HumanSignal/label-studio · warning · S3StorageError

Debugging info is not available for s3 endpoints on domain:

Error message

Debugging info is not available for s3 endpoints on domain: {domain}. Please contact your Label Studio devops team if you require detailed error reporting for this domain.

What it means

A decorator (`wrapper`) in label_studio/io_storages/s3/utils.py intercepts exceptions from S3 storage methods. If the storage uses a custom s3_endpoint whose registered domain is not in settings.S3_TRUSTED_STORAGE_DOMAINS, the original exception is replaced by S3StorageError saying debugging info is unavailable — this prevents leaking internal endpoint/error details of untrusted third-party S3 services to end users.

Source

Thrown at label_studio/io_storages/s3/utils.py:173

# prevents network call on first use
extractor = TLDExtract(suffix_list_urls=())


def catch_and_reraise_from_none(func):
    """
    For S3 storages - if s3_endpoint is not on a known domain, catch exception and
    raise a new one with the previous context suppressed. See also: https://peps.python.org/pep-0409/
    """

    def wrapper(self, *args, **kwargs):
        try:
            return func(self, *args, **kwargs)
        except Exception as e:
            if self.s3_endpoint and (
                domain := extractor.extract_urllib(urlparse(self.s3_endpoint)).registered_domain.lower()
            ) not in [trusted_domain.lower() for trusted_domain in settings.S3_TRUSTED_STORAGE_DOMAINS]:
                logger.error(f'Exception from unrecognized S3 domain: {e}', exc_info=True)
                raise S3StorageError(
                    f'Debugging info is not available for s3 endpoints on domain: {domain}. '
                    'Please contact your Label Studio devops team if you require detailed error reporting for this domain.'
                ) from None
            else:
                raise e

    return wrapper

View on GitHub (pinned to 0b49e9b539)

Solutions

1. Add your endpoint's registered domain to settings.S3_TRUSTED_STORAGE_DOMAINS (e.g. ['minio.mycompany.com']) to get full error reporting.
2. Fix the s3_endpoint value if the domain is a typo.
3. Reproduce the underlying error from the server logs — logger.error('Exception from unrecognized S3 domain: ...') still records the real exception server-side.
4. If you don't need a custom endpoint, unset s3_endpoint and use standard AWS S3.

Example fix

// before (settings)
S3_TRUSTED_STORAGE_DOMAINS = []

// after
S3_TRUSTED_STORAGE_DOMAINS = ['minio.mycompany.com']

from urllib.parse import urlparse
import tldextract
from django.conf import settings

def endpoint_domain_is_trusted(s3_endpoint: str) -> bool:
    domain = tldextract.extract(urlparse(s3_endpoint)).registered_domain.lower()
    trusted = [d.lower() for d in settings.S3_TRUSTED_STORAGE_DOMAINS]
    return domain in trusted

if storage_config.get('s3_endpoint') and not endpoint_domain_is_trusted(storage_config['s3_endpoint']):
    print('Warning: errors from this endpoint will be masked; add domain to S3_TRUSTED_STORAGE_DOMAINS')

def is_configured_endpoint(endpoint) -> bool:
    return isinstance(endpoint, str) and endpoint.startswith(('http://', 'https://'))

try:
    storage.sync()
except S3StorageError as e:
    if 'Debugging info is not available' in str(e):
        # real cause is in server logs under 'Exception from unrecognized S3 domain'
        # permanent fix: add the endpoint domain to settings.S3_TRUSTED_STORAGE_DOMAINS
        logger.error('Masked S3 error for untrusted endpoint domain')

When it happens

Trigger: Any S3 storage operation (sync, validate_connection, etc.) that raises while s3_endpoint is set to a host whose registered domain is not listed in S3_TRUSTED_STORAGE_DOMAINS — the `from None` suppresses the original cause entirely.

Common situations: Self-hosted MinIO/DigitalOcean Spaces/Wasabi endpoints without adding their domain to the trusted list; misconfigured s3_endpoint with a typo domain; operators unaware S3_TRUSTED_STORAGE_DOMAINS exists.

Related errors

• Absolute local path "{self.path}" cannot be the same as LOCA
• Absolute local path "{self.path}" must be a subdirectory of
• Serving local files from the host filesystem can be a securi
• When "FEATURE_FLAGS_FROM_FILE" is set, you have to specify a
• LABEL_STUDIO_HOST must be a subpath if DOMAIN_FROM_REQUEST i

AI-assisted analysis of HumanSignal/label-studio@0b49e9b539 (2026-08-29). Data as JSON: /api/errors/01e629a8fc90394c. Report an issue: GitHub.