Recently I started to work with Sentinel-1 data hosted on AWS S3 bucket 'sentinel-s1-l1c'. The bucket is requester pays and requires AWS signature version 4. I need to access the files via HTTP GET requests, so I generate authorization headers myself as described in AWS docs.

When the signature expires there's an XML exception, saying that MaxAllowedSkewMilliseconds equals 900 seconds. I estimate the expiration time as date in X-Amz-Date header (time of the request) + 900 seconds. But this method seems incorrect, since I have 403 Forbidden earlier than expected.

What is the correct method to calculate signature expiration time? Should I consider SignatureAge in bucket policy? If so, then how can I get the policy? I tried to get the policy using boto3 and awscli but no success...

Since Sentinel-2 also goes requester pays, I wonder what the policy will be and how to determine the signature age when migrating code to consider Sentinel-2 bucket as requester pays?

  • 3
    Sentinel-2 will use the same settings since defaults are used for Requester pays. If you do not get an answer, I suggest you post this question to Sentinel Hub forum (forum.sentinel-hub.com/c/aws-sentinel), which is regularly monitored by Earth on AWS staff as well. (btw, Sentinel-1 L1C does not exist, it is Sentinel-1 GRD) – Grega M. Jul 13 '18 at 6:32
  • @GregaM., thank you. Maybe you know the date when Sentinel-2 L1C will become Requester pays? – dr_times Jul 13 '18 at 9:23
  • 2
    It will take at least a few weeks more as we (our company is managing the bucket at AWS) want to make sure that access to meta-data remains easily accessible. You can monitor the thread at forum (forum.sentinel-hub.com/t/…), where a firm date will be announced at least 2 weeks up front. – Grega M. Jul 15 '18 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.