Go

Connect from Go with the AWS SDK for Go v2.

The AWS SDK for Go v2 works with Zata after one small fix: a middleware that keeps the Accept-Encoding header out of the request signature. This page gives a complete example with that fix.

Partly tested with the AWS SDK for Go v2 (service/s3 v1.114.3) and Go 1.24 on Zata in October 2026: upload, list and delete.

Before you start

• A bucket. See Create a bucket.
• An access key and secret key from the same region as the bucket. See Access keys.
• Go installed. See go.dev/doc/install.

Connection settings

Setting	Value
BaseEndpoint	https://idr01.zata.ai for Indore, https://bom01.zata.ai for Mumbai
Region	us-east-1
Access key / Secret key	from Access Keys in the Zata console. The key must be from the same region as the bucket.
UsePathStyle	true
RequestChecksumCalculation / ResponseChecksumValidation	WhenRequired
Accept-Encoding middleware	required, see below

Install the SDK

In your Go module:

go get github.com/aws/aws-sdk-go-v2/config github.com/aws/aws-sdk-go-v2/service/s3

Set your keys

Keep your keys out of the code. The SDK reads them from environment variables:

export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY

Example: upload, list and delete

This program uploads myfile.txt, lists the files in the folder and deletes the file again. For a bucket in Mumbai, use https://bom01.zata.ai.

main.go

package main

import (
	"context"
	"fmt"
	"log"
	"os"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/s3"
	"github.com/aws/smithy-go/middleware"
	smithyhttp "github.com/aws/smithy-go/transport/http"
)

// Zata rejects requests that sign the Accept-Encoding header, which the Go SDK
// signs by default: leave it out of the signature.
func unsignedAcceptEncoding(stack *middleware.Stack) error {
	return stack.Finalize.Insert(middleware.FinalizeMiddlewareFunc("zataUnsignedAcceptEncoding",
		func(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) (middleware.FinalizeOutput, middleware.Metadata, error) {
			if r, ok := in.Request.(*smithyhttp.Request); ok {
				r.Header.Del("Accept-Encoding")
			}
			return next.HandleFinalize(ctx, in)
		}), "Signing", middleware.Before)
}

func main() {
	ctx := context.Background()

	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion("us-east-1"))
	if err != nil {
		log.Fatal(err)
	}
	client := s3.NewFromConfig(cfg, func(o *s3.Options) {
		o.BaseEndpoint = aws.String("https://idr01.zata.ai")
		o.UsePathStyle = true
		o.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired
		o.ResponseChecksumValidation = aws.ResponseChecksumValidationWhenRequired
		o.APIOptions = append(o.APIOptions, unsignedAcceptEncoding)
	})

	// Upload a file
	f, err := os.Open("myfile.txt")
	if err != nil {
		log.Fatal(err)
	}
	defer f.Close()
	_, err = client.PutObject(ctx, &s3.PutObjectInput{
		Bucket: aws.String("my-bucket"),
		Key:    aws.String("folder/myfile.txt"),
		Body:   f,
	})
	if err != nil {
		log.Fatal(err)
	}

	// List the files in the folder
	out, err := client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
		Bucket: aws.String("my-bucket"),
		Prefix: aws.String("folder/"),
	})
	if err != nil {
		log.Fatal(err)
	}
	for _, obj := range out.Contents {
		fmt.Println(aws.ToString(obj.Key), aws.ToInt64(obj.Size))
	}

	// Delete the file
	_, err = client.DeleteObject(ctx, &s3.DeleteObjectInput{
		Bucket: aws.String("my-bucket"),
		Key:    aws.String("folder/myfile.txt"),
	})
	if err != nil {
		log.Fatal(err)
	}
}

Run it:

go mod tidy
go run main.go

Without unsignedAcceptEncoding, every request fails with SignatureDoesNotMatch. Other tools built on the Go SDK v2 have the same problem.

The checksum options exist in service/s3 releases from January 2025. On older releases, leave those two lines out.

Downloads (GetObject) and presigned URLs were not tested with the Go SDK yet. If you need tested download links, make them with Python or the AWS CLI.

Troubleshooting

Problem	Fix
SignatureDoesNotMatch on every request	Add the unsignedAcceptEncoding middleware to APIOptions.
Large uploads fail with XAmzContentSHA256Mismatch	Set RequestChecksumCalculation and ResponseChecksumValidation to WhenRequired.
InvalidAccessKeyId	BaseEndpoint is missing (requests go to AWS), or the key is from the other region.
NoSuchBucket	Use the endpoint of the region the bucket is in.

For other errors, see Signature errors and Wrong endpoint or region.