如何在AWS SDK（JavaScript）中使用S3 VPC端点实现上传与下载？

前提确认 #

• 确保你的S3 VPC端点已正确关联到目标VPC的路由表，且端点策略允许你的IAM实体（用户/角色）执行S3的PutObject、GetObject等操作
• 运行代码的EC2实例或其他资源必须位于该VPC内，且安全组允许与S3 VPC端点的443端口通信

配置AWS SDK for JavaScript #

核心是指定S3的endpoint为VPC端点的DNS名称，确保流量走VPC内网而非公共互联网。以下分v3和v2版本说明：

AWS SDK v3 配置 #

import { S3Client, PutObjectCommand, GetObjectCommand } from "@aws-sdk/client-s3";

// 初始化S3客户端
const s3Client = new S3Client({
  region: "你的AWS区域（如us-east-1）",
  // 若VPC端点启用私有DNS，直接用标准S3端点URL；否则替换为VPC端点完整DNS
  endpoint: "https://s3.你的区域.amazonaws.com",
  forcePathStyle: false,
  // 生产环境建议用IAM角色自动获取凭证，避免硬编码
  credentials: {
    accessKeyId: "你的访问密钥ID",
    secretAccessKey: "你的秘密访问密钥"
  },
  useAccelerateEndpoint: false,
  disableMultiregionAccessPoints: true
});

AWS SDK v2 配置 #

const AWS = require('aws-sdk');

// 初始化S3客户端
const s3 = new AWS.S3({
  region: "你的AWS区域（如us-east-1）",
  endpoint: "https://s3.你的区域.amazonaws.com", // 替换为VPC端点DNS（若私有DNS未启用）
  credentials: {
    accessKeyId: "你的访问密钥ID",
    secretAccessKey: "你的秘密访问密钥"
  },
  s3ForcePathStyle: false,
  useAccelerateEndpoint: false
});

文件上传示例 #

SDK v3 上传本地文件 #

import { createReadStream } from "fs";
import { PutObjectCommand } from "@aws-sdk/client-s3";

async function uploadFileToS3(bucketName, key, filePath) {
  const fileStream = createReadStream(filePath);
  
  const command = new PutObjectCommand({
    Bucket: bucketName,
    Key: key,
    Body: fileStream
  });

  try {
    const response = await s3Client.send(command);
    console.log("文件上传成功，响应：", response);
    return response;
  } catch (err) {
    console.error("上传失败：", err);
    throw err;
  }
}

// 调用示例
uploadFileToS3("my-vpc-bucket", "documents/report.pdf", "./local-report.pdf");

SDK v2 上传本地文件 #

const fs = require('fs');

async function uploadFileToS3(bucketName, key, filePath) {
  const fileContent = fs.readFileSync(filePath);
  
  const params = {
    Bucket: bucketName,
    Key: key,
    Body: fileContent
  };

  try {
    const response = await s3.upload(params).promise();
    console.log("文件上传成功，地址：", response.Location);
    return response;
  } catch (err) {
    console.error("上传失败：", err);
    throw err;
  }
}

// 调用示例
uploadFileToS3("my-vpc-bucket", "documents/report.pdf", "./local-report.pdf");

文件下载示例 #

SDK v3 下载到本地文件 #

import { createWriteStream } from "fs";
import { GetObjectCommand } from "@aws-sdk/client-s3";
import { pipeline } from "stream/promises";

async function downloadFileFromS3(bucketName, key, outputPath) {
  const command = new GetObjectCommand({
    Bucket: bucketName,
    Key: key
  });

  try {
    const response = await s3Client.send(command);
    await pipeline(response.Body, createWriteStream(outputPath));
    console.log("文件下载成功");
  } catch (err) {
    console.error("下载失败：", err);
    throw err;
  }
}

// 调用示例
downloadFileFromS3("my-vpc-bucket", "documents/report.pdf", "./downloaded-report.pdf");

SDK v2 下载到本地文件 #

const fs = require('fs');

async function downloadFileFromS3(bucketName, key, outputPath) {
  const params = {
    Bucket: bucketName,
    Key: key
  };

  try {
    const response = await s3.getObject(params).promise();
    fs.writeFileSync(outputPath, response.Body);
    console.log("文件下载成功");
  } catch (err) {
    console.error("下载失败：", err);
    throw err;
  }
}

// 调用示例
downloadFileFromS3("my-vpc-bucket", "documents/report.pdf", "./downloaded-report.pdf");

关键注意事项 #

• 凭证安全：生产环境禁止硬编码凭证，优先使用IAM角色（如EC2实例角色），SDK会自动获取临时凭证
• 端点URL规则：若VPC端点启用私有DNS，直接用标准S3端点URL即可，VPC内DNS会自动解析到内网端点；若私有DNS未启用，需替换为VPC端点的完整DNS名称（格式如vpce-xxxxxx-yyyyyy.s3.us-east-1.vpce.amazonaws.com）
• 权限校验：确认IAM实体拥有s3:PutObject、s3:GetObject等必要权限，同时VPC端点策略允许这些操作

内容的提问来源于stack exchange，提问作者Junie