CloudFront Key Value Store API调用报错：无支持的身份验证方案

问题描述 #

调用CloudFront Key Value Store相关API（如DescribeKeyValueStore）时，抛出如下错误：

/Users/kjw/.asdf/installs/ruby/3.2.2/lib/ruby/gems/3.2.0/gems/aws-sdk-core-3.201.1/lib/aws-sdk-core/endpoints.rb:32:in `resolve_auth_scheme': No supported auth scheme for this endpoint. (RuntimeError)
        from /Users/kjw/.asdf/installs/ruby/3.2.2/lib/ruby/gems/3.2.0/gems/aws-sdk-cloudfrontkeyvaluestore-1.10.0/lib/aws-sdk-cloudfrontkeyvaluestore/plugins/endpoints.rb:41:in `call'
        from /Users/kjw/.asdf/installs/ruby/3.2.2/lib/ruby/gems/3.2.0/gems/aws-sdk-core-3.201.1/lib/aws-sdk-core/plugins/endpoint_discovery.rb:84:in `call'
        from /Users/kjw/.asdf/installs/ruby/3.2.2/lib/ruby/gems/3.2.0/gems/aws-sdk-core-3.201.1/lib/seahorse/client/plugins/endpoint.rb:46:in `call'
        from /Users/kjw/.asdf/installs/ruby/3.2.2/lib/ruby/gems/3.2.0/gems/aws-sdk-core-3.201.1/lib/aws-sdk-core/plugins/param_validator.rb:26:in `call'
        from /Users/kjw/.asdf/installs/ruby/3.2.2/lib/ruby/gems/3.2.0/gems/aws-sdk-core-3.201.1/lib/seahorse/client/plugins/raise_response_errors.rb:16:in `call'

客户端已配置AWS区域，其他AWS API可正常调用，但CloudFront KVS API无法工作。

原因分析 #

CloudFront Key Value Store是全局AWS服务，其API需要使用SigV4a（多区域SigV4）认证协议，而旧版本的AWS Ruby SDK可能不支持该认证方式；同时，若区域配置不正确，会导致SDK无法解析正确的服务端点及对应认证方案。

解决步骤 #

1. 升级AWS Ruby SDK版本 #

确保aws-sdk-core和aws-sdk-cloudfrontkeyvaluestore gem版本足够新，以支持SigV4a认证：

# 升级核心SDK
gem update aws-sdk-core
# 升级CloudFront KVS SDK
gem update aws-sdk-cloudfrontkeyvaluestore

建议将aws-sdk-core升级到3.210.0及以上版本，aws-sdk-cloudfrontkeyvaluestore升级到1.11.0及以上版本（版本号以实际最新兼容版本为准）。

2. 正确配置客户端区域 #

CloudFront KVS服务使用全局端点，需将客户端区域指定为us-east-1（AWS全局服务的默认区域），示例代码：

require 'aws-sdk-cloudfrontkeyvaluestore'

client = Aws::CloudFrontKeyValueStore::Client.new(
  region: 'us-east-1',
  # 其他认证配置（如access_key_id、secret_access_key，若未通过环境变量/凭证文件配置）
)

# 调用API示例
resp = client.describe_key_value_store({
  key_value_store_arn: 'arn:aws:cloudfront::123456789012:key-value-store/abc123'
})

3. 强制指定服务端点（可选） #

若升级SDK后仍有问题，可手动指定全局端点：

client = Aws::CloudFrontKeyValueStore::Client.new(
  region: 'us-east-1',
  endpoint: 'https://cloudfront-keyvaluestore.amazonaws.com'
)

验证 #

重新调用DescribeKeyValueStore等API，确认错误消失，返回正常响应。

内容的提问来源于stack exchange，提问作者kjw0188