AWS App Runner生成S3预签名URL遇AuthorizationQueryParametersError报错

问题描述 #

在us-east-2区域的AWS App Runner服务中，尝试为同区域的S3桶生成预签名URL，已确认实例角色拥有S3全权限，且代码和环境变量均显式设置了us-east-2区域，但调用接口时出现以下错误：

return (<Error>
<Code>AuthorizationQueryParametersError</Code>
<Message>Error parsing the X-Amz-Credential parameter; the region 'us-east-2' is wrong; expecting 'us-east-1'</Message>
<Region>us-east-1</Region>
<RequestId>xxxxx</RequestId>
<HostId>xxxxx</HostId>
</Error>
)

使用的代码如下：

aws_config = Config(
    region_name="us-east-2",
    signature_version="v4",
)

session = boto3.Session(region_name="us-east-2")

s3resource = session.resource("s3", config=aws_config)
s3client = session.client("s3", config=aws_config)

def generate_s3_presigned_url(bucket, key, expiration: int = 3600):
    """Geenerate a temporary url for an object.

    Args:
        bucket: The s3 bucket to sync from
        key: the key to generate a url for
    """
    signed_url = s3client.generate_presigned_url(
        "get_object",
        Params={"Bucket": bucket, "Key": key},
        ExpiresIn=expiration,
    )
    return signed_url

问题原因 #

虽然桶和服务都在us-east-2，但boto3默认可能会使用S3的全局端点（s3.amazonaws.com），这个端点对应的签名区域是us-east-1，导致生成的预签名URL中使用的区域与S3桶实际区域不匹配，触发授权错误。

解决方案 #

创建S3客户端时，显式指定区域端点，确保签名区域与桶所在区域一致。修改代码如下：

aws_config = Config(
    region_name="us-east-2",
    signature_version="v4",
)

session = boto3.Session(region_name="us-east-2")

# 显式指定S3区域端点
s3client = session.client(
    "s3",
    config=aws_config,
    endpoint_url="https://s3.us-east-2.amazonaws.com"
)

def generate_s3_presigned_url(bucket, key, expiration: int = 3600):
    """Generate a temporary url for an object.

    Args:
        bucket: The s3 bucket to sync from
        key: the key to generate a url for
    """
    signed_url = s3client.generate_presigned_url(
        "get_object",
        Params={"Bucket": bucket, "Key": key},
        ExpiresIn=expiration,
    )
    return signed_url

额外验证步骤 #

• 确认S3桶确实创建在us-east-2区域，可通过AWS控制台查看桶属性。
• 检查App Runner服务的执行角色权限是否包含s3:GetObject（虽然你说已设置全权限，但再次确认避免遗漏）。
• 若仍有问题，可在代码中添加日志输出客户端的区域配置，确认是否生效：

  print(f"S3 Client Region: {s3client.meta.region_name}")
  print(f"S3 Client Endpoint: {s3client.meta.endpoint_url}")
  

内容的提问来源于stack exchange，提问作者Daniel Borders