<p>Got it working by aws curl <a href="https://github.com/okigan/awscurl" rel="nofollow noreferrer">https://github.com/okigan/awscurl</a></p>

<pre><code>awscurl --service iam 'https://iam.amazonaws.com/?Action=ListUsers&amp;Version=2010-05-08'
</code></pre>

CC BY-SA 3.0
2018-04-06T18:20:27.697Z
I Really wonder what that bring up over aws cli... This whole Q/A sounds useless for anyone but you for me
Tensibai
CC BY-SA 3.0
2018-04-06T23:02:49.400Z
tried to find a way to get IAM roles from python, not using subprocesses, and hoped  awscurl could be run from python script-from shell it works fine but from python again got missing authentication (using reguests)
Milister
CC BY-SA 3.0
2018-04-07T06:56:42.693Z
Why don't you use boto3 in python, the official aws python sdk?
Tensibai
CC BY-SA 3.0
2018-04-07T07:01:45.137Z
it doesn't have all capability as aws cli/aws url
Milister
CC BY-SA 3.0
2018-04-07T09:29:47.657Z
Sounds utterly strange as aws cli is a python program... https://github.com/aws/aws-cli
Tensibai
CC BY-SA 3.0
2018-04-07T09:41:55.657Z
After re-reading it I was thinking king about botocore, the low level interface behind bouo3 to make raw requests: https://github.com/boto/botocore
Tensibai
CC BY-SA 3.0
2018-04-06T13:23:59.163Z
2018-04-06T13:23:59.163Z
Milister
<p>The referred documentation from the question 
<a href="https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html</a></p>

<p>has this example of a request:</p>

<pre><code>https://iam.amazonaws.com/?Action=ListAttachedUserPolicies
&amp;UserName=Alice
&amp;Version=2010-05-08
&amp;AUTHPARAMS
</code></pre>

<p>AUTHPARAMS are explained 
<a href="https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html</a></p>

<p>(version 4 is preferred)
<a href="https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html</a></p>

<p>So you have to calculate a digest from the request together with your secret key and you have to do it exactly as it is explained in the documentation - which means be careful about every letter including spaces. </p>

CC BY-SA 3.0
2018-04-09T12:34:46.797Z
2018-04-09T12:34:46.797Z
petrchpetr
<p>How to authenticate against AWS to make API query ?</p>

<pre><code>https://iam.amazonaws.com/?Action=ListAttachedUserPolicies&amp;UserName=ja&amp;Version=2010-05-08&amp;accesskey
</code></pre>

<p>and getting:</p>

<pre><code>&lt;Code&gt;MissingAuthenticationToken&lt;/Code&gt;
&lt;Message&gt;Request is missing Authentication Token&lt;/Message&gt;
</code></pre>

CC BY-SA 3.0
2018-04-06T13:06:25.690Z
You have to pass an access key...  what did you try ? which command are you passing ?
Tensibai
CC BY-SA 3.0
2018-04-06T13:08:43.853Z
I already passed access key, i need to get list of attached user policies (see link i posted in question)
Milister
CC BY-SA 3.0
2018-04-06T13:10:34.530Z
This is usually related to requesting a URL that doesn't exist .. make sure you're using the correct HTTP method and path to a valid resource.
storm
CC BY-SA 3.0
2018-04-06T13:12:52.333Z
i collected that link from AWS docs:https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html
Milister
CC BY-SA 3.0
2018-04-06T13:15:34.063Z
From [Welcome page](https://docs.aws.amazon.com/IAM/latest/APIReference/Welcome.html): "Requests must be signed using an **access key ID** and **a secret access key**. " As far as I can guess from the few you gave, you're passing only an accesskey (in a strange form, I can't tell if accesskey is a placeholder here or just the parameter name with the value stripped down)
Tensibai
CC BY-SA 3.0
2018-04-06T13:16:20.740Z
And you probably need to read this also: https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
Tensibai
CC BY-SA 3.0
2018-04-06T13:19:02.980Z
yes, accesskey is parameter, but when specify secret then getting :<Code>MalformedQueryString</Code>
<Message>Keys may not contain +</Messag
Milister
<amazon-web-services><api>
AWS REST API Query
Milister
# AWS REST API Query

(Asked by: username_0 on 2018-04-06)

How to authenticate against AWS to make API query ?
https://iam.amazonaws.com/?Action=ListAttachedUserPolicies&UserName=ja&Version=2010-05-08&accesskey

and getting:
MissingAuthenticationToken
Request is missing Authentication Token

**Tags:** amazon-web-services, api

> **Comments:**
> **username_1**: You have to pass an access key...  what did you try ? which command are you passing ?  
> **username_0**: I already passed access key, i need to get list of attached user policies (see link i posted in question)  
> **username_2**: This is usually related to requesting a URL that doesn't exist .. make sure you're using the correct HTTP method and path to a valid resource.  
> **username_0**: i collected that link from AWS docs:https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html  
> **username_1**: From [Welcome page](https://docs.aws.amazon.com/IAM/latest/APIReference/Welcome.html): "Requests must be signed using an **access key ID** and **a secret access key**. " As far as I can guess from the few you gave, you're passing only an accesskey (in a strange form, I can't tell if accesskey is a placeholder here or just the parameter name with the value stripped down)  
> **username_1**: And you probably need to read this also: https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html  
> **username_0**: yes, accesskey is parameter, but when specify secret then getting :<Code>MalformedQueryString</Code> <Message>Keys may not contain +</Messag  

---

## 2 answers

### Answer by username_0 on 2018-04-06. Score: 2

Got it working by aws curl https://github.com/okigan/awscurl
awscurl --service iam 'https://iam.amazonaws.com/?Action=ListUsers&Version=2010-05-08'

> **Comments:**
> **username_1**: I Really wonder what that bring up over aws cli... This whole Q/A sounds useless for anyone but you for me  
> **username_0**: tried to find a way to get IAM roles from python, not using subprocesses, and hoped  awscurl could be run from python script-from shell it works fine but from python again got missing authentication (using reguests)  
> **username_1**: Why don't you use boto3 in python, the official aws python sdk?  
> **username_0**: it doesn't have all capability as aws cli/aws url  
> **username_1**: Sounds utterly strange as aws cli is a python program... https://github.com/aws/aws-cli  
> **username_1**: After re-reading it I was thinking king about botocore, the low level interface behind bouo3 to make raw requests: https://github.com/boto/botocore  

---

### Answer by username_3 on 2018-04-09. Score: 0

The referred documentation from the question 
https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html
has this example of a request:
https://iam.amazonaws.com/?Action=ListAttachedUserPolicies
&UserName=Alice
&Version=2010-05-08
&AUTHPARAMS

AUTHPARAMS are explained 
https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html
(version 4 is preferred)
https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
So you have to calculate a digest from the request together with your secret key and you have to do it exactly as it is explained in the documentation - which means be careful about every letter including spaces.


---

