You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* <p>Returns a list of the access grants that were given to the caller using S3 Access Grantsand that allow the caller to access the S3 data of the Amazon Web Services account specified in the request.</p>
33
+
* <p>Use this API to list the access grants that grant the caller access to Amazon S3 data through S3 Access Grants. The caller (grantee) can be an Identity and Access Management (IAM) identity or Amazon Web Services Identity Center corporate directory identity. You must pass the Amazon Web Services account of the S3 data owner (grantor) in the request. You can, optionally, narrow the results by <code>GrantScope</code>, using a fragment of the data's S3 path, and S3 Access Grants will return only the grants with a path that contains the path fragment. You can also pass the <code>AllowedByApplication</code> filter in the request, which returns only the grants authorized for applications, whether the application is the caller's Identity Center application or any other application (<code>ALL</code>). For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-list-grants.html">List the caller's access grants</a> in the <i>Amazon S3 User Guide</i>.</p>
* <p>For directory buckets, only the server-side encryptionwith Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) is supported.</p>
2557
-
* </note>
2554
+
* <p>The server-side encryption algorithm used when storing objects in Amazon S3.</p>
2555
+
* <p>
2556
+
* <b>Directory buckets </b> - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) and server-side encryption with KMS keys (SSE-KMS) (<code>KMS</code>). For more
2557
+
* information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-serv-side-encryption.html">Protecting data with server-side encryption</a> in the <i>Amazon S3 User Guide</i>. For <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops">the Copy operation in Batch Operations</a>, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_S3CopyObjectOperation.html">S3CopyObjectOperation</a>.</p>
* <b>Directory buckets</b> - For example, to copy objects to a directory bucket named
2636
-
* <code>destinationBucket</code> in the Availability Zone; identified by the AZ ID <code>usw2-az1</code>, set the <code>TargetResource</code> property to
* <code>destinationBucket</code> in the Availability Zone identified by the AZ ID <code>usw2-az1</code>, set the <code>TargetResource</code> property to
2637
+
* <code>arn:aws:s3express:<i>region</i>:<i>account_id</i>:/bucket/<i>destination_bucket_base_name</i>--<i>usw2-az1</i>--x-s3</code>. A directory bucket as a destination bucket can be in Availability Zone or Local Zone. </p>
2638
+
* <note>
2639
+
* <p>Copying objects across different Amazon Web Services Regions isn't supported when the source or destination bucket is in Amazon Web Services Local Zones. The source and destination buckets must have the same parent Amazon Web Services Region. Otherwise,
2640
+
* you get an HTTP <code>400 Bad Request</code> error with the error code <code>InvalidRequest</code>.</p>
* <p>Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. If the KMS key doesn't exist in the same
2737
+
* account that's issuing the command, you must use the full Key ARN not the Key ID.</p>
2733
2738
* <note>
2734
-
* <p>This functionality is not supported by directory buckets.</p>
2739
+
* <p>
2740
+
* <b>Directory buckets</b> - If you specify <code>SSEAlgorithm</code> with <code>KMS</code>, you must specify the <code>
2741
+
* SSEAwsKmsKeyId</code> parameter with the ID (Key ID or Key ARN) of the KMS
2742
+
* symmetric encryption customer managed key to use. Otherwise, you get an HTTP <code>400 Bad Request</code> error. The key alias format of the KMS key isn't supported. To encrypt new object copies in a directory bucket with SSE-KMS, you must specify SSE-KMS as the directory bucket's default encryption configuration with a KMS key (specifically, a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>).
2743
+
* The <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a> (<code>aws/s3</code>) isn't supported. Your SSE-KMS configuration can only support 1 <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a> per directory bucket for the lifetime of the bucket.
2744
+
* After you specify a customer managed key for SSE-KMS as the bucket default encryption, you can't override the customer managed key for the bucket's SSE-KMS configuration.
2745
+
* Then, when you specify server-side encryption settings for new object copies with SSE-KMS, you must make sure the encryption key is the same customer managed key that you specified for the directory bucket's default encryption configuration.
* <p>Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with
2786
2798
* server-side encryption using Amazon Web Services KMS (SSE-KMS). Setting this header to <code>true</code>
2787
2799
* causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS.</p>
2788
-
* <p>Specifying this header with an <i>object</i> action doesn’t affect
2800
+
* <p>Specifying this header with an <i>Copy</i> action doesn’t affect
2789
2801
* <i>bucket-level</i> settings for S3 Bucket Key.</p>
2790
2802
* <note>
2791
-
* <p>This functionality is not supported by directory buckets.</p>
2803
+
* <p>
2804
+
* <b>Directory buckets</b> - S3 Bucket Keys aren't supported, when you copy SSE-KMS encrypted objects from general purpose buckets
2805
+
* to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops">the Copy operation in Batch Operations</a>. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.</p>
* <p>The action that you want this job to perform on every object listed in the manifest. For
3131
-
* more information about the available actions, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-actions.html">Operations</a> in the
3145
+
* more information about the available actions, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-operations.html">Operations</a> in the
Copy file name to clipboardExpand all lines: codegen/sdk-codegen/aws-models/s3-control.json
+6-6
Original file line number
Diff line number
Diff line change
@@ -7913,7 +7913,7 @@
7913
7913
"Operation": {
7914
7914
"target": "com.amazonaws.s3control#JobOperation",
7915
7915
"traits": {
7916
-
"smithy.api#documentation": "<p>The action that you want this job to perform on every object listed in the manifest. For\n more information about the available actions, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-actions.html\">Operations</a> in the\n <i>Amazon S3 User Guide</i>.</p>",
7916
+
"smithy.api#documentation": "<p>The action that you want this job to perform on every object listed in the manifest. For\n more information about the available actions, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-operations.html\">Operations</a> in the\n <i>Amazon S3 User Guide</i>.</p>",
"smithy.api#documentation": "<p>Returns a list of the access grants that were given to the caller using S3 Access Grants and that allow the caller to access the S3 data of the Amazon Web Services account specified in the request.</p>\n <dl>\n <dt>Permissions</dt>\n <dd>\n <p>You must have the <code>s3:ListCallerAccessGrants</code> permission to use this operation. </p>\n </dd>\n </dl>",
13751
+
"smithy.api#documentation": "<p>Use this API to list the access grants that grant the caller access to Amazon S3 data through S3 Access Grants. The caller (grantee) can be an Identity and Access Management (IAM) identity or Amazon Web Services Identity Center corporate directory identity. You must pass the Amazon Web Services account of the S3 data owner (grantor) in the request. You can, optionally, narrow the results by <code>GrantScope</code>, using a fragment of the data's S3 path, and S3 Access Grants will return only the grants with a path that contains the path fragment. You can also pass the <code>AllowedByApplication</code> filter in the request, which returns only the grants authorized for applications, whether the application is the caller's Identity Center application or any other application (<code>ALL</code>). For more information, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-list-grants.html\">List the caller's access grants</a> in the <i>Amazon S3 User Guide</i>.</p>\n <dl>\n <dt>Permissions</dt>\n <dd>\n <p>You must have the <code>s3:ListCallerAccessGrants</code> permission to use this operation. </p>\n </dd>\n </dl>",
"smithy.api#documentation": "<p>Specifies the destination bucket\n Amazon Resource Name\n (ARN)\n for the batch copy operation.</p>\n <ul>\n <li>\n <p>\n <b>General purpose buckets</b> - For example, to copy objects to a general purpose bucket named\n <code>destinationBucket</code>, set the <code>TargetResource</code> property to\n <code>arn:aws:s3:::destinationBucket</code>.</p>\n </li>\n <li>\n <p>\n <b>Directory buckets</b> - For example, to copy objects to a directory bucket named\n <code>destinationBucket</code> in the Availability Zone; identified by the AZ ID <code>usw2-az1</code>, set the <code>TargetResource</code> property to\n <code>arn:aws:s3express:<i>region</i>:<i>account_id</i>:/bucket/<i>destination_bucket_base_name</i>--<i>usw2-az1</i>--x-s3</code>.</p>\n </li>\n </ul>"
17278
+
"smithy.api#documentation": "<p>Specifies the destination bucket\n Amazon Resource Name\n (ARN)\n for the batch copy operation.</p>\n <ul>\n <li>\n <p>\n <b>General purpose buckets</b> - For example, to copy objects to a general purpose bucket named\n <code>destinationBucket</code>, set the <code>TargetResource</code> property to\n <code>arn:aws:s3:::destinationBucket</code>.</p>\n </li>\n <li>\n <p>\n <b>Directory buckets</b> - For example, to copy objects to a directory bucket named\n <code>destinationBucket</code> in the Availability Zone identified by the AZ ID <code>usw2-az1</code>, set the <code>TargetResource</code> property to\n <code>arn:aws:s3express:<i>region</i>:<i>account_id</i>:/bucket/<i>destination_bucket_base_name</i>--<i>usw2-az1</i>--x-s3</code>. A directory bucket as a destination bucket can be in Availability Zone or Local Zone. </p>\n <note>\n <p>Copying objects across different Amazon Web Services Regions isn't supported when the source or destination bucket is in Amazon Web Services Local Zones. The source and destination buckets must have the same parent Amazon Web Services Region. Otherwise, \n you get an HTTP <code>400 Bad Request</code> error with the error code <code>InvalidRequest</code>.</p>\n </note>\n </li>\n </ul>"
"smithy.api#documentation": "<p></p>\n <note>\n <p>This functionality is not supported by directory buckets.</p>\n </note>"
17345
+
"smithy.api#documentation": "<p>Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. If the KMS key doesn't exist in the same\n account that's issuing the command, you must use the full Key ARN not the Key ID.</p>\n <note>\n <p>\n <b>Directory buckets</b> - If you specify <code>SSEAlgorithm</code> with <code>KMS</code>, you must specify the <code>\n SSEAwsKmsKeyId</code> parameter with the ID (Key ID or Key ARN) of the KMS \n symmetric encryption customer managed key to use. Otherwise, you get an HTTP <code>400 Bad Request</code> error. The key alias format of the KMS key isn't supported. To encrypt new object copies in a directory bucket with SSE-KMS, you must specify SSE-KMS as the directory bucket's default encryption configuration with a KMS key (specifically, a <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk\">customer managed key</a>). \n The <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk\">Amazon Web Services managed key</a> (<code>aws/s3</code>) isn't supported. Your SSE-KMS configuration can only support 1 <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk\">customer managed key</a> per directory bucket for the lifetime of the bucket. \nAfter you specify a customer managed key for SSE-KMS as the bucket default encryption, you can't override the customer managed key for the bucket's SSE-KMS configuration. \nThen, when you specify server-side encryption settings for new object copies with SSE-KMS, you must make sure the encryption key is the same customer managed key that you specified for the directory bucket's default encryption configuration. \n </p>\n </note>"
17346
17346
}
17347
17347
},
17348
17348
"TargetKeyPrefix": {
@@ -17373,7 +17373,7 @@
17373
17373
"target": "com.amazonaws.s3control#Boolean",
17374
17374
"traits": {
17375
17375
"smithy.api#default": false,
17376
-
"smithy.api#documentation": "<p>Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with\n server-side encryption using Amazon Web Services KMS (SSE-KMS). Setting this header to <code>true</code>\n causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS.</p>\n <p>Specifying this header with an <i>object</i> action doesn’t affect\n <i>bucket-level</i> settings for S3 Bucket Key.</p>\n <note>\n <p>This functionality is not supported by directory buckets.</p>\n </note>"
17376
+
"smithy.api#documentation": "<p>Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with\n server-side encryption using Amazon Web Services KMS (SSE-KMS). Setting this header to <code>true</code>\n causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS.</p>\n <p>Specifying this header with an <i>Copy</i> action doesn’t affect\n <i>bucket-level</i> settings for S3 Bucket Key.</p>\n <note>\n <p>\n <b>Directory buckets</b> - S3 Bucket Keys aren't supported, when you copy SSE-KMS encrypted objects from general purpose buckets \nto directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops\">the Copy operation in Batch Operations</a>. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.</p>\n </note>"
"smithy.api#documentation": "<p></p>\n <note>\n <p>For directory buckets, only the server-side encryptionwith Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) is supported.</p>\n </note>"
17778
+
"smithy.api#documentation": "<p>The server-side encryption algorithm used when storing objects in Amazon S3.</p>\n <p>\n <b>Directory buckets </b> - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) and server-side encryption with KMS keys (SSE-KMS) (<code>KMS</code>). For more\n information, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-serv-side-encryption.html\">Protecting data with server-side encryption</a> in the <i>Amazon S3 User Guide</i>. For <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops\">the Copy operation in Batch Operations</a>, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_S3CopyObjectOperation.html\">S3CopyObjectOperation</a>.</p>"
0 commit comments