python - boto3是否支持到S3的VPC端点连接

Question

我们有一个通过VPC终端节点连接到Amazon S3的Python客户端。我们的代码使用boto，我们能够从S3连接和下载。

从boto迁移到boto3后，我们注意到VPC端点连接不再起作用。下面是可以重现该问题的复制片段。

python -c "import boto3;s3 = boto3.resource('s3',aws_access_key_id='foo',aws_secret_access_key='bar');s3.Bucket('some-bucket').download_file('hello-remote.txt', 'hello-local.txt')"

得到以下错误:

Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "C:\Python27\lib\site-packages\boto3-1.4.0-py2.7.egg\boto3\s3\inject.py",
line 163, in bucket_download_file
    ExtraArgs=ExtraArgs, Callback=Callback, Config=Config)
  File "C:\Python27\lib\site-packages\boto3-1.4.0-py2.7.egg\boto3\s3\inject.py",
line 125, in download_file
    extra_args=ExtraArgs, callback=Callback)
  File "C:\Python27\lib\site-packages\boto3-1.4.0-py2.7.egg\boto3\s3\transfer.py
", line 269, in download_file
    future.result()
  File "build\bdist.win32\egg\s3transfer\futures.py", line 73, in result
  File "build\bdist.win32\egg\s3transfer\futures.py", line 233, in result
botocore.vendored.requests.exceptions.ConnectionError: ('Connection aborted.', e
rror(10060, 'A connection attempt failed because the connected party did not pro
perly respond after a period of time, or established connection failed because c
onnected host has failed to respond'))

有谁知道boto3是否支持通过VPC端点与S3的连接和/或能够使其工作？我们正在使用boto3-1.4.0。

Answer 1

这很可能是您的VPC端点策略中的配置错误。如果您的策略正确，则Boto3永远不会确切知道它如何到达S3位置，这取决于策略是否允许/禁止此类流量。
这是您可以进行故障排除的快速指南:https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/
其他相关文档:

https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html#vpc-endpoint-policies

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html#vpc-endpoints-policies-s3