fix(proxy): use path-style S3 URLs for dotted Transcribe media buckets

Virtual-hosted URLs for bucket names containing dots fail TLS verification, so the
media duration fetch failed and completed jobs were charged the eight hour maximum

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
yassin 2026-09-17 21:55:32 +00:00
parent 16500bdf07
commit 4885594a1e
2 changed files with 11 additions and 2 deletions

View file

@ -290,13 +290,16 @@ def transcribe_job_lookup(aws_region_name: str) -> JobLookup:
def s3_media_url(media_uri: str, aws_region_name: str) -> str | None:
"""
Transcribe accepts media as s3://bucket/key or as an https S3 URL; the bucket is required to
live in the job's region, so the s3 form maps onto that region's virtual-hosted endpoint.
The proxy's AWS signature is only ever sent to that partition's own hosts.
live in the job's region, so the s3 form maps onto that region's endpoint. Buckets with dots in
their name use the path-style form because they cannot match the virtual-hosted wildcard
certificate. The proxy's AWS signature is only ever sent to that partition's own hosts.
"""
dns_suffix: Final = get_aws_dns_suffix(aws_region_name)
if not media_uri.startswith("s3://"):
return media_uri if httpx.URL(media_uri).host.endswith(f".{dns_suffix}") else None
bucket, _, key = media_uri.removeprefix("s3://").partition("/")
if "." in bucket:
return f"https://s3.{aws_region_name}.{dns_suffix}/{bucket}/{quote(key)}"
return f"https://{bucket}.s3.{aws_region_name}.{dns_suffix}/{quote(key)}"

View file

@ -197,6 +197,12 @@ class TestS3MediaUrl:
== "https://my-bucket.s3.us-west-2.amazonaws.com/dir/a%20b.wav"
)
def test_dotted_bucket_maps_to_the_regional_path_style_endpoint(self):
assert (
s3_media_url("s3://media.example.com/dir/a b.wav", "us-west-2")
== "https://s3.us-west-2.amazonaws.com/media.example.com/dir/a%20b.wav"
)
@pytest.mark.parametrize(
"media_uri",
[