Using the Postman app to make S3 api requests

The Postman application provides a nice user interface for making REST requests including S3 api requests. It is easier for many users than a command-line tool like curl and unlike curl it can compute the request signature and Content-MD5 required by the S3 api.

Download it for your OS at https://www.postman.com/downloads/ and install.

After opening it press the “plus” button to create a new request e.g. to PUT an object-lock configuration on a bucket in your domain.

Select the HTTP method and enter the url, to the left of the Send button.

PUT https://mydomain.example.com/mylocker?object-lock

In the Authorization tab select Type “AWS Signature” and enter your AccessKey and SecretKey, which you get when you create an S3 token in Content Portal. Under Advanced you must enter “s3” (lowercase S3!) for the Service Name.

In the Body tab choose raw and choose XML in the Text dropdown. Enter a body like:

<ObjectLockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <ObjectLockEnabled>Enabled</ObjectLockEnabled>
    <Rule>
        <DefaultRetention>
            <Days>1</Days>
            <Mode>COMPLIANCE</Mode>
        </DefaultRetention>
    </Rule>
</ObjectLockConfiguration>

To avoid a 400 Bad Request error:

    <Code>InvalidRequest</Code>
    <Message>Missing required header for this request: Content-MD5</Message>

You must also add the Key Content-MD5 with the value {{contentMD5}} (that is Postman variable syntax) in the Headers tab. With recent Postman 10.21.0 it seems this reports contentMD5 is an Unresolved Variable but V4 signature still works probably because X-Amz-Content-Sha256 is used.

Finally you must enter this in the Pre-request Script tab so that {{contentMD5}} variable is available:

var md5checksum = CryptoJS.MD5(""+pm.request.body+"");
base64value = CryptoJS.enc.Base64.stringify(md5checksum);
postman.setGlobalVariable("contentMD5", base64value);

Now when you press Send you should see a 200 OK response. The empty response Body is fine.