The issue lies within how boto3 handles different aws regions. This may be unique to usage on AWS GovCloud. Originally I did not have a region configured for S3, but according to the docs an optional environment variable named
AWS_S3_REGION_NAME can be set.
AWS_S3_REGION_NAME (optional: default is None) Name of the AWS S3 region to use (eg. eu-west-1)
I reached this conclusion thanks to a stackoverflow answer I was using to try to manually connect to s3 via boto3. I noticed that they included an argument for
region_name when creating the session, which alerted me to make sure I had appropriately set the region in my app.settings and environment variables.
If anyone has some background on why this needs to be set for GovCloud functionality but apparently not for commercial, I would be interested to know.
I also had to specify the
AWS_S3_SIGNATURE_VERSION in app.settings so boto3 knew to use version 4 of the signature. According to the docs
As of boto3 version 1.13.21 the default signature version used for generating presigned urls is still v2. To be able to access your s3 objects in all regions through presigned urls, explicitly set this to s3v4. Set this to use an alternate version such as s3. Note that only certain regions support the legacy s3 (also known as v2) version.
Apparently GovCloud is in this group of newly deployed regions.
If you do not specify this calls to the s3 bucket for static files, such as js scripts, during operation of the web application will receiving a 400 response. S3 responds with the error message
<Code>InvalidRequest</Code> <Message>The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256.</Message> <RequestId>#########</RequestId> <HostId>##########</HostId> </Error>```
There are a couple of things in the configuration that don't look correct but should not cause the problem you are seeing. For instance, VPC Gateway Endpoints (S3) do not have Security Groups. Also, you have inbound rules in your security groups for S3 and RDS. These can be eliminated. The VPC Interface Endpoint for RDS is for the service calls (443) not database queries (5432). At this point, I think I would resort to a process of elimination, starting with the ESC SG rules.
Django App in ECS Container Cannot Connect to S3 in Gov CloudAccepted Answerasked 4 months ago
How to have ECS map ports automatically when a task is deployed in EC2?asked 2 years ago
ECS Container not recognizing EC2 instances after updating AMIasked 4 years ago
From docker container need to connect RDS - Using Session Managerasked a month ago
ECS Container and Dockerasked 9 months ago
Processes in ECS container go to sleep modeasked 3 months ago
docker container in EC2 cannot connect to elasticCacheasked 16 days ago
Running multiple container using single EC2 instances in ECSasked 2 months ago
How can we increase the speed of the container running in AWS ECS ?asked 6 months ago
Deploy on ECS Fargate Container from on-premiseasked 2 months ago