AWS SDK V1 behavior with vpc endpoint

Question

I am using AmazonS3Client object to check versioning status of a S3 bucket via VPC endpoint. Below is the code snippet:

```
AmazonS3Client s3Client = new AmazonS3Client(credentialsProvider);
s3Client.setSignerRegionOverride(region);
s3Client.setEndpoint(endPoint);
BucketVersioningConfiguration bvc = s3Client.getBucketVersioningConfiguration(S3Bucket);
```
Here, region is `eu-west-1` and endpoint is `bucket.vpce-abc-eu-west-1b.s3.eu-west-1.vpce.amazonaws.com`. Endpoint is VPC endpoint (format is different than standard S3 endpoint).
AWS SDK version is 1.12.317.

Even though I am explicitly setting signer region to `eu-west-1`, the request is failing with error `400 AuthorizationHeaderMalformed` with error message `The authorization header is malformed; the region 'vpce' is wrong; expecting 'eu-west-1'`.

For above request, host and authorization header is as below:
```
Host: S3Bucket.bucket.vpce-abc-eu-west-1b.s3.eu-west-1.vpce.amazonaws.com
Authorization: AWS4-HMAC-SHA256 Credential=access-key/20250515/vpce/s3/aws4_request, SignedHeaders=amz-sdk-invocation-id;amz-sdk-request;amz-sdk-retry;content-type;host;user-agent;x-amz-content-sha256;x-amz-date,Signature=signature"
```
I believe the issue is aws sdk is picking incorrect region `'vpce'` for authorization from endpoint `bucket.vpce-abc-eu-west-1b.s3.eu-west-1.vpce.amazonaws.com` and ignoring `setSignerRegionOverride as eu-west-1`.

I am unable to understand why it is taking `'vpce'` as region even though it should be ` 'eu-west-1'`. Can some one explain why it is ignoring `setSignerRegionOverride` and how can I fix it ?

re:Post Agent · Answer

There may be several reasons why this error occurs. These reasons include, but are not limited to, the following:

- If you are doing an operation on your S3 bucket and you have set the Region variable to a region other than the one in which the bucket is actually present.

- The AWS SDK for Java 1.x has entered maintenance mode as of July 31, 2024, and will reach end-of-support on December 31, 2025:

[+] https://aws.amazon.com/blogs/developer/announcing-end-of-support-for-aws-sdk-for-java-v1-x-on-december-31-2025/

Additionally, you can check below GitHub Pages for further details on such reported issue and possible workarounds:

[+] https://github.com/aws/aws-sdk-java/issues/3069

[+] https://github.com/aws/aws-sdk-java/issues/3017

To resolve this issue, you can check below options/alternatives:

1. Kindly verify the AWS region being used in the application and S3 bucket region. You can make use of the [setRegion](https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/s3/AmazonS3Client.html#setRegion-com.amazonaws.regions.Region-) method, which takes precedence over all other options:

```
   s3Client.setRegion(Region.getRegion(Regions.EU_WEST_1));
 ```

2. If possible, upgrade to a newer version of the AWS SDK for Java. Later versions may have improved handling of VPC endpoints.

Remember to ensure that your IAM policies and VPC endpoint policies are correctly configured to allow access to the S3 bucket through the VPC endpoint.

If these solutions don't resolve the issue, you may want to consider opening a support case with AWS using the following [link](https://support.console.aws.amazon.com/support/home#/case/create) or reporting the issue to the AWS SDK for [Java GitHub](https://github.com/aws/aws-sdk-java/issues) repository for further assistance.

**Sources**  
[AWS Region Selection](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/java-dg-region-selection.html)

AWS SDK V1 behavior with vpc endpoint

Add your answer

Relevant content