fix(aiohttp): Preserve SigV4-signed propagation headers

aiobotocore sends botocore's already-signed requests through aiohttp. The
Boto3 integration adds sentry-trace and baggage before signing, so both end up
named in SignedHeaders, and the aiohttp client integration then rewrote them
on the way out, appending to baggage. The sent value no longer matched the
signed one, so the service rejected the request with SignatureDoesNotMatch.

Against Cloudflare R2 this failed every signed call for as long as a
transaction was active, while calls made outside one kept working, so it
presented as intermittent and credential-shaped.

stdlib already skips propagation headers covered by SignedHeaders, which is
why synchronous boto3 is unaffected. Apply the same rule on the aiohttp path,
reading the signed names from the Authorization header, or from the query
string when the request is a presigned URL, as stdlib does for both. Headers
that are not signed are still added, so propagation is unchanged.

Fixes #7426

Author: Robinclash

sentry_sdk/integrations/aiohttp.py

@@ -39,6 +39,8 @@
     should_propagate_trace,
 )
 from sentry_sdk.utils import (
+    _get_aws_sigv4_signed_headers_from_authorization_header,
+    _get_aws_sigv4_signed_headers_from_url_query_string,
     CONTEXTVARS_ERROR_MESSAGE,
     HAS_REAL_CONTEXTVARS,
     SENSITIVE_DATA_SUBSTITUTE,
@@ -464,12 +466,48 @@ async def on_request_start(
             span = legacy_span
 
         if should_propagate_trace(client, str(params.url)):
+            # A request already signed with AWS SigV4 — aiobotocore routes
+            # botocore's signed requests through aiohttp — covers whichever
+            # propagation headers `SignedHeaders` names. Rewriting one of those
+            # here, after signing, makes the sent value differ from the signed
+            # one, and the service rejects the request with
+            # `SignatureDoesNotMatch`. `stdlib` skips signed headers for the
+            # same reason; do the same on this path.
+            signed_headers: "Set[str]" = set()
+            with capture_internal_exceptions():
+                authorization = params.headers.get("Authorization")
+                if authorization:
+                    if isinstance(authorization, bytes):
+                        authorization = authorization.decode("latin-1")
+                    signed_headers = (
+                        _get_aws_sigv4_signed_headers_from_authorization_header(
+                            authorization
+                        )
+                    )
+                else:
+                    # A presigned URL carries its signed header names in the
+                    # query string instead of an Authorization header.
+                    signed_headers = (
+                        _get_aws_sigv4_signed_headers_from_url_query_string(
+                            str(params.url)
+                        )
+                    )
+
             for (
                 key,
                 value,
             ) in sentry_sdk.get_current_scope().iter_trace_propagation_headers(
                 span=span
             ):
+                if key.lower() in signed_headers:
+                    logger.debug(
+                        "[Tracing] Not adding `{key}` header to outgoing request "
+                        "to {url}: it is covered by the AWS SigV4 signature.".format(
+                            key=key, url=params.url
+                        )
+                    )
+                    continue
+
                 logger.debug(
                     "[Tracing] Adding `{key}` header {value} to outgoing request to {url}.".format(
                         key=key, value=value, url=params.url

tests/integrations/aiohttp/test_aiohttp.py

@@ -2374,3 +2374,122 @@ async def hello(request):
         assert event["request"]["env"] == {"REMOTE_ADDR": "127.0.0.1"}
     else:
         assert "env" not in event["request"]
+
+
+@pytest.mark.asyncio
+async def test_outgoing_trace_headers_leave_sigv4_signed_headers_alone(
+    sentry_init, aiohttp_raw_server, aiohttp_client
+):
+    """Regression test for #7426.
+
+    aiobotocore sends botocore's already-signed requests through aiohttp. When
+    `SignedHeaders` covers `sentry-trace` or `baggage`, rewriting either one
+    here changes the value the service verifies the signature against, and the
+    request is rejected with `SignatureDoesNotMatch`. Signed propagation
+    headers must be left exactly as botocore set them.
+    """
+    sentry_init(
+        integrations=[AioHttpIntegration()],
+        traces_sample_rate=1.0,
+    )
+
+    async def handler(request):
+        return web.Response(text="OK")
+
+    raw_server = await aiohttp_raw_server(handler)
+
+    signed_baggage = "sentry-trace_id=aaaa,sentry-sample_rate=1.0"
+    signed_sentry_trace = "0123456789012345678901234567890-1234567890123456-1"
+    authorization = (
+        "AWS4-HMAC-SHA256 Credential=key/20260908/auto/s3/aws4_request, "
+        "SignedHeaders=baggage;host;sentry-trace;x-amz-date, "
+        "Signature=deadbeef"
+    )
+
+    with start_transaction(name="aws-call", op="greeting.sniff"):
+        client = await aiohttp_client(raw_server)
+        resp = await client.get(
+            "/",
+            headers={
+                "Authorization": authorization,
+                "baggage": signed_baggage,
+                "sentry-trace": signed_sentry_trace,
+            },
+        )
+
+    # Both headers are covered by the signature, so neither may be touched.
+    assert resp.request_info.headers["baggage"] == signed_baggage
+    assert resp.request_info.headers["sentry-trace"] == signed_sentry_trace
+
+
+@pytest.mark.asyncio
+async def test_outgoing_trace_headers_added_when_not_signed(
+    sentry_init, aiohttp_raw_server, aiohttp_client
+):
+    """An unsigned propagation header is still added, even alongside SigV4.
+
+    Only the headers named in `SignedHeaders` are off limits; skipping every
+    header on a signed request would silently drop propagation.
+    """
+    sentry_init(
+        integrations=[AioHttpIntegration()],
+        traces_sample_rate=1.0,
+    )
+
+    async def handler(request):
+        return web.Response(text="OK")
+
+    raw_server = await aiohttp_raw_server(handler)
+
+    signed_sentry_trace = "0123456789012345678901234567890-1234567890123456-1"
+    # `baggage` is deliberately absent from SignedHeaders.
+    authorization = (
+        "AWS4-HMAC-SHA256 Credential=key/20260908/auto/s3/aws4_request, "
+        "SignedHeaders=host;sentry-trace;x-amz-date, "
+        "Signature=deadbeef"
+    )
+
+    with start_transaction(name="aws-call", op="greeting.sniff"):
+        client = await aiohttp_client(raw_server)
+        resp = await client.get(
+            "/",
+            headers={
+                "Authorization": authorization,
+                "sentry-trace": signed_sentry_trace,
+            },
+        )
+
+    assert resp.request_info.headers["sentry-trace"] == signed_sentry_trace
+    assert "baggage" in resp.request_info.headers
+
+@pytest.mark.asyncio
+async def test_outgoing_trace_headers_leave_presigned_url_signed_headers_alone(
+    sentry_init, aiohttp_raw_server, aiohttp_client
+):
+    """A presigned URL names its signed headers in the query string.
+
+    There is no Authorization header to read in that case, so the signed names
+    have to come from `X-Amz-SignedHeaders`.
+    """
+    sentry_init(
+        integrations=[AioHttpIntegration()],
+        traces_sample_rate=1.0,
+    )
+
+    async def handler(request):
+        return web.Response(text="OK")
+
+    raw_server = await aiohttp_raw_server(handler)
+
+    signed_baggage = "sentry-trace_id=aaaa,sentry-sample_rate=1.0"
+
+    with start_transaction(name="aws-call", op="greeting.sniff"):
+        client = await aiohttp_client(raw_server)
+        resp = await client.get(
+            "/?X-Amz-Algorithm=AWS4-HMAC-SHA256"
+            "&X-Amz-SignedHeaders=baggage%3Bhost"
+            "&X-Amz-Signature=deadbeef",
+            headers={"baggage": signed_baggage},
+        )
+
+    assert resp.request_info.headers["baggage"] == signed_baggage