generate "authorization" field in request header in v1.11

[ewagcha]

Describe the bug

It is found the field authorization like below is missing when we upgrade from v1.9 to v1.11, If the user and access key are set via S3Client.

authorization: AWS4-HMAC-SHA256 Credential=..., SignedHeaders=amz-sdk-invocation-id;amz-sdk-request;content-length;content-md5;content-type;host;x-amz-acl;x-amz-content-sh a256;x-amz-date;x-amz-server-side-encryption, Signature=...

It works if we set two ENV Vars AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in v1.11

We suspect this is a bug and our customer is waiting to fix this.

please advice.

LOG in debug trace snips:

[INFO] 2025-06-18 19:17:48.700 Aws::Config::AWSConfigFileProfileConfigLoader [140553995281984] Initializing config loader against fileName /home/katew/.aws/credentials and using profilePrefix = 0
[TRACE] 2025-06-18 19:17:48.700 FileSystemUtils [140553995281984] Checking HOME for the home directory.
[DEBUG] 2025-06-18 19:17:48.700 FileSystemUtils [140553995281984] Environment value for variable HOME is /home/katew
[DEBUG] 2025-06-18 19:17:48.700 FileSystemUtils [140553995281984] Home directory is missing the final / appending one to normalize
[DEBUG] 2025-06-18 19:17:48.700 FileSystemUtils [140553995281984] Final Home Directory is /home/katew/
[TRACE] 2025-06-18 19:17:48.700 FileSystemUtils [140553995281984] Checking HOME for the home directory.
[DEBUG] 2025-06-18 19:17:48.700 FileSystemUtils [140553995281984] Environment value for variable HOME is /home/katew
[DEBUG] 2025-06-18 19:17:48.700 FileSystemUtils [140553995281984] Home directory is missing the final / appending one to normalize
[DEBUG] 2025-06-18 19:17:48.700 FileSystemUtils [140553995281984] Final Home Directory is /home/katew/
[INFO] 2025-06-18 19:17:48.700 ProfileConfigFileAWSCredentialsProvider [140553995281984] Setting provider to read credentials from /home/katew/.aws/credentials for credentials file and /home/katew/.aws/config for the config file , for use with profile default
[INFO] 2025-06-18 19:17:48.700 ProcessCredentialsProvider [140553995281984] Setting process credentials provider to read config from default
[WARN] 2025-06-18 19:17:48.700 STSAssumeRoleWithWebIdentityCredentialsProvider [140553995281984] Token file must be specified to use STS AssumeRole web identity creds provider.
[INFO] 2025-06-18 19:17:48.701 SSOBearerTokenProvider [140553995281984] Setting sso bearerToken provider to read config from default
[INFO] 2025-06-18 19:17:48.701 SSOCredentialsProvider [140553995281984] Setting sso credentials provider to read config from default
[DEBUG] 2025-06-18 19:17:48.701 DefaultAWSCredentialsProviderChain [140553995281984] The environment variable value AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is
[DEBUG] 2025-06-18 19:17:48.701 DefaultAWSCredentialsProviderChain [140553995281984] The environment variable value AWS_CONTAINER_CREDENTIALS_FULL_URI is
[DEBUG] 2025-06-18 19:17:48.701 DefaultAWSCredentialsProviderChain [140553995281984] The environment variable value AWS_EC2_METADATA_DISABLED is
[INFO] 2025-06-18 19:17:48.701 InstanceProfileCredentialsProvider [140553995281984] Creating Instance with default EC2MetadataClient and refresh rate 300000
[INFO] 2025-06-18 19:17:48.701 DefaultAWSCredentialsProviderChain [140553995281984] Added EC2 metadata service credentials provider to the provider chain.
[INFO] 2025-06-18 19:17:48.701 Aws::Config::AWSConfigFileProfileConfigLoader [140553995281984] Unable to open config file /home/katew/.aws/credentials for reading.
[INFO] 2025-06-18 19:17:48.701 Aws::Config::AWSProfileConfigLoaderBase [140553995281984] Failed to reload configuration.
[INFO] 2025-06-18 19:17:48.701 ProcessCredentialsProvider [140553995281984] Failed to find credential process's profile: default
[TRACE] 2025-06-18 19:17:48.701 FileSystemUtils [140553995281984] Checking HOME for the home directory.
[DEBUG] 2025-06-18 19:17:48.701 FileSystemUtils [140553995281984] Environment value for variable HOME is /home/katew
[DEBUG] 2025-06-18 19:17:48.701 FileSystemUtils [140553995281984] Home directory is missing the final / appending one to normalize
[DEBUG] 2025-06-18 19:17:48.701 FileSystemUtils [140553995281984] Final Home Directory is /home/katew/
[DEBUG] 2025-06-18 19:17:48.701 SSOCredentialsProvider [140553995281984] Loading token from: /home/katew/.aws/sso/cache/da39a3ee5e6b4b0d3255bfef95601890afd80709.json
[DEBUG] 2025-06-18 19:17:48.701 SSOCredentialsProvider [140553995281984] Preparing to load token from: /home/katew/.aws/sso/cache/da39a3ee5e6b4b0d3255bfef95601890afd80709.json
[INFO] 2025-06-18 19:17:48.701 SSOCredentialsProvider [140553995281984] Unable to open token file on path: /home/katew/.aws/sso/cache/da39a3ee5e6b4b0d3255bfef95601890afd80709.json
[TRACE] 2025-06-18 19:17:48.701 SSOCredentialsProvider [140553995281984] Access token for SSO not available
[DEBUG] 2025-06-18 19:17:48.701 InstanceProfileCredentialsProvider [140553995281984] Checking if latest credential pull has expired.
[INFO] 2025-06-18 19:17:48.701 InstanceProfileCredentialsProvider [140553995281984] Credentials have expired attempting to re-pull from EC2 Metadata Service.
[TRACE] 2025-06-18 19:17:48.701 EC2MetadataClient [140553995281984] Getting default credentials for ec2 instance from http://169.254.169.254
[TRACE] 2025-06-18 19:17:48.701 EC2MetadataClient [140553995281984] Retrieving credentials from http://169.254.169.254/latest/meta-data/iam/security-credentials
[TRACE] 2025-06-18 19:17:48.701 CurlHttpClient [140553995281984] Making request to http://169.254.169.254/latest/meta-data/iam/security-credentials
[TRACE] 2025-06-18 19:17:48.701 CurlHttpClient [140553995281984] Including headers:
[TRACE] 2025-06-18 19:17:48.701 CurlHttpClient [140553995281984] host: 169.254.169.254
[TRACE] 2025-06-18 19:17:48.701 CurlHttpClient [140553995281984] user-agent: aws-sdk-cpp/1.11.212 ua/2.0 md/aws-crt#0.24.8 os/Linux/5.14.0-427.42.1.el9_4.x86_64 md/arch#x86_64 lang/c++#C++11 md/GCC#11.4.1 cfg/retry-mode#default

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

authorization should be generated like v1.9.

Current Behavior

authorization like below is missing when we upgrade from v1.9 to v1.11

Reproduction Steps

Using TransferManager to UploadFile() to upload a file bigger than 5G.

Possible Solution

No response

Additional Information/Context

No response

AWS CPP SDK version used

v1.11

Compiler and Version used

cmake-3.21.2

Operating System and version

linuxamd64 RHEL9.4

[DmitriyMusatkin]

Can you share code sample of the case where sdk is not generating auth headers?

[ewagcha]

Can you share code sample of the case where sdk is not generating auth headers?

hi @DmitriyMusatkin

basically, it is like this

Aws::Auth::AWSCredentials credentials("YOUR_ACCESS_KEY_ID", "YOUR_SECRET_ACCESS_KEY"); 
std::shared_ptr using Aws::MakeShared std::shared_ptr<Aws::Auth::AWSCredentialsProvider> creds = Aws::MakeShared<Aws::Auth::StaticCredentialsProvider>("MyCustomProviderId", credentials);

Aws::Client::ClientConfiguration clientConfig;
clientConfig.region = Aws::Region::US_EAST_1;
clientConfig.requestTimeoutMs = 30000;
clientConfig.connectTimeoutMs = 10000;

  pS3Client = new Aws::S3::S3Client(
               creds,
               clientConfig,
               Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy::Never,
               bVirtAddressing );

   auto tmS3Client = Aws::MakeShared<Aws::S3::S3Client>("MyS3Client", *pS3Client);

   auto mpTransferExec = Aws::MakeShared<Aws::Utils::Threading::PooledThreadExecutor>("myTmExecutor", 25);

   Aws::Transfer::TransferManagerConfiguration tmConfig(mpTransferExec.get());

   tmConfig.bufferSize = ( Uint64 ) (5 * 1024 * 1024 * 1024);
   tmConfig.s3Client = tmS3Client;

   auto mpTm = Aws::Transfer::TransferManager::Create(tmConfig);

   auto uploadHandle = mpTm->UploadFile( "myfile", "containername", "objkeyname",
                                         "text/plain",    // doesn't change too much vs "text/plain"
                                         Aws::Map<Aws::String, Aws::String>());   // metadata

[sbiscigl]

std::shared_ptr using Aws::MakeShared std::shared_ptrAws::Auth::AWSCredentialsProvider creds = Aws::MakeSharedAws::Auth::StaticCredentialsProvider("MyCustomProviderId", credentials);

that line is confusing for me for two reasons:

• StaticCredentialsProvider is not defined in the SDK.
• that line does not compile

can you please update with a example that minimally reproduces this and compiles?

I created a full example and see the authorizaiton header i.e.

#include <aws/core/Aws.h>
#include <aws/core/auth/AWSCredentialsProvider.h>
#include <aws/core/utils/threading/PooledThreadExecutor.h>
#include <aws/s3/S3Client.h>
#include <aws/transfer/TransferManager.h>

using namespace Aws;
using namespace Aws::Auth;
using namespace Aws::S3;
using namespace Aws::Transfer;
using namespace Aws::Utils::Threading;

namespace {
const char* LOG_TAG = "transfer-test";
}

class SDKContext {
 public:
  explicit SDKContext(SDKOptions&& options = {}) : options_(options) { InitAPI(options_); }
  ~SDKContext() { ShutdownAPI(options_); }

 private:
  SDKOptions options_;
};

auto main() -> int {
  SDKOptions options;
  options.loggingOptions.logLevel = Aws::Utils::Logging::LogLevel::Debug;
  SDKContext context{std::move(options)};

  AWSCredentials credentials("YOUR_ACCESS_KEY_ID",
    "YOUR_SECRET_ACCESS_KEY",
    "YOUR_SESSION_TOKEN(Optional)");
  auto credentials_provider = MakeShared<SimpleAWSCredentialsProvider>("MyCustomProviderId", credentials);
  const auto executor = Aws::MakeUnique<PooledThreadExecutor>(LOG_TAG, std::thread::hardware_concurrency());
  const auto client = MakeShared<S3Client>(LOG_TAG, credentials_provider);

  TransferManagerConfiguration configuration{executor.get()};
  configuration.s3Client = client;

  const auto transfer_manager = TransferManager::Create(configuration);
  transfer_manager->UploadFile("/your/file/path", "yourbucket", "yourkey", "text/plain", {});
  transfer_manager->WaitUntilAllFinished();
}

in the logs i see

[DEBUG] 2025-06-24 16:35:52.952 CURL [0x16e7cf000] (HeaderOut) PUT /test-key?partNumber=2&uploadId=your_upload_id-- HTTP/1.1
Host: bucketname.s3.us-east-1.amazonaws.com
Accept: */*
authorization: AWS4-HMAC-SHA256 Credential=your_key/20250624/us-east-1/s3/aws4_request, SignedHeaders=amz-sdk-invocation-id;amz-sdk-request;content-encoding;content-type;host;x-amz-content-sha256;x-amz-date;x-amz-decoded-content-length;x-amz-sdk-checksum-algorithm;x-amz-security-token;x-amz-trailer, Signature=your_signature
content-encoding: aws-chunked
content-type: text/plain
transfer-encoding: chunked
x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER
x-amz-decoded-content-length: your_content_length
x-amz-sdk-checksum-algorithm: CRC64NVME
x-amz-security-token: your_token
x-amz-trailer: x-amz-checksum-crc64nvme

when uploading a file that has multiple chunks