S3 - The authorization header is malformed; the region 'vpce' is wrong;

[grochoge]

Describe the bug

I'm running into this via the Jenkins artifact-manager-s3-plugin, but it appears to ultimately coming from the Java SDK based on someone reporting the issue in aws-amplify/aws-sdk-android#3018.

Expected Behavior

S3 client works with VPC interface endpoints

Current Behavior

GET https://BUCKETNAME.bucket.vpce-0123456789abcdef0-tiydc1f7.s3.us-east-1.vpce.amazonaws.com/?delimiter=/&prefix=BUCKETPREFIX/ HTTP/1.1 failed with code 400, error: AWSError{requestId='XPPHVG85015KESAZ', requestToken='REDACTED', code='AuthorizationHeaderMalformed', message='The authorization header is malformed; the region 'vpce' is wrong; expecting 'us-east-1'', context='{Region=us-east-1, HostId=REDACTED}'}

Reproduction Steps

I have not tried yet, but I suspect adding the following test to aws-java-sdk-core/src/test/java/com/amazonaws/regions/EndpointToRegionTest.java should reproduce the issue but have yet to try:

    @Test
    public void guessRegionForHostname_returnsRegionFromS3VPCEndpoint() {
        verifyRegionAndPartitionForHostname("us-east-1", "aws", "bucketname.bucket.vpce-0123456789abcdef0-tiydc1f7.s3.us-east-1.vpce.amazonaws.com");
    }

Possible Solution

Fix region parsing

Additional Information/Context

No response

AWS Java SDK version used

1.12.586

JDK version used

OpenJDK Runtime Environment Temurin-17.0.9+9 (build 17.0.9+9)

Operating System and version

Docker image jenkins:lts-jdk17

[debora-ito]

@grochoge thank you for reaching out. You are probably running into the same issue reported here - #2858 (comment)

The SDK 1.x logic that tries to guess the region from an endpoint does not work for vpce endpoints.

Which S3 API are you calling?

[grochoge]

In the case mentioned originally it's listing the bucket. But we'll also need getting/putting objects and creating signed URLs.

[767604]

we will forewed to senior