amazon-s3 - 如何在 boto3 S3 客户端配置中指定 FIPS 端点 url？

Question

我目前正在尝试将我的 boto3 客户端配置为使用 FIPS 的自定义端点 URL 进行连接。 https://aws.amazon.com/compliance/fips/

---

我有以下代码适用于 EC2 的 boto3。

ec2_client.py

import boto3
from botocore.config import Config

config = Config(
    retries = dict(
        max_attempts = 1
    )
)

boto3.set_stream_logger(name='botocore')

ec2_client = boto3.client(
    service_name='ec2',
    endpoint_url='https://ec2-fips.us-east-1.amazonaws.com',
    config=config
)
ec2_client.describe_regions()

输出:

$ python ec2_client.py
2019-08-22 17:35:55,183 botocore.hooks [DEBUG] Changing event name from creating-client-class.iot-data to creating-client-class.iot-data-plane
2019-08-22 17:35:55,187 botocore.hooks [DEBUG] Changing event name from before-call.apigateway to before-call.api-gateway
2019-08-22 17:35:55,187 botocore.hooks [DEBUG] Changing event name from request-created.machinelearning.Predict to request-created.machine-learning.Predict
2019-08-22 17:35:55,189 botocore.hooks [DEBUG] Changing event name from before-parameter-build.autoscaling.CreateLaunchConfiguration to before-parameter-build.auto-scaling.CreateLaunchConfiguration
2019-08-22 17:35:55,190 botocore.hooks [DEBUG] Changing event name from before-parameter-build.route53 to before-parameter-build.route-53
2019-08-22 17:35:55,190 botocore.hooks [DEBUG] Changing event name from request-created.cloudsearchdomain.Search to request-created.cloudsearch-domain.Search
2019-08-22 17:35:55,191 botocore.hooks [DEBUG] Changing event name from docs.*.autoscaling.CreateLaunchConfiguration.complete-section to docs.*.auto-scaling.CreateLaunchConfiguration.complete-section
2019-08-22 17:35:55,193 botocore.hooks [DEBUG] Changing event name from before-parameter-build.logs.CreateExportTask to before-parameter-build.cloudwatch-logs.CreateExportTask
2019-08-22 17:35:55,193 botocore.hooks [DEBUG] Changing event name from docs.*.logs.CreateExportTask.complete-section to docs.*.cloudwatch-logs.CreateExportTask.complete-section
2019-08-22 17:35:55,194 botocore.hooks [DEBUG] Changing event name from before-parameter-build.cloudsearchdomain.Search to before-parameter-build.cloudsearch-domain.Search
2019-08-22 17:35:55,194 botocore.hooks [DEBUG] Changing event name from docs.*.cloudsearchdomain.Search.complete-section to docs.*.cloudsearch-domain.Search.complete-section
2019-08-22 17:35:55,218 botocore.credentials [DEBUG] Looking for credentials via: env
2019-08-22 17:35:55,219 botocore.credentials [DEBUG] Looking for credentials via: assume-role
2019-08-22 17:35:55,219 botocore.credentials [DEBUG] Looking for credentials via: shared-credentials-file
2019-08-22 17:35:55,220 botocore.credentials [INFO] Found credentials in shared credentials file: ~/.aws/credentials
2019-08-22 17:35:55,220 botocore.loaders [DEBUG] Loading JSON file: /Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/data/endpoints.json
2019-08-22 17:35:55,226 botocore.hooks [DEBUG] Event choose-service-name: calling handler <function handle_service_name_alias at 0x1056ae488>
2019-08-22 17:35:55,244 botocore.loaders [DEBUG] Loading JSON file: /Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/data/ec2/2016-11-15/service-2.json
2019-08-22 17:35:55,275 botocore.hooks [DEBUG] Event creating-client-class.ec2: calling handler <function add_generate_presigned_url at 0x10577de18>
2019-08-22 17:35:55,275 botocore.args [DEBUG] The s3 config key is not a dictionary type, ignoring its value of: None
2019-08-22 17:35:55,280 botocore.endpoint [DEBUG] Setting ec2 timeout as (60, 60)
2019-08-22 17:35:55,281 botocore.loaders [DEBUG] Loading JSON file: /Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/data/_retry.json
2019-08-22 17:35:55,282 botocore.client [DEBUG] Registering retry handlers for service: ec2
2019-08-22 17:35:55,283 botocore.hooks [DEBUG] Event before-parameter-build.ec2.DescribeRegions: calling handler <bound method ParameterAlias.alias_parameter_in_call of <botocore.handlers.ParameterAlias object at 0x1057e6438>>
2019-08-22 17:35:55,283 botocore.hooks [DEBUG] Event before-parameter-build.ec2.DescribeRegions: calling handler <function generate_idempotent_uuid at 0x1057deea0>
2019-08-22 17:35:55,283 botocore.hooks [DEBUG] Event before-call.ec2.DescribeRegions: calling handler <function inject_api_version_header_if_needed at 0x1057e29d8>
2019-08-22 17:35:55,283 botocore.endpoint [DEBUG] Making request for OperationModel(name=DescribeRegions) with params: {'url_path': '/', 'query_string': '', 'method': 'POST', 'headers': {'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': 'Boto3/1.9.6 Python/3.6.3 Darwin/18.7.0 Botocore/1.12.146'}, 'body': {'Action': 'DescribeRegions', 'Version': '2016-11-15'}, 'url': 'https://ec2-fips.us-east-1.amazonaws.com/', 'context': {'client_region': 'us-east-1', 'client_config': <botocore.config.Config object at 0x106d3a4a8>, 'has_streaming_input': False, 'auth_type': None}}
2019-08-22 17:35:55,283 botocore.hooks [DEBUG] Event request-created.ec2.DescribeRegions: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x106d3a438>>
2019-08-22 17:35:55,284 botocore.hooks [DEBUG] Event choose-signer.ec2.DescribeRegions: calling handler <function set_operation_specific_signer at 0x1057ded90>
2019-08-22 17:35:55,284 botocore.auth [DEBUG] Calculating signature using v4 auth.
2019-08-22 17:35:55,285 botocore.auth [DEBUG] CanonicalRequest:
POST
/

content-type:application/x-www-form-urlencoded; charset=utf-8
host:ec2-fips.us-east-1.amazonaws.com
x-amz-date:20190822T213555Z
x-amz-security-token:__xxx__

content-type;host;x-amz-date;x-amz-security-token
__xxx__
2019-08-22 17:35:55,285 botocore.auth [DEBUG] StringToSign:
AWS4-HMAC-SHA256
20190822T213555Z
20190822/us-east-1/ec2/aws4_request
791b3e04eac140d25ccb2c00d0d2489c3bab1cccf619bfa5df7a8d22a5826d7f
2019-08-22 17:35:55,285 botocore.auth [DEBUG] Signature:
__xxx__
2019-08-22 17:35:55,285 botocore.endpoint [DEBUG] Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://ec2-fips.us-east-1.amazonaws.com/, headers={'Content-Type': b'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': b'Boto3/1.9.6 Python/3.6.3 Darwin/18.7.0 Botocore/1.12.146', 'X-Amz-Date': b'20190822T213555Z', 'X-Amz-Security-Token': b'__xxx__', 'Authorization': b'AWS4-HMAC-SHA256 Credential=__xxx__/20190822/us-east-1/ec2/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token, Signature=__xxx__', 'Content-Length': '41'}>
2019-08-22 17:35:55,495 botocore.parsers [DEBUG] Response headers: {'Content-Type': 'text/xml;charset=UTF-8', 'Content-Length': '3655', 'vary': 'accept-encoding', 'Date': 'Thu, 22 Aug 2019 21:35:55 GMT', 'Server': 'AmazonEC2'}
2019-08-22 17:35:55,495 botocore.parsers [DEBUG] Response body:
b'<?xml version="1.0" encoding="UTF-8"?>\n<DescribeRegionsResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/">\n    <requestId>1cf5ab2e-a72b-4cb7-bd77-1c9dbe1d89c1</requestId>\n    <regionInfo>\n        <item>\n            <regionName>eu-north-1</regionName>\n            <regionEndpoint>ec2.eu-north-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>ap-south-1</regionName>\n            <regionEndpoint>ec2.ap-south-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>eu-west-3</regionName>\n            <regionEndpoint>ec2.eu-west-3.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>eu-west-2</regionName>\n            <regionEndpoint>ec2.eu-west-2.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>eu-west-1</regionName>\n            <regionEndpoint>ec2.eu-west-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>ap-northeast-2</regionName>\n            <regionEndpoint>ec2.ap-northeast-2.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>ap-northeast-1</regionName>\n            <regionEndpoint>ec2.ap-northeast-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>sa-east-1</regionName>\n            <regionEndpoint>ec2.sa-east-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>ca-central-1</regionName>\n            <regionEndpoint>ec2.ca-central-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>ap-southeast-1</regionName>\n            <regionEndpoint>ec2.ap-southeast-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>ap-southeast-2</regionName>\n            <regionEndpoint>ec2.ap-southeast-2.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>eu-central-1</regionName>\n            <regionEndpoint>ec2.eu-central-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>us-east-1</regionName>\n            <regionEndpoint>ec2.us-east-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>us-east-2</regionName>\n            <regionEndpoint>ec2.us-east-2.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>us-west-1</regionName>\n            <regionEndpoint>ec2.us-west-1.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n        <item>\n            <regionName>us-west-2</regionName>\n            <regionEndpoint>ec2.us-west-2.amazonaws.com</regionEndpoint>\n            <optInStatus>opt-in-not-required</optInStatus>\n        </item>\n    </regionInfo>\n</DescribeRegionsResponse>'
2019-08-22 17:35:55,497 botocore.hooks [DEBUG] Event needs-retry.ec2.DescribeRegions: calling handler <botocore.retryhandler.RetryHandler object at 0x106d3a588>
2019-08-22 17:35:55,497 botocore.retryhandler [DEBUG] No retry needed.

---

我有以下代码不适用于 S3 的 boto3。

s3_client.py

import boto3
from botocore.config import Config

config = Config(
    retries = dict(
        max_attempts = 1
    )
)

boto3.set_stream_logger(name='botocore')

s3_client = boto3.client(
    service_name='s3',
    endpoint_url='https://s3-fips.us-east-1.amazonaws.com',
    config=config
)
s3_client.list_buckets()

输出:https://gist.github.com/brokenthumbs/a2e3f05c877582e92cb4d09cc9f05459

$ python s3_client.py
2019-08-22 17:41:54,834 botocore.hooks [DEBUG] Changing event name from creating-client-class.iot-data to creating-client-class.iot-data-plane
2019-08-22 17:41:54,837 botocore.hooks [DEBUG] Changing event name from before-call.apigateway to before-call.api-gateway
2019-08-22 17:41:54,838 botocore.hooks [DEBUG] Changing event name from request-created.machinelearning.Predict to request-created.machine-learning.Predict
2019-08-22 17:41:54,840 botocore.hooks [DEBUG] Changing event name from before-parameter-build.autoscaling.CreateLaunchConfiguration to before-parameter-build.auto-scaling.CreateLaunchConfiguration
2019-08-22 17:41:54,840 botocore.hooks [DEBUG] Changing event name from before-parameter-build.route53 to before-parameter-build.route-53
2019-08-22 17:41:54,840 botocore.hooks [DEBUG] Changing event name from request-created.cloudsearchdomain.Search to request-created.cloudsearch-domain.Search
2019-08-22 17:41:54,841 botocore.hooks [DEBUG] Changing event name from docs.*.autoscaling.CreateLaunchConfiguration.complete-section to docs.*.auto-scaling.CreateLaunchConfiguration.complete-section
2019-08-22 17:41:54,843 botocore.hooks [DEBUG] Changing event name from before-parameter-build.logs.CreateExportTask to before-parameter-build.cloudwatch-logs.CreateExportTask
2019-08-22 17:41:54,843 botocore.hooks [DEBUG] Changing event name from docs.*.logs.CreateExportTask.complete-section to docs.*.cloudwatch-logs.CreateExportTask.complete-section
2019-08-22 17:41:54,843 botocore.hooks [DEBUG] Changing event name from before-parameter-build.cloudsearchdomain.Search to before-parameter-build.cloudsearch-domain.Search
2019-08-22 17:41:54,843 botocore.hooks [DEBUG] Changing event name from docs.*.cloudsearchdomain.Search.complete-section to docs.*.cloudsearch-domain.Search.complete-section
2019-08-22 17:41:54,864 botocore.credentials [DEBUG] Looking for credentials via: env
2019-08-22 17:41:54,865 botocore.credentials [DEBUG] Looking for credentials via: assume-role
2019-08-22 17:41:54,865 botocore.credentials [DEBUG] Looking for credentials via: shared-credentials-file
2019-08-22 17:41:54,866 botocore.credentials [INFO] Found credentials in shared credentials file: ~/.aws/credentials
2019-08-22 17:41:54,867 botocore.loaders [DEBUG] Loading JSON file: /Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/data/endpoints.json
2019-08-22 17:41:54,872 botocore.hooks [DEBUG] Event choose-service-name: calling handler <function handle_service_name_alias at 0x10a268510>
2019-08-22 17:41:54,881 botocore.loaders [DEBUG] Loading JSON file: /Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/data/s3/2006-03-01/service-2.json
2019-08-22 17:41:54,891 botocore.hooks [DEBUG] Event creating-client-class.s3: calling handler <function add_generate_presigned_post at 0x10a33b158>
2019-08-22 17:41:54,891 botocore.hooks [DEBUG] Event creating-client-class.s3: calling handler <function lazy_call.<locals>._handler at 0x10a4020d0>
2019-08-22 17:41:54,909 botocore.hooks [DEBUG] Event creating-client-class.s3: calling handler <function add_generate_presigned_url at 0x10a335ea0>
2019-08-22 17:41:54,909 botocore.args [DEBUG] The s3 config key is not a dictionary type, ignoring its value of: None
2019-08-22 17:41:54,913 botocore.endpoint [DEBUG] Setting s3 timeout as (60, 60)
2019-08-22 17:41:54,915 botocore.loaders [DEBUG] Loading JSON file: /Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/data/_retry.json
2019-08-22 17:41:54,916 botocore.client [DEBUG] Registering retry handlers for service: s3
2019-08-22 17:41:54,917 botocore.client [DEBUG] Using S3 path style addressing.
2019-08-22 17:41:54,918 botocore.hooks [DEBUG] Event before-parameter-build.s3.ListBuckets: calling handler <function validate_bucket_name at 0x10a39a378>
2019-08-22 17:41:54,918 botocore.hooks [DEBUG] Event before-parameter-build.s3.ListBuckets: calling handler <bound method S3RegionRedirector.redirect_from_cache of <botocore.utils.S3RegionRedirector object at 0x10b1b6390>>
2019-08-22 17:41:54,918 botocore.hooks [DEBUG] Event before-parameter-build.s3.ListBuckets: calling handler <function generate_idempotent_uuid at 0x10a397f28>
2019-08-22 17:41:54,919 botocore.hooks [DEBUG] Event before-call.s3.ListBuckets: calling handler <function add_expect_header at 0x10a39a840>
2019-08-22 17:41:54,919 botocore.hooks [DEBUG] Event before-call.s3.ListBuckets: calling handler <bound method S3RegionRedirector.set_request_url of <botocore.utils.S3RegionRedirector object at 0x10b1b6390>>
2019-08-22 17:41:54,919 botocore.hooks [DEBUG] Event before-call.s3.ListBuckets: calling handler <function inject_api_version_header_if_needed at 0x10a39ba60>
2019-08-22 17:41:54,919 botocore.endpoint [DEBUG] Making request for OperationModel(name=ListBuckets) with params: {'url_path': '/', 'query_string': '', 'method': 'GET', 'headers': {'User-Agent': 'Boto3/1.9.6 Python/3.6.3 Darwin/18.7.0 Botocore/1.12.146'}, 'body': b'', 'url': 'https://s3-fips.us-east-1.amazonaws.com/', 'context': {'client_region': 'us-east-1', 'client_config': <botocore.config.Config object at 0x10b0b19e8>, 'has_streaming_input': False, 'auth_type': None, 'signing': {'bucket': None}}}
2019-08-22 17:41:54,919 botocore.hooks [DEBUG] Event request-created.s3.ListBuckets: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x10b0b14e0>>
2019-08-22 17:41:54,919 botocore.hooks [DEBUG] Event choose-signer.s3.ListBuckets: calling handler <bound method ClientCreator._default_s3_presign_to_sigv2 of <botocore.client.ClientCreator object at 0x109e0c550>>
2019-08-22 17:41:54,919 botocore.hooks [DEBUG] Event choose-signer.s3.ListBuckets: calling handler <function set_operation_specific_signer at 0x10a397e18>
2019-08-22 17:41:54,920 botocore.auth [DEBUG] Calculating signature using v4 auth.
2019-08-22 17:41:54,920 botocore.auth [DEBUG] CanonicalRequest:
GET
/

host:s3-fips.us-east-1.amazonaws.com
x-amz-content-sha256:__xxx__
x-amz-date:20190822T214154Z
x-amz-security-token:__xxx__

host;x-amz-content-sha256;x-amz-date;x-amz-security-token
__xxx__
2019-08-22 17:41:54,935 botocore.auth [DEBUG] StringToSign:
AWS4-HMAC-SHA256
20190822T214154Z
20190822/us-east-1/s3/aws4_request
__xxx__
2019-08-22 17:41:54,935 botocore.auth [DEBUG] Signature:
__xxx__
2019-08-22 17:41:54,936 botocore.endpoint [DEBUG] Sending http request: <AWSPreparedRequest stream_output=False, method=GET, url=https://s3-fips.us-east-1.amazonaws.com/, headers={'User-Agent': b'Boto3/1.9.6 Python/3.6.3 Darwin/18.7.0 Botocore/1.12.146', 'X-Amz-Date': b'20190822T214154Z', 'X-Amz-Security-Token': b'__xxx__', 'X-Amz-Content-SHA256': b'__xxx__', 'Authorization': b'AWS4-HMAC-SHA256 Credential=ASIAX6MMDPJ5HINHNPVO/20190822/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token, Signature=__xxx__'}>
2019-08-22 17:41:54,944 botocore.endpoint [DEBUG] Exception received when sending HTTP request.
Traceback (most recent call last):
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/connection.py", line 141, in _new_conn
    (self.host, self.port), self.timeout, **extra_kw)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/util/connection.py", line 60, in create_connection
    for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM):
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/socket.py", line 745, in getaddrinfo
    for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
socket.gaierror: [Errno 8] nodename nor servname provided, or not known

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/httpsession.py", line 258, in send
    decode_content=False,
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/connectionpool.py", line 639, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/util/retry.py", line 333, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/packages/six.py", line 686, in reraise
    raise value
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/connectionpool.py", line 601, in urlopen
    chunked=chunked)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/connectionpool.py", line 346, in _make_request
    self._validate_conn(conn)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn
    conn.connect()
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/connection.py", line 284, in connect
    conn = self._new_conn()
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/urllib3/connection.py", line 150, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
urllib3.exceptions.NewConnectionError: <botocore.awsrequest.AWSHTTPSConnection object at 0x10b1b6ba8>: Failed to establish a new connection: [Errno 8] nodename nor servname provided, or not known

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "test.py", line 17, in <module>
    s3_client.list_buckets()
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/client.py", line 648, in _make_api_call
    operation_model, request_dict, request_context)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/client.py", line 667, in _make_request
    return self._endpoint.make_request(operation_model, request_dict)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/endpoint.py", line 102, in make_request
    return self._send_request(request_dict, operation_model)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/endpoint.py", line 137, in _send_request
    success_response, exception):
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/endpoint.py", line 231, in _needs_retry
    caught_exception=caught_exception, request_dict=request_dict)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/hooks.py", line 356, in emit
    return self._emitter.emit(aliased_event_name, **kwargs)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/hooks.py", line 228, in emit
    return self._emit(event_name, kwargs)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/hooks.py", line 211, in _emit
    response = handler(**kwargs)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/retryhandler.py", line 183, in __call__
    if self._checker(attempts, response, caught_exception):
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/retryhandler.py", line 251, in __call__
    caught_exception)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/retryhandler.py", line 277, in _should_retry
    return self._checker(attempt_number, response, caught_exception)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/retryhandler.py", line 317, in __call__
    caught_exception)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/retryhandler.py", line 223, in __call__
    attempt_number, caught_exception)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/retryhandler.py", line 359, in _check_caught_exception
    raise caught_exception
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/endpoint.py", line 200, in _do_get_response
    http_response = self._send(request)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/endpoint.py", line 244, in _send
    return self.http_session.send(request)
  File "/Users/meme/.pyenv/versions/3.6.3/lib/python3.6/site-packages/botocore/httpsession.py", line 278, in send
    raise EndpointConnectionError(endpoint_url=request.url, error=e)
botocore.exceptions.EndpointConnectionError: Could not connect to the endpoint URL: "https://s3-fips.us-east-1.amazonaws.com/"

---

为了让 boto3 s3 客户端连接到 FIPS 端点，我需要做些什么不同的事情？我看到文档指出:

Note: These Endpoints can only be used with Virtual Hosted-Style addressing. For example: https://bucket.s3-fips.us-east-2.amazonaws.com. Visit the Amazon S3 Documentation page for more information.

我不确定如何将其应用于我的 boto3 s3 客户端配置。关于如何更正我的配置以便为 s3 正确使用 FIPS 有什么想法吗？

Answer 1

这是我发现的可以解决您的问题的方法。

修改您的 Config 对象:

config = Config(
    retries = {'max_attempts': 1},
    s3 = {'addressing_style': 'virtual'}
)