SignatureDoesNotMatch or 403 on uploads that worked before |
the client sends Content-Type without signing it; RGW rejects that since a 2026 security fix |
update the SDK (aws-sdk-php 3.385.3 or later, current boto3/AWS CLI/rclone are fine) |
TooManyBuckets or BucketAlreadyExists on mkdir / mb |
one account holds one bucket, it already exists |
use the existing bucket; rclone: --s3-no-check-bucket |
| signature errors after changing the region |
region name and endpoint do not match |
use zero-fra1, zero-fra2 or zero-eyl1 with the matching endpoint |
NoSuchBucket with virtual-host URLs |
client uses bucket.endpoint addressing |
switch to path-style (force_path_style) |
503 SlowDown |
request rate limit |
back off and retry; for sustained load open a ticket |
custom domain shows 403 |
static hosting disabled, bucket policy private, geofencing, or origin lock without ZERO-PROTECT in front |
enable static hosting, set public-read, check geofencing and origin lock |
| custom domain shows a certificate error |
CNAME not pointing at <bucket>.<endpoint host>, or certificate not issued yet |
run the DNS check in the portal, then request the certificate |
public files return AccessDenied |
no public-read policy |
mc anonymous set download or a bucket policy |
| cancellation refused |
bucket not empty |
delete objects, versions, delete markers and multipart uploads; wait for locked versions to expire |