s3: add option to disable AWS dual-stack endpoints (#22060)

Co-authored-by: Michael Eischer <michael.eischer@fau.de>

internal/backend/s3/config.go

@@ -32,6 +32,7 @@ type Config struct {
 	Region              string `option:"region" help:"set region"`
 	BucketLookup        string `option:"bucket-lookup" help:"bucket lookup style: 'auto', 'dns', or 'path'"`
 	ListObjectsV1       bool   `option:"list-objects-v1" help:"use deprecated V1 api for ListObjects calls"`
+	DisableDualstack    bool   `option:"disable-dualstack" help:"do not use AWS S3 dual-stack endpoints, which VPC endpoints do not support"`
 	UnsafeAnonymousAuth bool   `option:"unsafe-anonymous-auth" help:"use anonymous authentication"`
 
 	// For testing only

internal/backend/s3/s3.go

@@ -89,6 +89,12 @@ func open(cfg Config, rt http.RoundTripper) (*s3, error) {
 		return nil, errors.Wrap(err, "minio.New")
 	}
 
+	if cfg.DisableDualstack {
+		// VPC interface and gateway endpoints have no dual-stack support, so
+		// resolving to one makes the bucket unreachable from within the VPC
+		client.SetS3EnableDualstack(false)
+	}
+
 	be := &s3{
 		client: client,
 		cfg:    cfg,