Error: SignatureDoesNotMatch in Terraform 1.6+ using S3 backend behind Edge SWG

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

When using Terraform 1.6 or higher with an AWS S3 backend, operations fail with a 403 Forbidden error. This occurs when traffic passes through an Edge SWG that modifies or reorders HTTP headers.

Terraform commands (e.g., terraform init, terraform plan) fail with the following error: Error: SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.

Environment

Environment:

• Terraform 1.6.x and higher
• AWS Provider for Terraform
• Broadcom Edge SWG (ProxySG)
• AWS S3 Backend

Cause

Terraform 1.6+ uses AWS Signature Version 4 for S3 requests. The Edge SWG may be configured to modify or reorder HTTP headers (specifically the range or content-length headers) during inspection. Since these headers are part of the signed request, any modification by the proxy after the client has signed the request results in a signature mismatch at the S3 endpoint.

Resolution

To resolve this issue, modify the Edge SWG policy to ensure headers remain unmodified for traffic destined for AWS S3.

1. Identify the proxy policy affecting the client traffic.
2. Create a policy exception for AWS S3 domains (e.g., *.s3.amazonaws.com) to prevent header modification and bypass caching. 
3. Ensure that the range header is preserved and not reordered.
4. If using SSL Inspection, ensure the proxy is not injecting or altering headers in a way that breaks the AWS SigV4 signature.
5. Test the connection using Terraform 1.6+ to verify the signature matches.