使用boto3生成的S3预签名URL公网无法访问问题排查

我用boto3生成S3对象的预签名URL，公网访问一直提示AccessDenied，但通过AWS控制台"Share with a presigned URL"按钮生成的URL能正常下载。

两种URL对比 #

• 控制台生成的URL示例：

https://cool-analysis-artifacts.s3.us-west-2.amazonaws.com/0012d668-13c9-11ee-a2f0-5602f45624de/picture-4079.png?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEOj//////////wEaCXVzLXdlc3QtMSJHMEUCIACEtKpoR%2BlEqdpoHWb1RVrfwBrByTGLYanx24UT1DlLAiEAhvqWPU9rBBjh6oPoFcmhWF8OYummjOd9TvwmBeoS7R0q8AQIYRACGgwwMjE1NDI3NDIxMDAiDCRM66a0CJAH3n63CirNBHBievkO%2BeReu4jS4Pniyusbk%2BkQ2L%2BVXh9kALEvqz65%2B9qAG2vlPMO9Mdl0XkuF%2FqLF3p4UBWf0yE1wDUPaY0Ly0R6J6MNz9y0%2Bdrg6hAOCbjOpsNi7gxzuMr8UlrU3vBCplcx5sGMdUMcXaCBj8%2Bgj2xEa15arGvZvS1xC%2Fb%2BRH5LPropdeep4DHGNlsdryfk0UkTAIsZ9Vaz4DNJSpzaEMWsKcRQ%2FPMOioMi0lQ8Bg12bH3GhW%2FzaXlFUrAvSec3phCKH9jm7jHwPWbkEqmVjHmRUGZVurganr4qYtf3TB1PGNN7SrHnGGDOQn9pnxNlyGFwyuWnTvT%2Frh2wzgarhKncgzn%2F8uNVpZYUZSMzlWcHlXrMZxnxh49J6AisYQv5rlReq8gmRdT75653FioCnKekpp6Fq5jCXCngBxuRHR065ILa9Sxf5URyt5BPabxJelWdIqXI4XGw%2BoVPI9G7QsOIkhuKqBXyuEiCRN%2BZ2CqPV%2F7cJhcqzLPg8ZsYbNoPNtOoE%2F9ID%2FDqe8Oup3ngssF9geZM59CYJZRDX5m2k1tx%2BharW2E7WQO095tOV0uvtq1L%2BFKpiWm3V0cQ8C2ZXUBomwHRWIV%2BjAOf%2FKi7ytNyKTb%2BbsoOR95qmlLYXwmMDozDDqx8zhZ2cWFZdkRDS%2BLLm1%2FOIJiJfoVz4Z18%2BxLqxdt7XzvWKFioJiRXqyY023WVRUxR4fUcTjmB4iQM2asN1bNiyiMyr3JcOVtJSa4GtUDWP98ewPG3oYk6E6bUVeIlC%2BZ3cmj2VM%2BYwyu6gpQY6igKmRY%2F3aRMKO8b9afxOR%2BaZPGgWiZJ063U%2FPt2fBOB2CPFRQVIJB2Gb%2BMghuFAQt066eUU4i6wTU%2BfLYsG4mAj54fDmTNObFvi0ptKM7NS89gJ13BIPXDVSTay%2FFsQnpw%2BF3zlBI1f8u4DpXBqWff9WMv8hn%2FWSiZvS2M69XEfFFM1rzhW1bGf%2B7tXV5jM7upipz3cBjKACWTC%2FfKd3UqEvldi7RbhldUOnApX9LIdmiwuBZYDKXY%2F4ElAHnR7l8Syh3DoyNiu8zakYrT0bZmAbvJCaz3RMgydxCQGODFo8yNvN0LtU1ORN5SWrFWnP%2BvefC3a7XnTZOAu%2Bmun5m15K455af7rLoMT%2FWQ%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20230707T235243Z&X-Amz-SignedHeaders=host&X-Amz-Expires=21600&X-Amz-Credential=ASIAQKBAMFBKM22NSNN2%2F20230707%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=0847be3aa9864b1b1412c6acb3d56c9a38e76559349511b8d2f2ddbfd1c81b77

• boto3生成的URL示例：

https://s3.us-west-2.amazonaws.com/cool-analysis-artifacts/0012d668-13c9-11ee-a2f0-5602f45624de/picture-4079.png?AWSAccessKeyId=ABCIAQKBAMFBKAIRALVWZ&Signature=123opx27AmUmffdnJayOQ7e%2BFpE%3D&Expires=1689378161

我的代码实现 #

s3_client = boto3.client(service_name='s3',
                         region_name='us-west-2',
                         config=botocore.config.Config(s3={'addressing_style': 'path'}),
                         aws_access_key_id='access_key',
                         aws_secret_access_key='secret_key'
                         )
presigned_url = s3_client.generate_presigned_url('get_object', 
                                                 Params={'Bucket':'cool-analysis-artifacts', 
                                                         'Key':'0012d668-13c9-11ee-a2f0-5602f45624de/picture-4079.png'}, 
                                                 ExpiresIn=MAXIMUM_EXPIRATION_IN_SECONDS)

后续排查更新 #

• 执行aws s3api list-objects --bucket cool-analysis-artifacts能正常返回结果，示例数据：

{
            "LastModified": "2023-06-15T18:38:30.000Z",
            "ETag": "\"abc12930ca127ee94938bbc39edf6\"",
            "StorageClass": "STANDARD",
            "Key": "abc-a24a53760417/cool-picture-199.png",
            "Owner": {
                "DisplayName": "cool-name",
                "ID": "abcde"
            },
            "Size": 12908
        }

• 去掉config=参数后，生成的URL依然无法访问，问题未解决。

问题原因及解决方法 #

1. 签名版本不兼容：控制台使用的是V4签名（AWS4-HMAC-SHA256），而你的boto3代码默认生成了V2签名。AWS新区域仅支持V4签名，V2签名会导致权限验证失败，触发AccessDenied。
2. 修复方案：
   • 初始化boto3客户端时，强制指定签名版本为s3v4：

   import boto3
   from botocore.config import Config
   
   s3_client = boto3.client(
       service_name='s3',
       region_name='us-west-2',
       config=Config(signature_version='s3v4'),
       aws_access_key_id='access_key',
       aws_secret_access_key='secret_key'
   )
   

   • 同时可以移除addressing_style: path配置，让boto3自动使用虚拟主机格式（和控制台URL格式一致），避免部分存储桶的路径格式访问限制。

内容的提问来源于stack exchange，提问作者Fisher Coder