SignatureDoesNotMatch on S3 PresignPutObject - go

Question

I've got a golang backend in which I want to generate a signed s3 URL so that a React frontend can upload to. When using the generated URL, I'm always getting a 403 SignatureDoesNotMatch.
Here's how I generate the URL on the backend:
client := s3.NewFromConfig(aws.Config{
Region: cfg.Region,
Credentials: credentials.NewStaticCredentialsProvider(cfg.AccessKeyId, cfg.SecretAccessKey, ""),
})
presignClient := s3.NewPresignClient(client, func(opts *s3.PresignOptions) {
opts.Expires = time.Duration(60 * int(time.Second))
})
headOut, err := client.HeadBucket(ctx, &s3.HeadBucketInput{
Bucket: aws.String("bucket-name-example"),
}) // THIS RETURNS NO ERROR - AWS SECRETS ARE GOOD
req, err := presignClient.PresignPutObject(ctx, &s3.PutObjectInput{
Bucket: aws.String("bucket-name-example"),
Key: aws.String("randomFileName"),
})
return req.URL // Using this URL in the Frontend
And on the UI I do:
return await fetch(signedURLFromBackend, {
method: "PUT",
headers: {
"Content-Type": "multipart/form-data", // removing this doesn't fix it
},
body: file,
})
On AWS, I'm using an IAM user with all s3 policies right now (testing). The S3 bucket has
ACLs disabled
Following bucket policy:
{
"Version": "2012-10-17",
"Id": "Policy1675697346173",
"Statement": [
{
"Sid": "Stmt1675697339589",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::userled-assets-library/*"
}
]
}
Following CORS settings:
[
{
"AllowedHeaders": ["*"],
"AllowedMethods": ["PUT","HEAD","GET"],
"AllowedOrigins": ["*"],
"ExposeHeaders": []
}
]