Checksum Validation

The AWS CLI will perform checksum validation for uploading and downloading

files in specific scenarios.

Upload

The AWS CLI will calculate and auto-populate the ``Content-MD5`` header for

both standard and multipart uploads. If the checksum that S3 calculates does

not match the ``Content-MD5`` provided, S3 will not store the object and

instead will return an error message back the AWS CLI. The AWS CLI will retry

this error up to 5 times before giving up. On the case that any files fail to

transfer successfully to S3, the AWS CLI will exit with a non zero RC.

See ``aws help returncodes`` for more information.

If the upload request is signed with Signature Version 4, then a

``Content-MD5`` is not calculated. Instead, the AWS CLI uses the

``x-amz-content-sha256`` header as a checksum instead of ``Content-MD5``.

The AWS CLI will use Signature Version 4 for S3 in several cases:

* You're using an AWS region that only supports Signature Version 4. This

includes ``eu-central-1`` and ``ap-northeast-2``.

* You explicitly opt in and set ``signature_version = s3v4`` in your

``~/.aws/config`` file.

Download

The AWS CLI will attempt to verify the checksum of downloads when possible,

based on the ``ETag`` header returned from a ``GetObject`` request that's

performed whenever the AWS CLI downloads objects from S3. If the calculated

MD5 checksum does not match the expected checksum, the file is deleted

and the download is retried. This process is retried up to 3 times.

If a downloads fails, the AWS CLI will exit with a non zero RC.

See ``aws help returncodes`` for more information.

There are several conditions where the CLI is *not* able to verify

checksums on downloads:

* If the object was uploaded via multipart uploads

* If the object was uploaded using server side encryption with KMS

* If the object was uploaded using a customer provided encryption key

* If the object is downloaded using range ``GetObject`` requests