Multi-Region Access Point restrictions and limitations - Amazon Simple Storage Service

Multi-Region Access Point restrictions and limitations

Multi-Region Access Points in Amazon S3 have the following restrictions and limitations.

  • Multi-Region Access Point names:

    • Must be unique within a single AWS account

    • Must begin with a number or lowercase letter

    • Must be between 3 and 50 characters long

    • Can't begin or end with a hyphen (-)

    • Can't contain underscores (_), uppercase letters, or periods (.)

    • Can't be edited after they are created

  • Multi-Region Access Point aliases are generated by Amazon S3 and can't be edited or reused.

  • You cannot access data through a Multi-Region Access Point by using gateway endpoints or interface endpoints. To use AWS PrivateLink, you must create VPC endpoints. For more information, see Configuring a Multi-Region Access Point for use with AWS PrivateLink.

  • You cannot use a Multi-Region Access Point as the distribution origin for Amazon CloudFront. However, you can configure Multi-Region Access Points as a custom distribution origin with Amazon CloudFront. For more details, see Building an active-active, proximity-based application across multiple Regions on the AWS Storage Blog.

  • Multi-Region Access Point minimum requirements:

    • Transport Layer Security (TLS) v1.2

    • Signature Version 4 (SigV4A)

      Multi-Region Access Points support Signature Version 4A. This version of SigV4 allows requests to be signed for multiple AWS Regions. This feature is useful in API operations that might result in data access from one of several Regions. When using an AWS SDK, you supply your credentials, and the requests to Multi-Region Access Points will use Signature Version 4A without additional configuration. Make sure to check your AWS SDK compatibility with the SigV4A algorithm. For more information about SigV4A, see Signing AWS API requests in the AWS General Reference.

      Note

      To use SigV4A with temporary security credentials—for example, when using AWS Identity and Access Management (IAM) roles—make sure that you request the temporary credentials from a Regional endpoint in AWS Security Token Service (AWS STS), instead of a global endpoint. If you use the global endpoint for AWS STS (sts.amazonaws.com), AWS STS will generate temporary credentials from a global endpoint, which isn't supported by Sig4A. As a result, you'll get an error. To resolve this issue, use any of the listed Regional endpoints for AWS STS.

  • Multi-Region Access Point limitations:

    • IPv6 is not supported.

    • Amazon S3 on Outposts buckets are not supported.

    • CopyObject is not supported, as a source or destination.

    • The S3 Batch Operations feature is not supported.

  • Certain AWS SDKs are not supported. To confirm which AWS SDKs are supported for Multi-Region Access Points, see Compatibility with AWS SDKs.

  • The service quotas for Multi-Region Access Points are as follows:

    • There is a maximum of 100 Multi-Region Access Points per account.

    • There is a limit of 17 Regions for a single Multi-Region Access Point.

  • Only the following AWS Regions are supported:

    • US East (N. Virginia)

    • US East (Ohio)

    • US West (N. California)

    • US West (Oregon)

    • Asia Pacific (Mumbai)

    • Asia Pacific (Osaka)

    • Asia Pacific (Seoul)

    • Asia Pacific (Singapore)

    • Asia Pacific (Sydney)

    • Asia Pacific (Tokyo)

    • Canada (Central)

    • Europe (Frankfurt)

    • Europe (Ireland)

    • Europe (London)

    • Europe (Paris)

    • Europe (Stockholm)

    • South America (São Paulo)