AWS S3: 'PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint' (or 301 / 'AuthorizationHeaderMalformed: the region is wrong'). How do I fix the region and endpoint?

Cause: each S3 bucket lives in one AWS Region, and requests must go to that Region's endpoint (and be signed for that Region). When your client uses a different Region (the default region in your profile, us-east-1 in many SDK defaults, or a hard-coded endpoint), S3 answers with PermanentRedirect (HTTP 301) or AuthorizationHeaderMalformed, naming the expected Region in the error body. Bucket names with dots can also break virtual-hosted-style HTTPS requests, because the certificate doesn't match. Fix: 1. Find the bucket's Region: aws s3api get-bucket-location --bucket <name> (null means us-east-1), or check the bucket in the S3 console. 2. Configure the client for that Region: aws s3 ls s3://<name> --region <region>; in boto3 boto3.client('s3', region_name='<region>'); in other SDKs set region on the S3 client. Don't hard-code s3.amazonaws.com as the endpoint for buckets in other Regions. 3. Use the Region-specific virtual-hosted-style URL (https://<bucket>.s3.<region>.amazonaws.com/<key>) for direct HTTP access and presigned URLs; generate presigned URLs with a client configured for the bucket's Region. 4. For bucket names containing dots, either avoid them for new buckets, or use path-style addressing for those requests if your SDK supports it (S3 recommends virtual-hosted style in general). 5. If you go through a VPC endpoint or S3-compatible service, make sure the endpoint URL matches the Region and service you intend. Verify: the same request succeeds with the bucket's Region set, and the error no longer appears. Sources: https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html