AmazonS3ClientBuilder, bucket policies, and regions

[bagovino]

Hi,

I've recently been trying to convert over code that uses the older, deprecated AmazonS3Client constructor to use the newer AmazonS3ClientBuilder and I've run into a strange issue with bucket policies and regions. If I create a request to list buckets it works as expected; all buckets in all regions for the account are returned. If I then try to issue a request to get the policy information associated with a bucket created in a region different from the one the client was created with I receive the following exception:

com.amazonaws.services.s3.model.AmazonS3Exception: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'us-east-2' (Service: Amazon S3; Status Code: 400; Error Code: AuthorizationHeaderMalformed; Request ID: 6E6A72061A624467), S3 Extended Request ID: eDvvfakSO4x98fd5r6zQPzE00e8zx7Kmrp8wJaDP27WZMvQVsWq7gb4MVVAlTV++Qi00UMNPWyg=

This code had previously worked. Is this a bug or do we now have to look for region exceptions and correct and reissue the request?

Thanks in advance.

[millems]

Were you previously not setting a region on the AmazonS3Client, and now are specifying us-east-1? (Presumably because the client builder doesn't allow excluding the region.)

[bagovino]

Yup, before they were omitting the region when instantiating the client, but now that a region is required for the builders I was passing in us-east-1.

[millems]

To emulate the previous behavior (no region configured), you'll need to also enable "forced global bucket access" in the client builder:

AmazonS3 client = 
        AmazonS3ClientBuilder.standard()
                             .withRegion("us-east-1") // The first region to try your request against
                             .withForceGlobalBucketAccess(true) // If a bucket is in a different region, try again in the correct region
                             .build();

This will suppress the exception you received and automatically retry the request under the region in the exception. It is made explicit in the builder so you are aware of this cross-region behavior. Note: The SDK will cache the bucket region after the first failure, so that every request against this bucket doesn't have to happen twice.

[bagovino]

That did the trick. Thanks for your help. :)