The error
The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method.AWS exception SignatureDoesNotMatch. The Wraps CLI reports it as ACCESS_KEY_INVALID.
Why this happens
AWS recognised the access key, recomputed the signature over the request, and got a different answer than the one you sent. Either the secret key does not match the access key ID, or something about how the request was signed differs from what AWS reconstructed.
- The secret access key does not match the access key ID, often from a partial copy or a rotation applied to one and not the other.
- Whitespace, a newline or a shell quoting artefact in the stored secret.
- Machine clock skew large enough to invalidate the signature timestamp.
- Hand-rolled or proxied SigV4 signing that alters headers or the body after signing.
How to fix it
1. Prove the key pair works at all
One call that only needs valid signing. If this fails the same way, the problem is the credentials or the clock, not anything SES-specific.
aws sts get-caller-identity2. Re-enter the secret rather than editing it
Most mismatches are transcription damage: a truncated paste, a trailing newline, or a shell that ate a special character. Replace the value wholesale instead of trying to spot the difference.
3. Check the clock
SigV4 signatures carry a timestamp and AWS rejects requests signed too far outside its own clock. Containers and long-suspended laptops drift.
date -u4. Stop modifying the request after signing
If a proxy, middleware or logging layer adds or rewrites headers or re-encodes the body after the SDK signs, the signature no longer covers the request AWS received. Sign last.
How to stop it recurring
Let the SDK sign
The AWS SDK's signer handles canonicalisation, payload hashing and the timestamp window. Hand-rolled SigV4 is where this error is most likely to become permanent rather than transient.
Keep time synchronised on senders
NTP on every host that signs AWS requests removes an entire class of intermittent failure that otherwise looks random.
Common questions
Can clock skew cause SignatureDoesNotMatch?
Yes. SigV4 signatures include a timestamp and AWS rejects a request signed too far from its own clock. Check the host clock before rotating keys.
Does SignatureDoesNotMatch mean my access key is wrong?
The access key ID is fine, otherwise you would get InvalidClientTokenId. The mismatch is in the secret key, or in how the request was signed.
Why does this only happen behind our proxy?
Because something is changing the request after the SDK signed it. Any header rewrite or body re-encoding downstream of the signer invalidates the signature.
What Wraps does about this
The Wraps CLI maps SignatureDoesNotMatch to ACCESS_KEY_INVALID and points at the IAM console rather than reporting missing credentials. The Wraps SDKs sign through the AWS SDK's own signer, so the signing path is not somewhere you have to debug.