S3 PUT request spike in the other region

Question

Hello,
I am in Hyderabad, India (ap-south-2). I am building an application (web UI and mobile UI) that will be served exclusively in India from the ap-south-2 region.

I have S3 buckets specific to the ap-south-2 region, and I have enabled the S3 policy restrictions to other regions (please see below). But, in the bill, in the S3 PUT request against us-east-1, there is a significant increase daily (please see attached images). I have deleted S3 buckets, and still there is a spike around (90+) per day PUT requests in us-east-1.

My application interacts with S3 to store images and PDFs, and I expect to be in at least 100K images and PDFs/month.

My environment – 
Number of developers – 1 (that’s me). There is no one else who knows the credentials or access keys.
In the application (APIs), I have hard-coded my region as “ap-south-2”

Appreciate your response.
Thank you.

************************
S3 Policy
************************
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::s3-bw-exp-receipts",
                "arn:aws:s3:::s3-bw-exp-receipts/*",
                "arn:aws:s3:::s3-bw-advts",
                "arn:aws:s3:::s3-bw-advts/*",
                "arn:aws:s3:::s3-bw-users",
                "arn:aws:s3:::s3-bw-users/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::s3-bw-exp-receipts",
                "arn:aws:s3:::s3-bw-exp-receipts/*",
                "arn:aws:s3:::s3-bw-advts",
                "arn:aws:s3:::s3-bw-advts/*",
                "arn:aws:s3:::s3-bw-users",
                "arn:aws:s3:::s3-bw-users/*"
            ]
        },
        {
            "Sid": "AllowS3AccessInSpecificRegion",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::s3-country-flags",
                "arn:aws:s3:::s3-country-flags/*",
                "arn:aws:s3:::s3-bw-exp-receipts",
                "arn:aws:s3:::s3-bw-exp-receipts/*",
                "arn:aws:s3:::s3-bw-advts",
                "arn:aws:s3:::s3-bw-advts/*",
                "arn:aws:s3:::s3-bw-users",
                "arn:aws:s3:::s3-bw-users/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": [
                        "ap-south-1",
                        "ap-south-2"
                    ]
                }
            }
        },
        {
            "Sid": "DenyS3AccessOutsideSpecificRegion",
            "Effect": "Deny",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::s3-country-flags",
                "arn:aws:s3:::s3-country-flags/*",
                "arn:aws:s3:::s3-bw-exp-receipts",
                "arn:aws:s3:::s3-bw-exp-receipts/*",
                "arn:aws:s3:::s3-bw-advts",
                "arn:aws:s3:::s3-bw-advts/*",
                "arn:aws:s3:::s3-bw-users",
                "arn:aws:s3:::s3-bw-users/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "ap-south-1",
                        "ap-south-2"
                    ]
                }
            }
        }
    ]
}

*********************
Asia Pacific (Hyderabad)

Amazon Simple Storage Service APS5-Requests-Tier1
$0.005 per 1,000 PUT, COPY, POST, or LIST requests
167 Requests

Amazon Simple Storage Service APS5-Requests-Tier2
$0.004 per 10,000 GET and all other requests
364 Requests

Amazon Simple Storage Service APS5-Tables-Requests-Tier1
$0.005 per 1,000 PUT Requests/COPY/POST or LIST Requests to S3 Table Buckets
1 Requests

Amazon Simple Storage Service APS5-TimedStorage-ByteHrs
$0.025 per GB-Mo for TimedStorage-ByteHrs in Asia Pacific (Hyderabad)
0 GB-Mo

Amazon Simple Storage Service GetAG
$0.03 per 1,000 GetAG requests for S3 Access Grants
1 Requests

EU (Stockholm)
USD 0.00

US East (N. Virginia)

Amazon Simple Storage Service Requests-Tier1
$0.005 per 1,000 PUT, COPY, POST, or LIST requests
1,912 Requests

Amazon Simple Storage Service Requests-Tier2
$0.004 per 10,000 GET and all other requests
11 Requests

Shahed Kazi (@shajam) · Answer

The S3 policy that you shared, is that S3 bucket policy, IAM policy or SCP policy? I suspect it is either S3 bucket or IAM policy and therefore it only applies to the specific bucket or IAM role. In your S3 console, check if you have S3 buckets in us-east-1 region. Check if you have other services like Config, SecurityHub, CloudTrail, etc that are writing to a bucket in us-east-1 region.

EXPERT

Shahed Kazi (@shajam)

answered 9 months ago

re:Post Agent · Answer

The S3 PUT requests in us-east-1 despite your regional restrictions could be occurring for several reasons:

1. **Default Region Behavior**: When no region is explicitly specified in an API call, AWS often defaults to us-east-1. Check if any part of your application code is missing the region specification.

2. **AWS Services Integration**: Some AWS services automatically create or interact with S3 buckets in us-east-1 regardless of your application's primary region. These could be generating the PUT requests you're seeing.

3. **IAM Policy Scope**: Your IAM policy has region restrictions for specific buckets, but it doesn't restrict creating new buckets or interacting with other buckets in different regions. The "ListAllMyBuckets" and "GetBucketLocation" permissions apply to all resources (*) without region restrictions.

4. **SDK Configuration**: If you're using AWS SDKs, check that all client configurations explicitly set the region to ap-south-2.

To address this issue:

1. Use AWS CloudTrail to identify the specific API calls being made to us-east-1 and their sources.

2. Consider using a more restrictive IAM policy that denies all S3 actions in regions other than ap-south-1 and ap-south-2, not just for specific buckets.

3. If you need to optimize for geographic performance, consider using Amazon S3 Transfer Acceleration which uses AWS edge locations to accelerate data transfers, or Multi-Region Access Points if you need to access data across multiple regions.

4. Review all application code and configurations to ensure the region is consistently set to ap-south-2.  
**Sources**  
[Managing multi-Region traffic with Multi-Region Access Points - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html)  
[Using Amazon S3 Transfer Acceleration to Accelerate Geographically Disparate Data Transfers - Best Practices Design Patterns: Optimizing Amazon S3 Performance](https://docs.aws.amazon.com/whitepapers/latest/s3-optimizing-performance-best-practices/using-amazon-s3-transfer-acceleration-to-accelerate-geographically-disparate-data-transfers.html)

S3 PUT request spike in the other region

Add your answer

Relevant content