AWS Osaka local region(ap-northeast-3) support

[Yukinobu]

Hi,

Our customer plan to use S3 of AWS Osaka local region(ap-northeast-3).

AWS Osaka local region is not full region.
So we cannot select it in object storage repository wizard of Amazon S3.

So they confirmed that can add object storage repository of S3 compatible with following info.
Service point: https://s3.ap-northeast-3.amazonaws.com
Region: ap-northeast-3

Can we use Osaka local region S3 as object storage repository of S3 compatible?

Additional we confirmed S3 region list at following xml in Veeam Backup server.
"C:\Program Files\Veeam\Backup and Replication\Backup\AmazonS3Regions.xml"

Or should we add Osaka local region to the xml file and use Osaka local region S3 as object storage repository of Amazon S3?

Code: Select all

<Region Id="ap-northeast-3" Name="Asia Pacific (Osaka-Local)" Type="Global">
	<Endpoint Type="S3">s3.accesspoint.ap-northeast-3.amazonaws.com</Endpoint>
	<Endpoint Type="S3">s3-accesspoint.ap-northeast-3.amazonaws.com</Endpoint>
	<Endpoint Type="S3">s3.dualstack.ap-northeast-3.amazonaws.com</Endpoint>
	<Endpoint Type="EC2">ec2.ap-northeast-3.amazonaws.com</Endpoint>
	<Endpoint Type="IAM">iam.amazonaws.com</Endpoint>
	<Protocol>HTTP</Protocol>
	<Protocol>HTTPS</Protocol>
	<LocationConstraint>ap-northeast-3</LocationConstraint>
	<SignatureVersion>2</SignatureVersion>
	<SignatureVersion>4</SignatureVersion>
</Region>

Thank you for any help you can provide.

[HannesK]

Hello,

Can we use Osaka local region S3 as object storage repository of S3 compatible?

yes, that should work. We have the XML to support such situations.

If your edit of the C:\Program Files\Veeam\Backup and Replication\Backup\AmazonS3Regions.xml is not working, then please contact support and post the case number.

It looks like Osaka is a restricted region. At least I cannot create buckets there (otherwise I would have tested it on my own).

Best regards,
Hannes

[veremin]

So they confirmed that can add object storage repository of S3 compatible with following info.

The described approach is valid, however, we haven't tested it with the restricted regions. So, should you continue experiencing issues, kindly, open a support ticket, as Hannes recommended - and we will assist you with the investigation process. Thanks!

[Yukinobu]

Hi,

Thank you for info!

Currently Veeam try to access all region endpoint in xml.
But if we allow only specific region access, the wizard may fail prematurely.
In such a case, is there no choice but to edit the xml?

Also, we request a feature that works by accessing a only specific region(can select a region in advance as Veeam's operation).

[HannesK]

But if we allow only specific region access, the wizard may fail prematurely.

I do not understand what you mean. Does that have anything to do with the original question?

If something is not working, please provide the case number. Thanks.

[Yukinobu]

Hi,

The addition as an S3 compatible repository has been successful and is working.
Thank you very much.

However, they are filtering endpoints such as the following, which allows only specific regions.
* .ap-northeast-3.amazonaws.com

So when they added ap-northeast-3 setting to the end of the xml and added it as an S3 repository, this failed with a timeout.
If they added ap-northeast-3 setting to the beginning of the xml and added it as an S3 repository, this was successful.

[veremin]

However, they are filtering endpoints such as the following, which allows only specific regions.

Not sure whether I get this. You're saying that xml modification approach works only, if the new region is added to the beginning of the xml, not to the end? If so, we will double check it. Thanks!

[Yukinobu]

Yes.
If we deny an endpoint other than A, xml modification approach works only that A region is added to the beginning of the xml, not the end.

[veremin]

Just to be 100% clear - what exactly you mean by "deny an endpoint other than A"? Thanks!

[Yukinobu]

It means blocking all access except endpoints in a particular region.

It doesn't matter how you do it, but I'm assuming there are firewalls that block certain URIs, or IAM policies that deny certain regions.
https://docs.aws.amazon.com/IAM/latest/ ... egion.html

[veremin]

Ah, understood, it might explain the situation: after several unsuccessful attempts to establish connection to different regions, the process must have stopped and have not queried the last region in the list.