s3fs Proxy Bypass Must Match the Actual Bucket Hostname
Match an s3fs bypass rule against the actual S3 endpoint, including bucket-style hostnames and redirects.
s3.amazonaws.com does not match photos.s3.us-east-1.amazonaws.com. The regional hostname does not end in that configured domain. A domain exception can include subdomains, but it cannot identify every endpoint belonging to a storage service.
Find the host s3fs actually contacts, including later redirects. Virtual-hosted addressing puts the bucket in the hostname; path-style addressing puts it in the path. A custom endpoint or region correction can therefore change the name a bypass rule must match.
Use use_path_request_style when the service requires that addressing form. Changing it only to make an unexplained proxy exception work mixes two decisions and can affect certificate names and service compatibility.
s3fs uses libcurl for HTTP transfers, and no_proxy can exclude HTTPS destinations too. Choose a hostname or domain exception broad enough for the intended direct requests. A wider domain can include other buckets and services; * disables proxy use altogether for the applicable request.
If the same endpoint works from an interactive mount but not a service-managed mount, compare their inherited environment and configuration sources. Exporting a variable after the service has started cannot update that existing process. Establish the endpoint name and mount process inputs before changing bucket credentials.