使用boto3创建AWS Workspace时遇EndpointConnectionError求助

问题重现 #

代码实现：

def awsWorkspaceCreation(event, context):
    client = boto3.client('workspaces')
    response = client.create_workspaces(
        Workspaces=[
            {
                'DirectoryId': 'd-9067b1946c',
                'UserName': 'hhsjhdhtest',
                'BundleId': 'wsb-cys0c7ctl',
                'WorkspaceProperties': {
                    'RunningMode': 'AUTO_STOP'
                }
            },
        ]
    )
    return {"status":"success"}

报错信息：

{
  "errorMessage": "Could not connect to the endpoint URL: \"https://workspaces.us-east-2.amazonaws.com/\"",
  "errorType": "EndpointConnectionError",
  "stackTrace": [
    "  File \"/var/task/handler.py\", line 73, in awsWorkspaceCreation\n    'Value': 'CallCentreProvisioned'\n",
    "  File \"/var/task/botocore/client.py\", line 316, in _api_call\n    return self._make_api_call(operation_name, kwargs)\n",
    "  File \"/var/task/botocore/client.py\", line 622, in _make_api_call\n    operation_model, request_dict, request_context)\n",
    "  File \"/var/task/botocore/client.py\", line 641, in _make_request\n    return self._endpoint.make_request(operation_model, request_dict)\n",
    "  File \"/var/task/botocore/endpoint.py\", line 102, in make_request\n    return self._send_request(request_dict, operation_model)\n",
    "  File \"/var/task/botocore/endpoint.py\", line 137, in _send_request\n    success_response, exception):\n",
    "  File \"/var/task/botocore/endpoint.py\", line 256, in _needs_retry\n    caught_exception=caught_exception, request_dict=request_dict)\n",
    "  File \"/var/task/botocore/hooks.py\", line 356, in emit\n    return self._emitter.emit(aliased_event_name, **kwargs)\n",
    "  File \"/var/task/botocore/hooks.py\", line 228, in emit\n    return self._emit(event_name, kwargs)\n",
    "  File \"/var/task/botocore/hooks.py\", line 211, in _emit\n    response = handler(**kwargs)\n",
    "  File \"/var/task/botocore/retryhandler.py\", line 183, in __call__\n    if self._checker(attempts, response, caught_exception):\n",
    "  File \"/var/task/botocore/retryhandler.py\", line 251, in __call__\n    caught_exception)\n",
    "  File \"/var/task/botocore/retryhandler.py\", line 277, in _should_retry\n    return self._checker(attempt_number, response, caught_exception)\n",
    "  File \"/var/task/botocore/retryhandler.py\", line 317, in __call__\n    caught_exception)\n",
    "  File \"/var/task/botocore/retryhandler.py\", line 223, in __call__\n    attempt_number, caught_exception)\n",
    "  File \"/var/task/botocore/retryhandler.py\", line 359, in _check_caught_exception\n    raise caught_exception\n",
    "  File \"/var/task/botocore/endpoint.py\", line 200, in _do_get_response\n    http_response = self._send(request)\n",
    "  File \"/var/task/botocore/endpoint.py\", line 269, in _send\n    return self.http_session.send(request)\n",
    "  File \"/var/task/botocore/httpsession.py\", line 283, in send\n    raise EndpointConnectionError(endpoint_url=request.url, error=e)\n"
  ]
}

原因分析 #

这个错误核心是代码运行环境无法连接到AWS Workspaces的us-east-2区域端点，常见诱因包括：

• boto3客户端未显式指定区域，导致默认区域与资源所在区域不匹配
• 运行环境（如Lambda）的网络配置限制了对Workspaces公共端点的访问
• 资源（目录、Bundle）所在区域与客户端连接的区域不一致

解决步骤 #

1. 显式指定资源所在区域 #

创建boto3客户端时明确指定你的Directory、Bundle所在的区域（比如us-east-2），避免默认区域不匹配：

def awsWorkspaceCreation(event, context):
    # 显式指定区域
    client = boto3.client('workspaces', region_name='us-east-2')
    response = client.create_workspaces(
        Workspaces=[
            {
                'DirectoryId': 'd-9067b1946c',
                'UserName': 'hhsjhdhtest',
                'BundleId': 'wsb-cys0c7ctl',
                'WorkspaceProperties': {
                    'RunningMode': 'AUTO_STOP'
                }
            },
        ]
    )
    return {"status":"success"}

2. 检查网络访问权限 #

如果代码运行在Lambda中：

• 确认Lambda执行角色拥有workspaces:CreateWorkspaces权限
• 若Lambda配置在VPC内：
  • 确保子网配置了NAT网关，允许出站访问互联网（Workspaces公共端点需要公网访问）
  • 或者创建Workspaces的VPC接口端点（服务名称为com.amazonaws.us-east-2.workspaces），让Lambda通过VPC内部访问服务
  • 检查安全组和网络ACL，允许出站HTTPS（443端口）流量到AWS服务端点

3. 验证资源有效性 #

确认DirectoryId、BundleId在指定区域内真实存在，且UserName是该目录下的合法用户。

内容的提问来源于stack exchange，提问作者Santhosh