We’re using CF Tunnel to provide access to a S3 server (ceph rgw).
When we enable the a “Service Auth policy” and we supply the “Service Token” the requests are somehow modified by the CF Tunnel, and so S3 always complains about it:
We get a 403:
<?xml version="1.0" encoding="UTF-8"?>
<Error>
<Code>SignatureDoesNotMatch</Code>
<RequestId>tx00000332be2bfbfb88349-00638f5d42-1320ea-us1</RequestId>
<HostId>1320ea-us1-america</HostId>
</Error>
We think this happens because CF strips the original headers in the request (CF-Access-Client-Id / CF-Access-Client-Secret)