Skip to content

Commit

Permalink
feat(client-s3-control): Amazon S3 introduces support for AWS Dedicat…
Browse files Browse the repository at this point in the history 
…ed Local Zones
  • Loading branch information
awstools committed Dec 2, 2024
1 parent 8730906 commit f1a56b4
Show file tree
Hide file tree
Showing 3 changed files with 32 additions and 18 deletions.
2 changes: 1 addition & 1 deletion clients/client-s3-control/src/commands/ListCallerAccessGrantsCommand.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ export interface ListCallerAccessGrantsCommandInput extends ListCallerAccessGran
export interface ListCallerAccessGrantsCommandOutput extends ListCallerAccessGrantsResult, __MetadataBearer {}

/**
* <p>Returns a list of the access grants that were given to the caller using S3 Access Grants and that allow the caller to access the S3 data of the Amazon Web Services account specified in the request.</p>
* <p>Use this API to list the access grants that grant the caller access to Amazon S3 data through S3 Access Grants. The caller (grantee) can be an Identity and Access Management (IAM) identity or Amazon Web Services Identity Center corporate directory identity. You must pass the Amazon Web Services account of the S3 data owner (grantor) in the request. You can, optionally, narrow the results by <code>GrantScope</code>, using a fragment of the data's S3 path, and S3 Access Grants will return only the grants with a path that contains the path fragment. You can also pass the <code>AllowedByApplication</code> filter in the request, which returns only the grants authorized for applications, whether the application is the caller's Identity Center application or any other application (<code>ALL</code>). For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-list-grants.html">List the caller's access grants</a> in the <i>Amazon S3 User Guide</i>.</p>
* <dl>
* <dt>Permissions</dt>
* <dd>
Expand Down
36 changes: 25 additions & 11 deletions clients/client-s3-control/src/models/models_0.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2551,10 +2551,10 @@ export interface S3ObjectMetadata {
RequesterCharged?: boolean | undefined;

/**
* <p></p>
* <note>
* <p>For directory buckets, only the server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) is supported.</p>
* </note>
* <p>The server-side encryption algorithm used when storing objects in Amazon S3.</p>
* <p>
* <b>Directory buckets </b> - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) and server-side encryption with KMS keys (SSE-KMS) (<code>KMS</code>). For more
* information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-serv-side-encryption.html">Protecting data with server-side encryption</a> in the <i>Amazon S3 User Guide</i>. For <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops">the Copy operation in Batch Operations</a>, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_S3CopyObjectOperation.html">S3CopyObjectOperation</a>.</p>
* @public
*/
SSEAlgorithm?: S3SSEAlgorithm | undefined;
Expand Down Expand Up @@ -2633,8 +2633,12 @@ export interface S3CopyObjectOperation {
* <li>
* <p>
* <b>Directory buckets</b> - For example, to copy objects to a directory bucket named
* <code>destinationBucket</code> in the Availability Zone; identified by the AZ ID <code>usw2-az1</code>, set the <code>TargetResource</code> property to
* <code>arn:aws:s3express:<i>region</i>:<i>account_id</i>:/bucket/<i>destination_bucket_base_name</i>--<i>usw2-az1</i>--x-s3</code>.</p>
* <code>destinationBucket</code> in the Availability Zone identified by the AZ ID <code>usw2-az1</code>, set the <code>TargetResource</code> property to
* <code>arn:aws:s3express:<i>region</i>:<i>account_id</i>:/bucket/<i>destination_bucket_base_name</i>--<i>usw2-az1</i>--x-s3</code>. A directory bucket as a destination bucket can be in Availability Zone or Local Zone. </p>
* <note>
* <p>Copying objects across different Amazon Web Services Regions isn't supported when the source or destination bucket is in Amazon Web Services Local Zones. The source and destination buckets must have the same parent Amazon Web Services Region. Otherwise,
* you get an HTTP <code>400 Bad Request</code> error with the error code <code>InvalidRequest</code>.</p>
* </note>
* </li>
* </ul>
* @public
Expand Down Expand Up @@ -2729,9 +2733,17 @@ export interface S3CopyObjectOperation {
UnModifiedSinceConstraint?: Date | undefined;

/**
* <p></p>
* <p>Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. If the KMS key doesn't exist in the same
* account that's issuing the command, you must use the full Key ARN not the Key ID.</p>
* <note>
* <p>This functionality is not supported by directory buckets.</p>
* <p>
* <b>Directory buckets</b> - If you specify <code>SSEAlgorithm</code> with <code>KMS</code>, you must specify the <code>
* SSEAwsKmsKeyId</code> parameter with the ID (Key ID or Key ARN) of the KMS
* symmetric encryption customer managed key to use. Otherwise, you get an HTTP <code>400 Bad Request</code> error. The key alias format of the KMS key isn't supported. To encrypt new object copies in a directory bucket with SSE-KMS, you must specify SSE-KMS as the directory bucket's default encryption configuration with a KMS key (specifically, a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>).
* The <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a> (<code>aws/s3</code>) isn't supported. Your SSE-KMS configuration can only support 1 <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a> per directory bucket for the lifetime of the bucket.
* After you specify a customer managed key for SSE-KMS as the bucket default encryption, you can't override the customer managed key for the bucket's SSE-KMS configuration.
* Then, when you specify server-side encryption settings for new object copies with SSE-KMS, you must make sure the encryption key is the same customer managed key that you specified for the directory bucket's default encryption configuration.
* </p>
* </note>
* @public
*/
Expand Down Expand Up @@ -2785,10 +2797,12 @@ export interface S3CopyObjectOperation {
* <p>Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with
* server-side encryption using Amazon Web Services KMS (SSE-KMS). Setting this header to <code>true</code>
* causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS.</p>
* <p>Specifying this header with an <i>object</i> action doesn’t affect
* <p>Specifying this header with an <i>Copy</i> action doesn’t affect
* <i>bucket-level</i> settings for S3 Bucket Key.</p>
* <note>
* <p>This functionality is not supported by directory buckets.</p>
* <p>
* <b>Directory buckets</b> - S3 Bucket Keys aren't supported, when you copy SSE-KMS encrypted objects from general purpose buckets
* to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops">the Copy operation in Batch Operations</a>. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.</p>
* </note>
* @public
*/
Expand Down Expand Up @@ -3128,7 +3142,7 @@ export interface CreateJobRequest {

/**
* <p>The action that you want this job to perform on every object listed in the manifest. For
* more information about the available actions, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-actions.html">Operations</a> in the
* more information about the available actions, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-operations.html">Operations</a> in the
* <i>Amazon S3 User Guide</i>.</p>
* @public
*/
Expand Down
12 changes: 6 additions & 6 deletions codegen/sdk-codegen/aws-models/s3-control.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7913,7 +7913,7 @@
"Operation": {
"target": "com.amazonaws.s3control#JobOperation",
"traits": {
"smithy.api#documentation": "<p>The action that you want this job to perform on every object listed in the manifest. For\n more information about the available actions, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-actions.html\">Operations</a> in the\n <i>Amazon S3 User Guide</i>.</p>",
"smithy.api#documentation": "<p>The action that you want this job to perform on every object listed in the manifest. For\n more information about the available actions, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-operations.html\">Operations</a> in the\n <i>Amazon S3 User Guide</i>.</p>",
"smithy.api#required": {}
}
},
Expand Down Expand Up @@ -13748,7 +13748,7 @@
"target": "com.amazonaws.s3control#ListCallerAccessGrantsResult"
},
"traits": {
"smithy.api#documentation": "<p>Returns a list of the access grants that were given to the caller using S3 Access Grants and that allow the caller to access the S3 data of the Amazon Web Services account specified in the request.</p>\n <dl>\n <dt>Permissions</dt>\n <dd>\n <p>You must have the <code>s3:ListCallerAccessGrants</code> permission to use this operation. </p>\n </dd>\n </dl>",
"smithy.api#documentation": "<p>Use this API to list the access grants that grant the caller access to Amazon S3 data through S3 Access Grants. The caller (grantee) can be an Identity and Access Management (IAM) identity or Amazon Web Services Identity Center corporate directory identity. You must pass the Amazon Web Services account of the S3 data owner (grantor) in the request. You can, optionally, narrow the results by <code>GrantScope</code>, using a fragment of the data's S3 path, and S3 Access Grants will return only the grants with a path that contains the path fragment. You can also pass the <code>AllowedByApplication</code> filter in the request, which returns only the grants authorized for applications, whether the application is the caller's Identity Center application or any other application (<code>ALL</code>). For more information, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-list-grants.html\">List the caller's access grants</a> in the <i>Amazon S3 User Guide</i>.</p>\n <dl>\n <dt>Permissions</dt>\n <dd>\n <p>You must have the <code>s3:ListCallerAccessGrants</code> permission to use this operation. </p>\n </dd>\n </dl>",
"smithy.api#endpoint": {
"hostPrefix": "{AccountId}."
},
Expand Down Expand Up @@ -17275,7 +17275,7 @@
"TargetResource": {
"target": "com.amazonaws.s3control#S3RegionalOrS3ExpressBucketArnString",
"traits": {
"smithy.api#documentation": "<p>Specifies the destination bucket\n Amazon Resource Name\n (ARN)\n for the batch copy operation.</p>\n <ul>\n <li>\n <p>\n <b>General purpose buckets</b> - For example, to copy objects to a general purpose bucket named\n <code>destinationBucket</code>, set the <code>TargetResource</code> property to\n <code>arn:aws:s3:::destinationBucket</code>.</p>\n </li>\n <li>\n <p>\n <b>Directory buckets</b> - For example, to copy objects to a directory bucket named\n <code>destinationBucket</code> in the Availability Zone; identified by the AZ ID <code>usw2-az1</code>, set the <code>TargetResource</code> property to\n <code>arn:aws:s3express:<i>region</i>:<i>account_id</i>:/bucket/<i>destination_bucket_base_name</i>--<i>usw2-az1</i>--x-s3</code>.</p>\n </li>\n </ul>"
"smithy.api#documentation": "<p>Specifies the destination bucket\n Amazon Resource Name\n (ARN)\n for the batch copy operation.</p>\n <ul>\n <li>\n <p>\n <b>General purpose buckets</b> - For example, to copy objects to a general purpose bucket named\n <code>destinationBucket</code>, set the <code>TargetResource</code> property to\n <code>arn:aws:s3:::destinationBucket</code>.</p>\n </li>\n <li>\n <p>\n <b>Directory buckets</b> - For example, to copy objects to a directory bucket named\n <code>destinationBucket</code> in the Availability Zone identified by the AZ ID <code>usw2-az1</code>, set the <code>TargetResource</code> property to\n <code>arn:aws:s3express:<i>region</i>:<i>account_id</i>:/bucket/<i>destination_bucket_base_name</i>--<i>usw2-az1</i>--x-s3</code>. A directory bucket as a destination bucket can be in Availability Zone or Local Zone. </p>\n <note>\n <p>Copying objects across different Amazon Web Services Regions isn't supported when the source or destination bucket is in Amazon Web Services Local Zones. The source and destination buckets must have the same parent Amazon Web Services Region. Otherwise, \n you get an HTTP <code>400 Bad Request</code> error with the error code <code>InvalidRequest</code>.</p>\n </note>\n </li>\n </ul>"
}
},
"CannedAccessControlList": {
Expand Down Expand Up @@ -17342,7 +17342,7 @@
"SSEAwsKmsKeyId": {
"target": "com.amazonaws.s3control#KmsKeyArnString",
"traits": {
"smithy.api#documentation": "<p></p>\n <note>\n <p>This functionality is not supported by directory buckets.</p>\n </note>"
"smithy.api#documentation": "<p>Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. If the KMS key doesn't exist in the same\n account that's issuing the command, you must use the full Key ARN not the Key ID.</p>\n <note>\n <p>\n <b>Directory buckets</b> - If you specify <code>SSEAlgorithm</code> with <code>KMS</code>, you must specify the <code>\n SSEAwsKmsKeyId</code> parameter with the ID (Key ID or Key ARN) of the KMS \n symmetric encryption customer managed key to use. Otherwise, you get an HTTP <code>400 Bad Request</code> error. The key alias format of the KMS key isn't supported. To encrypt new object copies in a directory bucket with SSE-KMS, you must specify SSE-KMS as the directory bucket's default encryption configuration with a KMS key (specifically, a <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk\">customer managed key</a>). \n The <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk\">Amazon Web Services managed key</a> (<code>aws/s3</code>) isn't supported. Your SSE-KMS configuration can only support 1 <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk\">customer managed key</a> per directory bucket for the lifetime of the bucket. \nAfter you specify a customer managed key for SSE-KMS as the bucket default encryption, you can't override the customer managed key for the bucket's SSE-KMS configuration. \nThen, when you specify server-side encryption settings for new object copies with SSE-KMS, you must make sure the encryption key is the same customer managed key that you specified for the directory bucket's default encryption configuration. \n </p>\n </note>"
}
},
"TargetKeyPrefix": {
Expand Down Expand Up @@ -17373,7 +17373,7 @@
"target": "com.amazonaws.s3control#Boolean",
"traits": {
"smithy.api#default": false,
"smithy.api#documentation": "<p>Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with\n server-side encryption using Amazon Web Services KMS (SSE-KMS). Setting this header to <code>true</code>\n causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS.</p>\n <p>Specifying this header with an <i>object</i> action doesn’t affect\n <i>bucket-level</i> settings for S3 Bucket Key.</p>\n <note>\n <p>This functionality is not supported by directory buckets.</p>\n </note>"
"smithy.api#documentation": "<p>Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with\n server-side encryption using Amazon Web Services KMS (SSE-KMS). Setting this header to <code>true</code>\n causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS.</p>\n <p>Specifying this header with an <i>Copy</i> action doesn’t affect\n <i>bucket-level</i> settings for S3 Bucket Key.</p>\n <note>\n <p>\n <b>Directory buckets</b> - S3 Bucket Keys aren't supported, when you copy SSE-KMS encrypted objects from general purpose buckets \nto directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops\">the Copy operation in Batch Operations</a>. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.</p>\n </note>"
}
},
"ChecksumAlgorithm": {
Expand Down Expand Up @@ -17775,7 +17775,7 @@
"SSEAlgorithm": {
"target": "com.amazonaws.s3control#S3SSEAlgorithm",
"traits": {
"smithy.api#documentation": "<p></p>\n <note>\n <p>For directory buckets, only the server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) is supported.</p>\n </note>"
"smithy.api#documentation": "<p>The server-side encryption algorithm used when storing objects in Amazon S3.</p>\n <p>\n <b>Directory buckets </b> - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (<code>AES256</code>) and server-side encryption with KMS keys (SSE-KMS) (<code>KMS</code>). For more\n information, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-serv-side-encryption.html\">Protecting data with server-side encryption</a> in the <i>Amazon S3 User Guide</i>. For <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops\">the Copy operation in Batch Operations</a>, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_S3CopyObjectOperation.html\">S3CopyObjectOperation</a>.</p>"
}
}
},
Expand Down

0 comments on commit f1a56b4

Please sign in to comment.