Recently I started to work with Sentinel-1 data hosted on AWS S3 bucket 'sentinel-s1-l1c'. The bucket is requester pays and requires AWS signature version 4. I need to access the files via HTTP GET requests, so I generate authorization headers myself as described in AWS docs.
When the signature expires there's an XML exception, saying that MaxAllowedSkewMilliseconds equals 900 seconds. I estimate the expiration time as date in X-Amz-Date header (time of the request) + 900 seconds. But this method seems incorrect, since I have 403 Forbidden earlier than expected.
What is the correct method to calculate signature expiration time? Should I consider SignatureAge in bucket policy? If so, then how can I get the policy? I tried to get the policy using boto3 and awscli but no success...
Since Sentinel-2 also goes requester pays, I wonder what the policy will be and how to determine the signature age when migrating code to consider Sentinel-2 bucket as requester pays?