AWS Textract "InvalidParameterException" on a digitally signed PDF

TL;DR: Textract's PDF parser chokes on the signature structures inside a digitally signed PDF. Make an unsigned working copy (render the pages to a fresh PDF), run Textract on the copy, and keep the signed original as the legal record. Do not try to "fix" the signed file itself.

InvalidParameterException

1. Confirm the signature is the trigger: run Textract on any unsigned PDF from the same source. Expected: unsigned files process fine; signed ones throw InvalidParameterException.

2. Check the file structure: qpdf --check signed.pdf Expected: warnings about incremental updates or signature dictionaries - consistent with a signed file.

3. Render an unsigned working copy: gs -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=unsigned-working-copy.pdf signed.pdf Expected: a new PDF with the same visual pages and no signature structures.

4. Submit the working copy to Textract. Expected: the job starts and completes normally.

5. Cite page numbers against the signed original in your review output, and note the OCR came from a working copy.

Use this when

• Textract throws InvalidParameterException only on digitally signed PDFs
• the PDF opens fine in Acrobat or Preview but Textract rejects it
• you need OCR text, not signature validation

Not for this skill when

• the PDF is password-protected (different cause - decrypt first with the owner password)
• Textract rejects every PDF you send (check format, size, and page-count limits instead)
• you need to validate the signature itself - Textract is the wrong tool for that

Variant phrasings

textract InvalidParameterException signed pdf

aws textract fails on digitally signed document

textract signed pdf not supported workaround

Why it happens

Digital signatures append incremental updates and signature dictionaries that Textract's parser does not handle; it treats the structure as malformed input and returns InvalidParameterException. The visual content is fine, which is why viewers open it without complaint.

Edge cases

• Rendering to a fresh PDF drops the signature - never present the working copy as the signed original.
• Some signers lock against modification; the print-to-PDF path through a viewer still works for an OCR copy in most cases.
• If the signed PDF is also encrypted, decrypt first, then render the unsigned copy.
• Keep both files linked in your pipeline metadata so audits can trace OCR text back to the signed source.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5CSZYqNvV5hJilaZYaO6Ug