Troubleshooting
This page lists common problems when you use FPT Object Storage, their likely causes, and how to fix them.
A client or SDK connects to Amazon S3 instead of FPT Object Storage
Symptoms: InvalidAccessKeyId, or the request is sent to an amazonaws.com address.
Cause: S3 tools and SDKs send requests to Amazon S3 unless you set an endpoint.
Fix: Set the endpoint of your region in the client or SDK. For example, AWS CLI needs --endpoint-url, and s3cmd needs S3 Endpoint and DNS-style bucket+hostname. See Connect with S3 clients and SDK reference. You can find the endpoint of each region in the Access Key tab on the Portal.
Requests to bucket-name.<endpoint> fail with DNS or SSL errors
Symptoms: The client cannot resolve an address such as my-bucket.s3-hcm04.fptcloud.com, or reports an SSL certificate mismatch. This often happens when the bucket name contains a dot (.).
Cause: FPT Object Storage supports two addressing styles:
- Virtual-hosted style: the bucket name is part of the host name, for example
https://my-bucket.s3-hcm04.fptcloud.com/photo.jpg. - Path style: the bucket name is part of the path, for example
https://s3-hcm04.fptcloud.com/my-bucket/photo.jpg.
Virtual-hosted style depends on DNS and on the SSL certificate matching the full host name, so it can fail on some networks or with bucket names that contain dots.
Fix: Switch the client to path style:
| Tool | Setting |
|---|---|
| AWS CLI | aws configure set default.s3.addressing_style path |
| s3cmd | Set host_bucket to the same value as host_base, for example s3-hcm04.fptcloud.com. |
| boto3 (Python) | config=botocore.config.Config(s3={"addressing_style": "path"}) |
| Other SDKs | Enable the path-style option, as shown in the SDK reference. |
Requests fail with AccessDenied (403)
Check the identity that owns the key:
- SubUser: the role may be None, or a Bucket Policy may not grant this SubUser access to the bucket. See Manage SubUsers and Grant per-bucket access to SubUsers.
- IAM User: a new IAM User has no permission until you attach a policy, and the policy must cover both the bucket and its objects (
arn:aws:s3:::bucket-nameandarn:aws:s3:::bucket-name/*). See Manage IAM Users and IAM Roles. - Deleted key: a key that was deleted on the Portal stops working immediately.
The object URL returns AccessDenied in a browser
Cause: Anonymous users can open an object URL only when the object is public. Bucket ACL Public lets anyone list the bucket but does not make its objects public.
Fix: Make the object public with Object ACL, or add a Bucket Policy that allows s3:GetObject for everyone. See Manage permissions.
A web page cannot load files from a bucket because of CORS
Symptoms: The browser console shows an error such as No 'Access-Control-Allow-Origin' header.
Fix: Add a CORS rule to the bucket that allows the origin of your website and the HTTP methods it uses. See Configure a bucket.
Uploads fail with checksum errors after you update an SDK or AWS CLI
Symptoms: Errors such as XAmzContentSHA256Mismatch, MissingContentLength, or InvalidRequest on upload, after an upgrade.
Cause: AWS SDK and AWS CLI versions released from 2025 onward add data-integrity checksums to upload requests by default.
Fix: Set the request checksum calculation option to when_required. For AWS CLI and SDKs that read the AWS configuration file, add the following lines to ~/.aws/config:
[default]
request_checksum_calculation = when_required
response_checksum_validation = when_required
You cannot upload a file larger than 100 GB on the Portal
Cause: The Portal accepts up to 100 GB per upload.
Fix: Upload the file with an S3 client such as AWS CLI or s3cmd, or with an SDK. These tools split large files into parts automatically (multipart upload). See Connect with S3 clients.
You lost the Secret Key of an Access Key
Cause: The Secret Key is shown only once, when the key is created, and cannot be retrieved later.
Fix: Generate a new key, update every application that uses the old key, then delete the old key. See Manage Access Keys.
The IAM User tab does not appear on the Portal
Cause: IAM Users and IAM Roles are available only for Object Storage on the HCM-04 cluster.
Fix: On other clusters, use SubUsers to share limited access. See Manage SubUsers.
s3cmd does not keep your settings
Cause: At the end of s3cmd --configure, the prompt Save settings? [y/N] defaults to N.
Fix: Run s3cmd --configure again and type y at the last prompt, or edit ~/.s3cfg directly.
Still need help?
Contact FPT Cloud support and include the bucket name, region, the tool or SDK and its version, the exact error message, and the time the error occurred.