DynamoDB IncompleteSignatureException

TL;DR — The request's AWS Signature Version 4 signature was incomplete or didn't conform to AWS standards, so DynamoDB rejected it before authenticating. If you use an AWS SDK the signing is automatic — this almost always means a hand-built request, a proxy/gateway that mangled the Authorization header, or clock skew. Let the SDK sign, and check the machine clock.

What it means

IncompleteSignatureException: The request signature does not conform to AWS standards.

AWS signs every request with SigV4. This exception means the signature was present but malformed or missing required components — a bad Authorization header, a missing signed header, or a canonical-request mismatch. It's an HTTP 400, client-side, and not retryable as-is: the signature has to be corrected.

Why it happens

• Hand-rolled signing — you're building the SigV4 signature yourself (not through an SDK) and the canonical request, signed-headers list, or Authorization header is wrong.
• A proxy or API gateway rewrote the request — mutating headers, the path, or the body after the SDK signed it invalidates the signature (SigV4 signs those).
• Clock skew — the machine clock is off far enough that the request timestamp fails signature validation (this can surface as a signature error rather than an "expired" one).
• Manually edited headers — adding/removing headers after signing, or reordering the query string, breaks the canonical request.
• A truncated or wrong secret access key used to compute the signature.

How to fix it

1. Use an official AWS SDK and let it sign the request. The SDKs implement SigV4 correctly for you — the fix for almost every occurrence is to stop hand-signing.
2. Don't mutate the request after signing — if a proxy/gateway sits in front, make sure it doesn't add, drop, or reorder headers or change the body/path. Sign at the edge that actually sends the request.
3. Sync the machine clock (NTP). A skewed clock can invalidate the signature.
4. If you must sign manually, follow the AWS SigV4 signing process exactly — the canonical request, the string-to-sign, the signing key derivation, and the Authorization header must all match. Verify against a known-good SDK request.
5. Confirm the full secret key — a truncated AWS_SECRET_ACCESS_KEY produces a signature that never validates.

FAQ

What causes an IncompleteSignatureException? The AWS SigV4 signature on the request was malformed or missing required parts. With an AWS SDK signing is automatic, so it usually means a hand-built signature, a proxy that altered the request after signing, or a machine clock skewed enough to invalidate the signature.

How is this different from UnrecognizedClientException? IncompleteSignatureException means the signature itself was malformed. UnrecognizedClientException ("security token is invalid") means the signature was well-formed but the credentials behind it weren't accepted.

Related errors

• The security token included in the request is invalid — well-formed signature, bad credentials.
• The security token included in the request is expired — temporary credentials timed out.
• Missing region in config