Skip to navigation

Go

Connect from Go with the AWS SDK for Go v2.

The AWS SDK for Go v2 works with Zata after one small fix: a middleware that keeps the Accept-Encoding header out of the request signature. This page gives a complete example with that fix.

Partly tested with the AWS SDK for Go v2 (service/s3 v1.114.3) and Go 1.24 on Zata in October 2026: upload, list and delete.

Before you start

Connection settings

SettingValue
BaseEndpointhttps://idr01.zata.ai for Indore, https://bom01.zata.ai for Mumbai
Regionus-east-1
Access key / Secret keyfrom Access Keys in the Zata console. The key must be from the same region as the bucket.
UsePathStyletrue
RequestChecksumCalculation / ResponseChecksumValidationWhenRequired
Accept-Encoding middlewarerequired, see below

Install the SDK

In your Go module:

go get github.com/aws/aws-sdk-go-v2/config github.com/aws/aws-sdk-go-v2/service/s3

Set your keys

Keep your keys out of the code. The SDK reads them from environment variables:

export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY

Example: upload, list and delete

This program uploads myfile.txt, lists the files in the folder and deletes the file again. For a bucket in Mumbai, use https://bom01.zata.ai.

main.go
package main
import (
"context"
"fmt"
"log"
"os"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/config"
"github.com/aws/aws-sdk-go-v2/service/s3"
"github.com/aws/smithy-go/middleware"
smithyhttp "github.com/aws/smithy-go/transport/http"
)
// Zata rejects requests that sign the Accept-Encoding header, which the Go SDK
// signs by default: leave it out of the signature.
func unsignedAcceptEncoding(stack *middleware.Stack) error {
return stack.Finalize.Insert(middleware.FinalizeMiddlewareFunc("zataUnsignedAcceptEncoding",
func(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) (middleware.FinalizeOutput, middleware.Metadata, error) {
if r, ok := in.Request.(*smithyhttp.Request); ok {
r.Header.Del("Accept-Encoding")
}
return next.HandleFinalize(ctx, in)
}), "Signing", middleware.Before)
}
func main() {
ctx := context.Background()
cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion("us-east-1"))
if err != nil {
log.Fatal(err)
}
client := s3.NewFromConfig(cfg, func(o *s3.Options) {
o.BaseEndpoint = aws.String("https://idr01.zata.ai")
o.UsePathStyle = true
o.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired
o.ResponseChecksumValidation = aws.ResponseChecksumValidationWhenRequired
o.APIOptions = append(o.APIOptions, unsignedAcceptEncoding)
})
// Upload a file
f, err := os.Open("myfile.txt")
if err != nil {
log.Fatal(err)
}
defer f.Close()
_, err = client.PutObject(ctx, &s3.PutObjectInput{
Bucket: aws.String("my-bucket"),
Key: aws.String("folder/myfile.txt"),
Body: f,
})
if err != nil {
log.Fatal(err)
}
// List the files in the folder
out, err := client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
Bucket: aws.String("my-bucket"),
Prefix: aws.String("folder/"),
})
if err != nil {
log.Fatal(err)
}
for _, obj := range out.Contents {
fmt.Println(aws.ToString(obj.Key), aws.ToInt64(obj.Size))
}
// Delete the file
_, err = client.DeleteObject(ctx, &s3.DeleteObjectInput{
Bucket: aws.String("my-bucket"),
Key: aws.String("folder/myfile.txt"),
})
if err != nil {
log.Fatal(err)
}
}

Run it:

go mod tidy
go run main.go

Without unsignedAcceptEncoding, every request fails with SignatureDoesNotMatch. Other tools built on the Go SDK v2 have the same problem.

The checksum options exist in service/s3 releases from January 2025. On older releases, leave those two lines out.

Downloads (GetObject) and presigned URLs were not tested with the Go SDK yet. If you need tested download links, make them with Python or the AWS CLI.

Troubleshooting

ProblemFix
SignatureDoesNotMatch on every requestAdd the unsignedAcceptEncoding middleware to APIOptions.
Large uploads fail with XAmzContentSHA256MismatchSet RequestChecksumCalculation and ResponseChecksumValidation to WhenRequired.
InvalidAccessKeyIdBaseEndpoint is missing (requests go to AWS), or the key is from the other region.
NoSuchBucketUse the endpoint of the region the bucket is in.

For other errors, see Signature errors and Wrong endpoint or region.