When syncing media to an AWS S3 bucket located outside the us-east-1 region, the ext_url generated by media-sync defaults to the legacy global S3 format:
https://s3.amazonaws.com/{bucket}/{path}
This format only works for buckets in us-east-1. For buckets in other regions (e.g., eu-west-1), AWS returns AccessDenied when accessing this URL, even with correct public-read permissions and bucket policies.
Possible fix
If the region specified in config.yaml is not us-east-1 build the ext_url with https://{bucket}.s3.{config.minio.region}.amazonaws.com/{path}
Alternatively expose a config option like external_url_template for more flexibility in config.yaml