diff --git a/common.go b/common.go
index 54f69b5..f39c899 100644
--- a/common.go
+++ b/common.go
@@ -288,3 +288,13 @@ func shouldEscape(c byte) bool {
 	}
 	return true
 }
+
+func normquery(v url.Values) string {
+	qs := v.Encode()
+
+	// Go encodes a space as '+' but Amazon require '%20'. Luckily any '+' in the
+	// original query string has been percent escaped so all '+' chars that are left
+	// were originally spaces.
+
+	return strings.Replace(qs, "+", "%20", -1)
+}
diff --git a/sign4.go b/sign4.go
index 4ae56d8..3ae9da6 100644
--- a/sign4.go
+++ b/sign4.go
@@ -36,7 +36,7 @@ func hashedCanonicalRequestV4(req *http.Request, meta *metadata) string {
 		headersToSign += key + ":" + value + "\n"
 	}
 	meta.signedHeaders = concat(";", sortedHeaderKeys...)
-	canonicalRequest := concat("\n", req.Method, normuri(req.URL.Path), req.URL.Query().Encode(), headersToSign, meta.signedHeaders, payloadHash)
+	canonicalRequest := concat("\n", req.Method, normuri(req.URL.Path), normquery(req.URL.Query()), headersToSign, meta.signedHeaders, payloadHash)
 
 	return hashSHA256([]byte(canonicalRequest))
 }