Skip to main content

S3: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'ap-southeast-2'

bloatedstoat
  • Edited

We are running cPanel Version 136.0.35 on CloudLinux v8.10.0 and have encountered an issue with the native Amazon S3 backup destination today only.

This configuration was functioning correctly and validating successfully as recently as 17 August 2026. No AWS-side changes were made to the bucket region or credentials. The failure began on 18 August following the cPanel/CloudLinux update. The destination now saves successfully but fails validation, and the generated destination configuration contains region: ''

Our S3 bucket is located in ap-southeast-2 (Sydney):

The AWS credentials are valid and have been successfully used by cPanel to upload backups recently.

However, the Amazon S3 destination in WHM is displaying US East as the bucket region, albeit greyed out.

I explicitly selected the correct ap-southeast-2 region in the destination configuration and saved it today. WHM reported: Success: The system successfully saved the “Amazon_S3” destination.

However, the resulting destination configuration still contains:

region: ''

The complete relevant configuration is:

bucket: server01-cpanel-backups-xxxxxxxxx-ap-southeast-2-an
folder: server01
region: ''
type: AmazonS3

The configuration file is:

/var/cpanel/backups/Amazon_S3_UID_xxxxxxxxxxxxxxx_.backup_destination

The file's modification timestamp corresponds to the time the destination was saved, so the region is not simply being lost later — it appears that the selected region is not being persisted.

We subsequently observed the following cpbackup_transporter error:

AuthorizationHeaderMalformed:
The authorization header is malformed;
the region 'us-east-1' is wrong;
expecting 'ap-southeast-2'

Specifically:

[2026-08-18 22:45:34 +1000] Starting a "copy" operation on the "Amazon_S3" destination
[2026-08-18 22:46:56 +1000] Making Path /server01/2026-08-18/accounts/
[2026-08-18 22:48:00 +1000] Path creation failed:
AuthorizationHeaderMalformed:
The authorization header is malformed;
the region 'us-east-1' is wrong;
expecting 'ap-southeast-2'

There was also a separate network/DNS interruption during this backup run. Earlier uploads failed with:

Can't connect to server01-cpanel-backups-xxxxxxxxx-ap-southeast-2-an.s3-ap-southeast-2.amazonaws.com:443
(Name or service not known)

This appears to have been a transient DNS/network outage, as the server was also intermittently unreachable externally at approximately the same time.

However, after connectivity recovered, the wrong-region error remained, which appears to be a separate issue.

Interestingly, many other backup objects were successfully uploaded to the same bucket, so the credentials and bucket themselves are valid.

I have also found cPanel community reports describing cpbackup_transporter producing the same:

AuthorizationHeaderMalformed
region 'us-east-1' is wrong
expecting '<actual region>'

behaviour.

Could you please advise:

  • Why does the native Amazon S3 destination fail to persist the selected ap-southeast-2 region?
  • Is this a known issue in cPanel 136.0.35, or is there a specific configuration/API method required to set the AWS region?
  • Is there a supported workaround for an existing AWS S3 bucket in ap-southeast-2?
  • Should we be using the native Amazon S3 destination or the S3 Compatible destination for this configuration?
  • Is there a current fix/hotfix for the cpbackup_transporter AuthorizationHeaderMalformed / us-east-1 issue?

We have deliberately restricted the backup IAM user's s3:DeleteObject permission to protect remote backups from cPanel pruning, so we get DeleteObject AccessDenied but these are intentional and are not the primary issue described here.

The immediate concern is that failed S3 transports can result in the local backup subsequently being removed because local retention is set to 1.

Notably: cPanel's current documentation describes Amazon S3 as a native destination, but its documented Amazon S3 settings don't list a region field and thus figured this behaviour is worth escalating.

Thank you.

Comments

4 comments

Date Votes
  • bloatedstoat

    I'm going to follow this up. We think this is due to the implemented IAM policy not allowing cpanel to delete a temporary validation object. So I'm going to hold this and update later whilst looking into it further.

    Thanks cpRex.

    1
  • bloatedstoat

    Our backup last night completed successfully, our provider had a network issue the previous day that prevented the backup completing the upload of 2 accounts.

    That said, the fact "region" in the WHM backup config for S3 is blank  and shows east us in grey is a red herring. Entered information is not saved nor printed to the screen in the Region text field. 

    At this stage our backup is working as expected so nothing further to add to this. Thanks.

    0
  • cPRex Jurassic Moderator

    Thanks for sharing that - I'll do some testing on that interface issue and get a report filed with the developers a bit later.  It might not be until Friday before I'm able to get to this one but I'll let you know!

    1
  • cPRex Jurassic Moderator

    I've confirmed that issue with the default "us-east-1" displaying even though valid data is entered into the configuration.  I've created case CPANEL-56095 with our developers and I've linked this thread to the case so I'll be sure to post an update if I hear anything on my end.

    1

Please sign in to leave a comment.

Didn't find what you were looking for?

New post