Answers: <p>Got it working by aws curl <a href="https://github.com/okigan/awscurl" rel="nofollow noreferrer">https://github.com/okigan/awscurl</a></p>
  
  <pre><code>awscurl --service iam 'https://iam.amazonaws.com/?Action=ListUsers&amp;Version=2010-05-08'
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2018-04-06T18:20:27.697Z
Answers: I Really wonder what that bring up over aws cli... This whole Q/A sounds useless for anyone but you for me
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2018-04-06T23:02:49.400Z
Answers: tried to find a way to get IAM roles from python, not using subprocesses, and hoped  awscurl could be run from python script-from shell it works fine but from python again got missing authentication (using reguests)
Answers: Milister
Answers: CC BY-SA 3.0
Answers: 2018-04-07T06:56:42.693Z
Answers: Why don't you use boto3 in python, the official aws python sdk?
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2018-04-07T07:01:45.137Z
Answers: it doesn't have all capability as aws cli/aws url
Answers: Milister
Answers: CC BY-SA 3.0
Answers: 2018-04-07T09:29:47.657Z
Answers: Sounds utterly strange as aws cli is a python program... https://github.com/aws/aws-cli
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2018-04-07T09:41:55.657Z
Answers: After re-reading it I was thinking king about botocore, the low level interface behind bouo3 to make raw requests: https://github.com/boto/botocore
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2018-04-06T13:23:59.163Z
Answers: 2018-04-06T13:23:59.163Z
Answers: Milister
Answers: <p>The referred documentation from the question 
  <a href="https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html</a></p>
  
  <p>has this example of a request:</p>
  
  <pre><code>https://iam.amazonaws.com/?Action=ListAttachedUserPolicies
  &amp;UserName=Alice
  &amp;Version=2010-05-08
  &amp;AUTHPARAMS
  </code></pre>
  
  <p>AUTHPARAMS are explained 
  <a href="https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html</a></p>
  
  <p>(version 4 is preferred)
  <a href="https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html</a></p>
  
  <p>So you have to calculate a digest from the request together with your secret key and you have to do it exactly as it is explained in the documentation - which means be careful about every letter including spaces. </p>
  
Answers: CC BY-SA 3.0
Answers: 2018-04-09T12:34:46.797Z
Answers: 2018-04-09T12:34:46.797Z
Answers: petrchpetr
Body: <p>How to authenticate against AWS to make API query ?</p>
  
  <pre><code>https://iam.amazonaws.com/?Action=ListAttachedUserPolicies&amp;UserName=ja&amp;Version=2010-05-08&amp;accesskey
  </code></pre>
  
  <p>and getting:</p>
  
  <pre><code>&lt;Code&gt;MissingAuthenticationToken&lt;/Code&gt;
  &lt;Message&gt;Request is missing Authentication Token&lt;/Message&gt;
  </code></pre>
  
Comments: CC BY-SA 3.0
Comments: 2018-04-06T13:06:25.690Z
Comments: You have to pass an access key...  what did you try ? which command are you passing ?
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2018-04-06T13:08:43.853Z
Comments: I already passed access key, i need to get list of attached user policies (see link i posted in question)
Comments: Milister
Comments: CC BY-SA 3.0
Comments: 2018-04-06T13:10:34.530Z
Comments: This is usually related to requesting a URL that doesn't exist .. make sure you're using the correct HTTP method and path to a valid resource.
Comments: storm
Comments: CC BY-SA 3.0
Comments: 2018-04-06T13:12:52.333Z
Comments: i collected that link from AWS docs:https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html
Comments: Milister
Comments: CC BY-SA 3.0
Comments: 2018-04-06T13:15:34.063Z
Comments: From [Welcome page](https://docs.aws.amazon.com/IAM/latest/APIReference/Welcome.html): "Requests must be signed using an **access key ID** and **a secret access key**. " As far as I can guess from the few you gave, you're passing only an accesskey (in a strange form, I can't tell if accesskey is a placeholder here or just the parameter name with the value stripped down)
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2018-04-06T13:16:20.740Z
Comments: And you probably need to read this also: https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2018-04-06T13:19:02.980Z
Comments: yes, accesskey is parameter, but when specify secret then getting :<Code>MalformedQueryString</Code>
  <Message>Keys may not contain +</Messag
Comments: Milister
Tags: <amazon-web-services><api>
Title: AWS REST API Query
UserDisplayName: Milister
ThreadText: # AWS REST API Query
  
  (Asked by: username_0 on 2018-04-06)
  
  How to authenticate against AWS to make API query ?
  
  ```
  https://iam.amazonaws.com/?Action=ListAttachedUserPolicies&UserName=ja&Version=2010-05-08&accesskey
  
  ```
  
  and getting:
  
  ```
  <Code>MissingAuthenticationToken</Code>
  <Message>Request is missing Authentication Token</Message>
  
  ```
  
  **Tags:** amazon-web-services, api
  
  > **Comments:**
  > **username_1**: You have to pass an access key...  what did you try ? which command are you passing ?  
  > **username_0**: I already passed access key, i need to get list of attached user policies (see link i posted in question)  
  > **username_2**: This is usually related to requesting a URL that doesn't exist .. make sure you're using the correct HTTP method and path to a valid resource.  
  > **username_0**: i collected that link from AWS docs:https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html  
  > **username_1**: From [Welcome page](https://docs.aws.amazon.com/IAM/latest/APIReference/Welcome.html): "Requests must be signed using an **access key ID** and **a secret access key**. " As far as I can guess from the few you gave, you're passing only an accesskey (in a strange form, I can't tell if accesskey is a placeholder here or just the parameter name with the value stripped down)  
  > **username_1**: And you probably need to read this also: https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html  
  > **username_0**: yes, accesskey is parameter, but when specify secret then getting :<Code>MalformedQueryString</Code> <Message>Keys may not contain +</Messag  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2018-04-06. Score: 2
  
  Got it working by aws curl <https://github.com/okigan/awscurl>
  
  ```
  awscurl --service iam 'https://iam.amazonaws.com/?Action=ListUsers&Version=2010-05-08'
  
  ```
  
  > **Comments:**
  > **username_1**: I Really wonder what that bring up over aws cli... This whole Q/A sounds useless for anyone but you for me  
  > **username_0**: tried to find a way to get IAM roles from python, not using subprocesses, and hoped  awscurl could be run from python script-from shell it works fine but from python again got missing authentication (using reguests)  
  > **username_1**: Why don't you use boto3 in python, the official aws python sdk?  
  > **username_0**: it doesn't have all capability as aws cli/aws url  
  > **username_1**: Sounds utterly strange as aws cli is a python program... https://github.com/aws/aws-cli  
  > **username_1**: After re-reading it I was thinking king about botocore, the low level interface behind bouo3 to make raw requests: https://github.com/boto/botocore  
  
  ---
  
  ### Answer by username_3 on 2018-04-09. Score: 0
  
  The referred documentation from the question
  <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html>
  
  has this example of a request:
  
  ```
  https://iam.amazonaws.com/?Action=ListAttachedUserPolicies
  &UserName=Alice
  &Version=2010-05-08
  &AUTHPARAMS
  
  ```
  
  AUTHPARAMS are explained
  <https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html>
  
  (version 4 is preferred)
  <https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html>
  
  So you have to calculate a digest from the request together with your secret key and you have to do it exactly as it is explained in the documentation - which means be careful about every letter including spaces.
  
  
  ---
  
  