aws_endpoint
The `aws_endpoint` directive specifies the AWS endpoint for S3 service when using the NGINX AWS authentication module.
Description
The aws_endpoint directive is utilized within the NGINX configuration to define the specific AWS endpoint needed for communication with authenticated services, particularly Amazon S3. When set, this directive allows the NGINX server to route requests to the correct regional endpoint, enhancing connectivity and reducing latency by ensuring that requests are directed to the closest geographical service location. The AWS endpoint is a critical component because different AWS regions use different endpoints, which dictate the URL used for service calls.
The directive takes a single argument that should be a valid string representing the desired AWS endpoint, for example, s3.us-west-1.amazonaws.com or s3.cn-north-1.amazonaws.com.cn. It must be defined in the context of http, server, or location blocks, and is typically used alongside other AWS configuration directives such as aws_access_key, aws_signing_key, and aws_s3_bucket to ensure requests are correctly authenticated and authorized. This directive is especially useful for setups where multiple S3 buckets across different regions are served by a single NGINX instance, allowing for granular control over request routing based on their geographical attributes.
It's important to note that if this directive is not specified, the default endpoint used will be s3.amazonaws.com, which may lead to issues if the resources are hosted in other regions. It aids in adapting the module's behavior based on the infrastructure needs of the application being hosted.
Config Example
server {
listen 8000;
aws_access_key your_aws_access_key;
aws_key_scope scope_of_generated_signing_key;
aws_signing_key signing_key_generated_using_script;
aws_s3_bucket your_s3_bucket;
location /s3_beijing {
aws_endpoint "s3.cn-north-1.amazonaws.com.cn";
proxy_pass http://your_s3_bucket.s3.cn-north-1.amazonaws.com.cn;
}
}Ensure the endpoint matches the intended AWS region to avoid connectivity issues.
Do not forget to refresh the signing key regularly; it is valid for just one week.
The endpoint should be enclosed in quotes; failure to do so may lead to syntax errors.