Amazon S3 backup fails with account regional namespace buckets #8241

Since March 2026, when you create a bucket in the AWS console, the suggested option is the "Account Regional namespace". The bucket name in this namespace ends with -<account-id>-<region>-an. Outside the us-east-1 region, these buckets can be reached only through the regional endpoint (s3.<region>.amazonaws.com), not through the global one (s3.amazonaws.com). See Namespaces for general purpose buckets.

The "Amazon S3" backup destination always uses the global endpoint, even though the form asks for the region. As a result, the destination cannot be added and the error suggests a permission problem, even though the credentials are correct.

In addition, adding the destination fails if the access key belongs to a user that is not allowed to create buckets, even when the bucket already exists. Such a "least privilege" user is a common and recommended setup. The S3 settings of some other providers already handle this case (Synology, IDrive).

Troubleshooting these failures is hard: the error messages printed by rclone, the tool used to check the destination, are lost. They do not appear in the task log, in the system logs, or on the terminal when rclone is run by hand with podman exec rclone-gateway rclone .... Only a generic error code is recorded.

The write check is also weak: it creates and removes a test directory, but on object storage such as S3 directories do not really exist, so this check may succeed without writing anything. With the bucket check disabled (see below) it would never fail.

Steps to reproduce

• In the AWS console, create a bucket in the "Account Regional namespace", in a region other than us-east-1 (for example eu-north-1)
• Create an access key for a user that can list the bucket and read, write, and delete its objects, but cannot create buckets
• In NethServer 8, go to Backup > Backup destinations, add a destination with the "Amazon S3" provider, and fill in bucket name, region, and access key

Expected behavior

The backup destination is added and backups run successfully.

Actual behavior

The destination is rejected on every node with no_read_permission ("Cannot connect, authenticate, or read ..."). AWS answers 403 AccessDenied because the request goes to the global endpoint.

If the regional endpoint is used instead, the read check passes but the write check fails with no_write_permission, because the user is not allowed to create buckets.

A working workaround is the "Rclone-compatible provider" with this configuration and the bucket name as path:

type = s3
provider = AWS
env_auth = false
access_key_id = <KEY_ID>
secret_access_key = <SECRET>
region = eu-north-1
endpoint = s3.eu-north-1.amazonaws.com
no_check_bucket = true

Proposed solution

• Build the Amazon S3 endpoint from the region field (s3.<region>.amazonaws.com), without breaking existing destinations
• Do not check for, or try to create, the bucket (no_check_bucket = true), as already done for Synology and IDrive. The bucket must already exist
• Make the rclone error messages visible in the task log and system logs, both during the destination check and when rclone is run by hand
• Replace the directory-based write check with a real one: write a small temporary file and remove it

Components

NethServer 8 core 3.23.1

See also

• https://community.nethserver.org/t/amazon-s3-backup-destination-fails-with-the-new-account-regional-namespace-buckets/29021
• https://community.nethserver.org/t/backup-s3-server-locationconstraintconflict-the-location-constraint-differs-from-the-location-you-are-trying-to-access/25609 (related)

Thanks to Thorsten for the detailed analysis and the workaround.