使用预签名URL访问me-central-1区域S3桶时触发IllegalLocationConstraintException错误
问题
在使用预签名URL访问S3对象时遇到错误:
'IllegalLocationConstraintException' 'The me-central-1 location constraint is incompatible for the region specific endpoint this request was sent to'
已在me-central-1区域创建存储桶,文件上传成功,但通过预签名URL访问时抛出上述错误;而ap-south-1区域的存储桶使用预签名URL访问完全正常。确认端点应为https://s3.me-central-1.amazonaws.com,仍无法定位中东区域存储桶出现位置错误的原因。
以下是Python代码:
def save_to_s3_bucket(file, file_name): try: import base64,json import requests from io import BytesIO from botocore.exceptions import ClientError from botocore.config import Config format, imgstr = file.split(';base64,') s3 = boto3.client('s3', aws_access_key_id=settings.AWS_ACCESS_KEY_ID, aws_secret_access_key=settings.AWS_SECRET_ACCESS_KEY, config=Config(signature_version='s3v4'), region_name=settings.AWS_DEFAULT_REGION) random_path = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(10)) s3.put_object(Bucket=settings.AWS_STORAGE_BUCKET_NAME, Key='pvt/doc/ln-app/'+random_path+'/'+file_name, Body=base64.b64decode(imgstr), StorageClass='REDUCED_REDUNDANCY') img_url = settings.AWS_BUCKET_URL+'pvt/doc/ln-app/'+random_path+'/'+file_name url = s3.generate_presigned_url('get_object', Params = {'Bucket': settings.AWS_STORAGE_BUCKET_NAME, 'Key': 'pvt/doc/ln-app/'+random_path+'/'+file_name}, ExpiresIn = 10000) print('AWS-S3-URL--->>>>>>>>>', url) res = { 'hasError': False, 'message': 'Success', 'response': { 'key': 'pvt/doc/ln-app/'+random_path+'/'+file_name, 'file_url': url } } return res except Exception as e: res = { 'hasError': True, 'message': str(e), 'response': None } return res
解决方案
- 显式指定区域端点:对于
me-central-1这类较新的区域,boto3需要显式指定endpoint_url才能生成匹配区域的预签名URL。修改S3客户端初始化代码,添加该参数:
s3 = boto3.client('s3', aws_access_key_id=settings.AWS_ACCESS_KEY_ID, aws_secret_access_key=settings.AWS_SECRET_ACCESS_KEY, config=Config(signature_version='s3v4'), region_name=settings.AWS_DEFAULT_REGION, endpoint_url=f"https://s3.{settings.AWS_DEFAULT_REGION}.amazonaws.com")
- 校验区域配置一致性:确认
settings.AWS_DEFAULT_REGION确实设置为me-central-1,避免客户端区域配置与存储桶实际区域不匹配。 - 验证预签名URL端点:生成URL后检查其域名是否为
s3.me-central-1.amazonaws.com,若仍为通用端点s3.amazonaws.com,则说明客户端未正确识别区域,必须强制指定endpoint_url。
内容的提问来源于stack exchange,提问作者Sins97
相关产品推荐
相关产品推荐

