/**
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
* SPDX-License-Identifier: Apache-2.0.
*/
#pragma once
#include This action aborts a multipart upload. After a multipart upload is aborted,
* no additional parts can be uploaded using that upload ID. The storage consumed
* by any previously uploaded parts will be freed. However, if any part uploads are
* currently in progress, those part uploads might or might not succeed. As a
* result, it might be necessary to abort a given multipart upload multiple times
* in order to completely free all storage consumed by all parts. To verify
* that all parts have been removed, so you don't get charged for the part storage,
* you should call the ListParts
* action and ensure that the parts list is empty. For information about
* permissions required to use the multipart upload, see Multipart
* Upload and Permissions. The following operations are related to
* AbortMultipartUpload
:See Also:
AWS
* API Reference
Completes a multipart upload by assembling previously uploaded parts.
*You first initiate the multipart upload and then upload all parts using the
* UploadPart
* operation. After successfully uploading all relevant parts of an upload, you
* call this action to complete the upload. Upon receiving this request, Amazon S3
* concatenates all the parts in ascending order by part number to create a new
* object. In the Complete Multipart Upload request, you must provide the parts
* list. You must ensure that the parts list is complete. This action concatenates
* the parts that you provide in the list. For each part in the list, you must
* provide the part number and the ETag
value, returned after that
* part was uploaded.
Processing of a Complete Multipart Upload request * could take several minutes to complete. After Amazon S3 begins processing the * request, it sends an HTTP response header that specifies a 200 OK response. * While processing is in progress, Amazon S3 periodically sends white space * characters to keep the connection from timing out. Because a request could fail * after the initial 200 OK response has been sent, it is important that you check * the response body to determine whether the request succeeded.
Note that
* if CompleteMultipartUpload
fails, applications should be prepared
* to retry the failed requests. For more information, see Amazon
* S3 Error Best Practices.
You cannot use
* Content-Type: application/x-www-form-urlencoded
with Complete
* Multipart Upload requests. Also, if you do not provide a
* Content-Type
header, CompleteMultipartUpload
returns a
* 200 OK response.
For more information about multipart * uploads, see Uploading * Objects Using Multipart Upload.
For information about permissions * required to use the multipart upload API, see Multipart * Upload and Permissions.
CompleteMultipartUpload
has the
* following special errors:
Error code:
* EntityTooSmall
Description: Your proposed upload * is smaller than the minimum allowed object size. Each part must be at least 5 MB * in size, except the last part.
400 Bad Request
Error code: InvalidPart
Description: One or more of the specified parts could not be found. The part * might not have been uploaded, or the specified entity tag might not have matched * the part's entity tag.
400 Bad Request
Error code: InvalidPartOrder
Description: * The list of parts was not in ascending order. The parts list must be specified * in order by part number.
400 Bad Request
Error code: NoSuchUpload
Description: The * specified multipart upload does not exist. The upload ID might be invalid, or * the multipart upload might have been aborted or completed.
404 * Not Found
The following operations are related to
* CompleteMultipartUpload
:
Creates a copy of an object that is already stored in Amazon S3.
*You can store individual objects of up to 5 TB in Amazon S3. You create a * copy of your object up to 5 GB in size in a single atomic action using this API. * However, to copy an object greater than 5 GB, you must use the multipart upload * Upload Part - Copy (UploadPartCopy) API. For more information, see Copy * Object Using the REST Multipart Upload API.
All copy requests * must be authenticated. Additionally, you must have read access to the * source object and write access to the destination bucket. For more * information, see REST * Authentication. Both the Region that you want to copy the object from and * the Region that you want to copy the object to must be enabled for your * account.
A copy request might return an error when Amazon S3 receives the
* copy request or while Amazon S3 is copying the files. If the error occurs before
* the copy action starts, you receive a standard Amazon S3 error. If the error
* occurs during the copy operation, the error response is embedded in the
* 200 OK
response. This means that a 200 OK
response can
* contain either a success or an error. Design your application to parse the
* contents of the response and handle it appropriately.
If the copy is * successful, you receive a response with information about the copied object.
*If the request is an HTTP 1.1 request, the response is chunk encoded. * If it were not, it would not contain the content-length, and you would need to * read the entire body.
The copy request charge is based on the * storage class and Region that you specify for the destination object. For * pricing information, see Amazon S3 * pricing.
Amazon S3 transfer acceleration does not support
* cross-Region copies. If you request a cross-Region copy using a transfer
* acceleration endpoint, you get a 400 Bad Request
error. For more
* information, see Transfer
* Acceleration.
Metadata
When copying an * object, you can preserve all metadata (default) or specify new metadata. * However, the ACL is not preserved and is set to private for the user making the * request. To override the default ACL setting, specify a new ACL when generating * a copy request. For more information, see Using * ACLs.
To specify whether you want the object metadata copied from
* the source object or replaced with metadata provided in the request, you can
* optionally add the x-amz-metadata-directive
header. When you grant
* permissions, you can use the s3:x-amz-metadata-directive
condition
* key to enforce certain metadata behavior when objects are uploaded. For more
* information, see Specifying
* Conditions in a Policy in the Amazon S3 User Guide. For a complete
* list of Amazon S3-specific condition keys, see Actions,
* Resources, and Condition Keys for Amazon S3.
x-amz-copy-source-if * Headers
To only copy an object under certain conditions, such as
* whether the Etag
matches or whether the object was modified before
* or after a specified date, use the following request parameters:
x-amz-copy-source-if-match
* x-amz-copy-source-if-none-match
* x-amz-copy-source-if-unmodified-since
* x-amz-copy-source-if-modified-since
If both
* the x-amz-copy-source-if-match
and
* x-amz-copy-source-if-unmodified-since
headers are present in the
* request and evaluate as follows, Amazon S3 returns 200 OK
and
* copies the data:
x-amz-copy-source-if-match
* condition evaluates to true
* x-amz-copy-source-if-unmodified-since
condition evaluates to
* false
If both the
* x-amz-copy-source-if-none-match
and
* x-amz-copy-source-if-modified-since
headers are present in the
* request and evaluate as follows, Amazon S3 returns the 412 Precondition
* Failed
response code:
* x-amz-copy-source-if-none-match
condition evaluates to false
x-amz-copy-source-if-modified-since
condition
* evaluates to true
All headers with the
* x-amz-
prefix, including x-amz-copy-source
, must be
* signed.
Server-side encryption
When you perform a * CopyObject operation, you can optionally use the appropriate encryption-related * headers to encrypt the object using server-side encryption with Amazon Web * Services managed encryption keys (SSE-S3 or SSE-KMS) or a customer-provided * encryption key. With server-side encryption, Amazon S3 encrypts your data as it * writes it to disks in its data centers and decrypts the data when you access it. * For more information about server-side encryption, see Using * Server-Side Encryption.
If a target object uses SSE-KMS, you can * enable an S3 Bucket Key for the object. For more information, see Amazon S3 * Bucket Keys in the Amazon S3 User Guide.
Access Control * List (ACL)-Specific Request Headers
When copying an object, you can * optionally use headers to grant ACL-based permissions. By default, all objects * are private. Only the owner has full access control. When adding a new object, * you can grant permissions to individual Amazon Web Services accounts or to * predefined groups defined by Amazon S3. These permissions are then added to the * ACL on the object. For more information, see Access * Control List (ACL) Overview and Managing * ACLs Using the REST API.
If the bucket that you're copying objects
* to uses the bucket owner enforced setting for S3 Object Ownership, ACLs are
* disabled and no longer affect permissions. Buckets that use this setting only
* accept PUT requests that don't specify an ACL or PUT requests that specify
* bucket owner full control ACLs, such as the
* bucket-owner-full-control
canned ACL or an equivalent form of this
* ACL expressed in the XML format.
For more information, see * Controlling ownership of objects and disabling ACLs in the Amazon S3 User * Guide.
If your bucket uses the bucket owner enforced setting * for Object Ownership, all objects written to the bucket by any account will be * owned by the bucket owner.
Checksums
When copying
* an object, if it has a checksum, that checksum will be copied to the new object
* by default. When you copy the object over, you may optionally specify a
* different checksum algorithm to use with the
* x-amz-checksum-algorithm
header.
Storage Class * Options
You can use the CopyObject
action to change the
* storage class of an object that is already stored in Amazon S3 using the
* StorageClass
parameter. For more information, see Storage
* Classes in the Amazon S3 User Guide.
Versioning
*By default, x-amz-copy-source
identifies the current version of
* an object to copy. If the current version is a delete marker, Amazon S3 behaves
* as if the object was deleted. To copy a different version, use the
* versionId
subresource.
If you enable versioning on the
* target bucket, Amazon S3 generates a unique version ID for the object being
* copied. This version ID is different from the version ID of the source object.
* Amazon S3 returns the version ID of the copied object in the
* x-amz-version-id
response header in the response.
If you do * not enable versioning or suspend it on the target bucket, the version ID that * Amazon S3 generates is always null.
If the source object's storage class * is GLACIER, you must restore a copy of this object before you can use it as a * source object for the copy operation. For more information, see RestoreObject.
*The following operations are related to CopyObject
:
For more information, see Copying * Objects.
Creates a new S3 bucket. To create a bucket, you must register with Amazon S3 * and have a valid Amazon Web Services Access Key ID to authenticate requests. * Anonymous requests are never allowed to create buckets. By creating the bucket, * you become the bucket owner.
Not every string is an acceptable bucket * name. For information about bucket naming restrictions, see Bucket * naming rules.
If you want to create an Amazon S3 on Outposts bucket, * see Create * Bucket.
By default, the bucket is created in the US East (N. * Virginia) Region. You can optionally specify a Region in the request body. You * might choose a Region to optimize latency, minimize costs, or address regulatory * requirements. For example, if you reside in Europe, you will probably find it * advantageous to create buckets in the Europe (Ireland) Region. For more * information, see Accessing * a bucket.
If you send your create bucket request to the
* s3.amazonaws.com
endpoint, the request goes to the us-east-1
* Region. Accordingly, the signature calculations in Signature Version 4 must use
* us-east-1 as the Region, even if the location constraint in the request
* specifies another Region where the bucket is to be created. If you create a
* bucket in a Region other than US East (N. Virginia), your application must be
* able to handle 307 redirect. For more information, see Virtual
* hosting of buckets.
Access control lists (ACLs)
*When creating a bucket using this operation, you can optionally configure the * bucket ACL to specify the accounts or groups that should be granted specific * permissions on the bucket.
If your CreateBucket request sets
* bucket owner enforced for S3 Object Ownership and specifies a bucket ACL that
* provides access to an external Amazon Web Services account, your request fails
* with a 400
error and returns the
* InvalidBucketAclWithObjectOwnership
error code. For more
* information, see Controlling
* object ownership in the Amazon S3 User Guide.
There are two ways to grant the appropriate permissions using the request * headers.
Specify a canned ACL using the x-amz-acl
* request header. Amazon S3 supports a set of predefined ACLs, known as canned
* ACLs. Each canned ACL has a predefined set of grantees and permissions. For
* more information, see Canned
* ACL.
Specify access permissions explicitly using the
* x-amz-grant-read
, x-amz-grant-write
,
* x-amz-grant-read-acp
, x-amz-grant-write-acp
, and
* x-amz-grant-full-control
headers. These headers map to the set of
* permissions Amazon S3 supports in an ACL. For more information, see Access
* control list (ACL) overview.
You specify each grantee as a type=value * pair, where the type is one of the following:
id
* – if the value specified is the canonical user ID of an Amazon Web Services
* account
uri
– if you are granting permissions to
* a predefined group
emailAddress
– if the value
* specified is the email address of an Amazon Web Services account
Using email addresses to specify a grantee is only supported in the following * Amazon Web Services Regions:
US East (N. Virginia)
US West (N. California)
US West (Oregon)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
*Asia Pacific (Tokyo)
Europe (Ireland)
South America (São Paulo)
For a list of all the * Amazon S3 supported Regions and endpoints, see Regions * and Endpoints in the Amazon Web Services General Reference.
*For example, the following x-amz-grant-read
header
* grants the Amazon Web Services accounts identified by account IDs permissions to
* read object data and its metadata:
x-amz-grant-read:
* id="11112222333", id="444455556666"
You can * use either a canned ACL or specify access permissions explicitly. You cannot do * both.
Permissions
In addition to
* s3:CreateBucket
, the following permissions are required when your
* CreateBucket includes specific headers:
ACLs - If your
* CreateBucket
request specifies ACL permissions and the ACL is
* public-read, public-read-write, authenticated-read, or if you specify access
* permissions explicitly through any other ACL, both s3:CreateBucket
* and s3:PutBucketAcl
permissions are needed. If the ACL the
* CreateBucket
request is private or doesn't specify any ACLs, only
* s3:CreateBucket
permission is needed.
Object
* Lock - If ObjectLockEnabledForBucket
is set to true in your
* CreateBucket
request,
* s3:PutBucketObjectLockConfiguration
and
* s3:PutBucketVersioning
permissions are required.
* S3 Object Ownership - If your CreateBucket request includes the the
* x-amz-object-ownership
header,
* s3:PutBucketOwnershipControls
permission is required.
The following operations are related to CreateBucket
:
This action initiates a multipart upload and returns an upload ID. This * upload ID is used to associate all of the parts in the specific multipart * upload. You specify this upload ID in each of your subsequent upload part * requests (see UploadPart). * You also include this upload ID in the final request to either complete or abort * the multipart upload request.
For more information about multipart * uploads, see Multipart * Upload Overview.
If you have configured a lifecycle rule to abort * incomplete multipart uploads, the upload must complete within the number of days * specified in the bucket lifecycle configuration. Otherwise, the incomplete * multipart upload becomes eligible for an abort action and Amazon S3 aborts the * multipart upload. For more information, see Aborting * Incomplete Multipart Uploads Using a Bucket Lifecycle Policy.
For * information about the permissions required to use the multipart upload API, see * Multipart * Upload and Permissions.
For request signing, multipart upload is just * a series of regular requests. You initiate a multipart upload, send one or more * requests to upload parts, and then complete the multipart upload process. You * sign each request individually. There is nothing special about signing multipart * upload requests. For more information about signing, see Authenticating * Requests (Amazon Web Services Signature Version 4).
After you * initiate a multipart upload and upload one or more parts, to stop being charged * for storing the uploaded parts, you must either complete or abort the multipart * upload. Amazon S3 frees up the space used to store the parts and stop charging * you for storing them only after you either complete or abort a multipart upload. *
You can optionally request server-side encryption. For
* server-side encryption, Amazon S3 encrypts your data as it writes it to disks in
* its data centers and decrypts it when you access it. You can provide your own
* encryption key, or use Amazon Web Services KMS keys or Amazon S3-managed
* encryption keys. If you choose to provide your own encryption key, the request
* headers you provide in UploadPart
* and UploadPartCopy
* requests must match the headers you used in the request to initiate the upload
* by using CreateMultipartUpload
.
To perform a multipart
* upload with encryption using an Amazon Web Services KMS key, the requester must
* have permission to the kms:Decrypt
and
* kms:GenerateDataKey*
actions on the key. These permissions are
* required because Amazon S3 must decrypt and read data from the encrypted file
* parts before it completes the multipart upload. For more information, see Multipart
* upload API and permissions in the Amazon S3 User Guide.
If * your Identity and Access Management (IAM) user or role is in the same Amazon Web * Services account as the KMS key, then you must have these permissions on the key * policy. If your IAM user or role belongs to a different account than the key, * then you must have the permissions on both the key policy and your IAM user or * role.
For more information, see Protecting * Data Using Server-Side Encryption.
When copying an object, you can optionally specify the accounts or groups * that should be granted specific permissions on the new object. There are two * ways to grant the permissions using the request headers:
Specify a canned ACL with the x-amz-acl
request header. For more
* information, see Canned
* ACL.
Specify access permissions explicitly with the
* x-amz-grant-read
, x-amz-grant-read-acp
,
* x-amz-grant-write-acp
, and x-amz-grant-full-control
* headers. These parameters map to the set of permissions that Amazon S3 supports
* in an ACL. For more information, see Access
* Control List (ACL) Overview.
You can use either a canned * ACL or specify access permissions explicitly. You cannot do both.
You can * optionally tell Amazon S3 to encrypt data at rest using server-side encryption. * Server-side encryption is for data encryption at rest. Amazon S3 encrypts your * data as it writes it to disks in its data centers and decrypts it when you * access it. The option you use depends on whether you want to use Amazon Web * Services managed encryption keys or provide your own encryption key.
Use encryption keys managed by Amazon S3 or customer managed key stored * in Amazon Web Services Key Management Service (Amazon Web Services KMS) – If you * want Amazon Web Services to manage the keys used to encrypt data, specify the * following headers in the request.
* x-amz-server-side-encryption
* x-amz-server-side-encryption-aws-kms-key-id
* x-amz-server-side-encryption-context
If
* you specify x-amz-server-side-encryption:aws:kms
, but don't provide
* x-amz-server-side-encryption-aws-kms-key-id
, Amazon S3 uses the
* Amazon Web Services managed key in Amazon Web Services KMS to protect the
* data.
All GET and PUT requests for an object * protected by Amazon Web Services KMS fail if you don't make them with SSL or by * using SigV4.
For more information about server-side * encryption with KMS key (SSE-KMS), see Protecting * Data Using Server-Side Encryption with KMS keys.
Use * customer-provided encryption keys – If you want to manage your own encryption * keys, provide all the following headers in the request.
* x-amz-server-side-encryption-customer-algorithm
* x-amz-server-side-encryption-customer-key
* x-amz-server-side-encryption-customer-key-MD5
For more information about server-side encryption with KMS keys (SSE-KMS), * see Protecting * Data Using Server-Side Encryption with KMS keys.
You also can * use the following access control–related headers with this operation. By * default, all objects are private. Only the owner has full access control. When * adding a new object, you can grant permissions to individual Amazon Web Services * accounts or to predefined groups defined by Amazon S3. These permissions are * then added to the access control list (ACL) on the object. For more information, * see Using * ACLs. With this operation, you can grant access permissions using one of the * following two methods:
Specify a canned ACL
* (x-amz-acl
) — Amazon S3 supports a set of predefined ACLs, known as
* canned ACLs. Each canned ACL has a predefined set of grantees and
* permissions. For more information, see Canned
* ACL.
Specify access permissions explicitly — To explicitly * grant access permissions to specific Amazon Web Services accounts or groups, use * the following headers. Each header maps to specific permissions that Amazon S3 * supports in an ACL. For more information, see Access * Control List (ACL) Overview. In the header, you specify a list of grantees * who get the specific permission. To grant permissions explicitly, use:
x-amz-grant-read
* x-amz-grant-write
* x-amz-grant-read-acp
* x-amz-grant-write-acp
* x-amz-grant-full-control
You specify each * grantee as a type=value pair, where the type is one of the following:
id
– if the value specified is the canonical user ID of an
* Amazon Web Services account
uri
– if you are
* granting permissions to a predefined group
* emailAddress
– if the value specified is the email address of an
* Amazon Web Services account
Using email addresses to specify a * grantee is only supported in the following Amazon Web Services Regions:
*US East (N. Virginia)
US West (N. California)
*US West (Oregon)
Asia Pacific (Singapore)
*Asia Pacific (Sydney)
Asia Pacific (Tokyo)
*Europe (Ireland)
South America (São Paulo)
*For a list of all the Amazon S3 supported Regions and endpoints, * see Regions * and Endpoints in the Amazon Web Services General Reference.
*For example, the following x-amz-grant-read
header
* grants the Amazon Web Services accounts identified by account IDs permissions to
* read object data and its metadata:
x-amz-grant-read:
* id="11112222333", id="444455556666"
The
* following operations are related to CreateMultipartUpload
:
Deletes the S3 bucket. All objects (including all object versions and delete * markers) in the bucket must be deleted before the bucket itself can be * deleted.
Related Resources
Deletes an analytics configuration for the bucket (specified by the analytics * configuration ID).
To use this operation, you must have permissions to
* perform the s3:PutAnalyticsConfiguration
action. The bucket owner
* has this permission by default. The bucket owner can grant this permission to
* others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For information about * the Amazon S3 analytics feature, see Amazon * S3 Analytics – Storage Class Analysis.
The following operations are
* related to DeleteBucketAnalyticsConfiguration
:
Deletes the cors
configuration information set for the
* bucket.
To use this operation, you must have permission to perform the
* s3:PutBucketCORS
action. The bucket owner has this permission by
* default and can grant this permission to others.
For information about
* cors
, see Enabling
* Cross-Origin Resource Sharing in the Amazon S3 User Guide.
Related Resources:
This implementation of the DELETE action removes default encryption from the * bucket. For information about the Amazon S3 default encryption feature, see Amazon * S3 Default Bucket Encryption in the Amazon S3 User Guide.
To
* use this operation, you must have permissions to perform the
* s3:PutEncryptionConfiguration
action. The bucket owner has this
* permission by default. The bucket owner can grant this permission to others. For
* more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to your Amazon S3 Resources in the Amazon S3 User
* Guide.
Related Resources
Deletes the S3 Intelligent-Tiering configuration from the specified * bucket.
The S3 Intelligent-Tiering storage class is designed to optimize * storage costs by automatically moving data to the most cost-effective storage * access tier, without performance impact or operational overhead. S3 * Intelligent-Tiering delivers automatic cost savings in three low latency and * high throughput access tiers. To get the lowest storage cost on data that can be * accessed in minutes to hours, you can choose to activate additional archiving * capabilities.
The S3 Intelligent-Tiering storage class is the ideal * storage class for data with unknown, changing, or unpredictable access patterns, * independent of object size or retention period. If the size of an object is less * than 128 KB, it is not monitored and not eligible for auto-tiering. Smaller * objects can be stored, but they are always charged at the Frequent Access tier * rates in the S3 Intelligent-Tiering storage class.
For more information, * see Storage * class for automatically optimizing frequently and infrequently accessed * objects.
Operations related to
* DeleteBucketIntelligentTieringConfiguration
include:
Deletes an inventory configuration (identified by the inventory ID) from the * bucket.
To use this operation, you must have permissions to perform the
* s3:PutInventoryConfiguration
action. The bucket owner has this
* permission by default. The bucket owner can grant this permission to others. For
* more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For information about * the Amazon S3 inventory feature, see Amazon * S3 Inventory.
Operations related to
* DeleteBucketInventoryConfiguration
include:
Deletes the lifecycle configuration from the specified bucket. Amazon S3 * removes all the lifecycle configuration rules in the lifecycle subresource * associated with the bucket. Your objects never expire, and Amazon S3 no longer * automatically deletes any objects on the basis of rules contained in the deleted * lifecycle configuration.
To use this operation, you must have permission
* to perform the s3:PutLifecycleConfiguration
action. By default, the
* bucket owner has this permission and the bucket owner can grant this permission
* to others.
There is usually some time lag before lifecycle configuration * deletion is fully propagated to all the Amazon S3 systems.
For more * information about the object expiration, see Elements * to Describe Lifecycle Actions.
Related actions include:
Deletes a metrics configuration for the Amazon CloudWatch request metrics * (specified by the metrics configuration ID) from the bucket. Note that this * doesn't include the daily storage metrics.
To use this operation, you
* must have permissions to perform the s3:PutMetricsConfiguration
* action. The bucket owner has this permission by default. The bucket owner can
* grant this permission to others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For information about * CloudWatch request metrics for Amazon S3, see Monitoring * Metrics with Amazon CloudWatch.
The following operations are related
* to DeleteBucketMetricsConfiguration
:
Removes OwnershipControls
for an Amazon S3 bucket. To use this
* operation, you must have the s3:PutBucketOwnershipControls
* permission. For more information about Amazon S3 permissions, see Specifying
* Permissions in a Policy.
For information about Amazon S3 Object * Ownership, see Using * Object Ownership.
The following operations are related to
* DeleteBucketOwnershipControls
:
This implementation of the DELETE action uses the policy subresource to
* delete the policy of a specified bucket. If you are using an identity other than
* the root user of the Amazon Web Services account that owns the bucket, the
* calling identity must have the DeleteBucketPolicy
permissions on
* the specified bucket and belong to the bucket owner's account to use this
* operation.
If you don't have DeleteBucketPolicy
* permissions, Amazon S3 returns a 403 Access Denied
error. If you
* have the correct permissions, but you're not using an identity that belongs to
* the bucket owner's account, Amazon S3 returns a 405 Method Not
* Allowed
error.
As a security precaution, the root * user of the Amazon Web Services account that owns a bucket can always use this * operation, even if the policy explicitly denies the root user the ability to * perform this action.
For more information about bucket * policies, see Using * Bucket Policies and UserPolicies.
The following operations are
* related to DeleteBucketPolicy
Deletes the replication configuration from the bucket.
To use this
* operation, you must have permissions to perform the
* s3:PutReplicationConfiguration
action. The bucket owner has these
* permissions by default and can grant it to others. For more information about
* permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
It can take a * while for the deletion of a replication configuration to fully propagate.
*For information about replication configuration, see Replication * in the Amazon S3 User Guide.
The following operations are related
* to DeleteBucketReplication
:
Deletes the tags from the bucket.
To use this operation, you must have
* permission to perform the s3:PutBucketTagging
action. By default,
* the bucket owner has this permission and can grant this permission to others.
*
The following operations are related to
* DeleteBucketTagging
:
This action removes the website configuration for a bucket. Amazon S3 returns
* a 200 OK
response upon successfully deleting a website
* configuration on the specified bucket. You will get a 200 OK
* response if the website configuration you are trying to delete does not exist on
* the bucket. Amazon S3 returns a 404
response if the bucket
* specified in the request does not exist.
This DELETE action requires the
* S3:DeleteBucketWebsite
permission. By default, only the bucket
* owner can delete the website configuration attached to a bucket. However, bucket
* owners can grant other users permission to delete the website configuration by
* writing a bucket policy granting them the S3:DeleteBucketWebsite
* permission.
For more information about hosting websites, see Hosting * Websites on Amazon S3.
The following operations are related to
* DeleteBucketWebsite
:
Removes the null version (if there is one) of an object and inserts a delete * marker, which becomes the latest version of the object. If there isn't a null * version, Amazon S3 does not remove any objects but will still respond that the * command was successful.
To remove a specific version, you must be the
* bucket owner and you must use the version Id subresource. Using this subresource
* permanently deletes the version. If the object deleted is a delete marker,
* Amazon S3 sets the response header, x-amz-delete-marker
, to true.
*
If the object you want to delete is in a bucket where the bucket
* versioning configuration is MFA Delete enabled, you must include the
* x-amz-mfa
request header in the DELETE versionId
* request. Requests that include x-amz-mfa
must use HTTPS.
* For more information about MFA Delete, see Using * MFA Delete. To see sample requests that use versioning, see Sample * Request.
You can delete objects by explicitly calling DELETE Object
* or configure its lifecycle (PutBucketLifecycle)
* to enable Amazon S3 to remove them for you. If you want to block users or
* accounts from removing or deleting objects from your bucket, you must deny them
* the s3:DeleteObject
, s3:DeleteObjectVersion
, and
* s3:PutLifeCycleConfiguration
actions.
The following action
* is related to DeleteObject
:
Removes the entire tag set from the specified object. For more information * about managing object tags, see * Object Tagging.
To use this operation, you must have permission to
* perform the s3:DeleteObjectTagging
action.
To delete tags of
* a specific object version, add the versionId
query parameter in the
* request. You will need permission for the
* s3:DeleteObjectVersionTagging
action.
The following
* operations are related to DeleteBucketMetricsConfiguration
:
This action enables you to delete multiple objects from a bucket using a * single HTTP request. If you know the object keys that you want to delete, then * this action provides a suitable alternative to sending individual delete * requests, reducing per-request overhead.
The request contains a list of * up to 1000 keys that you want to delete. In the XML, you provide the object key * names, and optionally, version IDs if you want to delete a specific version of * the object from a versioning-enabled bucket. For each key, Amazon S3 performs a * delete action and returns the result of that delete, success, or failure, in the * response. Note that if the object specified in the request is not found, Amazon * S3 returns the result as deleted.
The action supports two modes for the * response: verbose and quiet. By default, the action uses verbose mode in which * the response includes the result of deletion of each key in your request. In * quiet mode the response includes only keys where the delete action encountered * an error. For a successful deletion, the action does not return any information * about the delete in the response body.
When performing this action on an * MFA Delete enabled bucket, that attempts to delete any versioned objects, you * must include an MFA token. If you do not provide one, the entire request will * fail, even if there are non-versioned objects you are trying to delete. If you * provide an invalid token, whether there are versioned keys in the request or * not, the entire Multi-Object Delete request will fail. For information about MFA * Delete, see * MFA Delete.
Finally, the Content-MD5 header is required for all * Multi-Object Delete requests. Amazon S3 uses the header value to ensure that * your request body has not been altered in transit.
The following
* operations are related to DeleteObjects
:
Removes the PublicAccessBlock
configuration for an Amazon S3
* bucket. To use this operation, you must have the
* s3:PutBucketPublicAccessBlock
permission. For more information
* about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
The following
* operations are related to DeletePublicAccessBlock
:
This implementation of the GET action uses the accelerate
* subresource to return the Transfer Acceleration state of a bucket, which is
* either Enabled
or Suspended
. Amazon S3 Transfer
* Acceleration is a bucket-level feature that enables you to perform faster data
* transfers to and from Amazon S3.
To use this operation, you must have
* permission to perform the s3:GetAccelerateConfiguration
action. The
* bucket owner has this permission by default. The bucket owner can grant this
* permission to others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to your Amazon S3 Resources in the Amazon S3 User
* Guide.
You set the Transfer Acceleration state of an existing bucket
* to Enabled
or Suspended
by using the PutBucketAccelerateConfiguration
* operation.
A GET accelerate
request does not return a state
* value for a bucket that has no transfer acceleration state. A bucket has no
* Transfer Acceleration state if a state has never been set on the bucket.
For more information about transfer acceleration, see Transfer * Acceleration in the Amazon S3 User Guide.
Related * Resources
This implementation of the GET
action uses the acl
* subresource to return the access control list (ACL) of a bucket. To use
* GET
to return the ACL of the bucket, you must have
* READ_ACP
access to the bucket. If READ_ACP
permission
* is granted to the anonymous user, you can return the ACL of the bucket without
* using an authorization header.
If your bucket uses the bucket
* owner enforced setting for S3 Object Ownership, requests to read ACLs are still
* supported and return the bucket-owner-full-control
ACL with the
* owner being the account that created the bucket. For more information, see
* Controlling object ownership and disabling ACLs in the Amazon S3 User
* Guide.
Related Resources
This implementation of the GET action returns an analytics configuration * (identified by the analytics configuration ID) from the bucket.
To use
* this operation, you must have permissions to perform the
* s3:GetAnalyticsConfiguration
action. The bucket owner has this
* permission by default. The bucket owner can grant this permission to others. For
* more information about permissions, see
* Permissions Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources in the Amazon S3 User
* Guide.
For information about Amazon S3 analytics feature, see Amazon * S3 Analytics – Storage Class Analysis in the Amazon S3 User * Guide.
Related Resources
Returns the Cross-Origin Resource Sharing (CORS) configuration information * set for the bucket.
To use this operation, you must have permission to
* perform the s3:GetBucketCORS
action. By default, the bucket owner
* has this permission and can grant it to others.
For more information * about CORS, see Enabling * Cross-Origin Resource Sharing.
The following operations are related
* to GetBucketCors
:
Returns the default encryption configuration for an Amazon S3 bucket. If the
* bucket does not have a default encryption configuration, GetBucketEncryption
* returns ServerSideEncryptionConfigurationNotFoundError
.
For * information about the Amazon S3 default encryption feature, see Amazon * S3 Default Bucket Encryption.
To use this operation, you must have
* permission to perform the s3:GetEncryptionConfiguration
action. The
* bucket owner has this permission by default. The bucket owner can grant this
* permission to others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
The following
* operations are related to GetBucketEncryption
:
Gets the S3 Intelligent-Tiering configuration from the specified bucket.
*The S3 Intelligent-Tiering storage class is designed to optimize storage * costs by automatically moving data to the most cost-effective storage access * tier, without performance impact or operational overhead. S3 Intelligent-Tiering * delivers automatic cost savings in three low latency and high throughput access * tiers. To get the lowest storage cost on data that can be accessed in minutes to * hours, you can choose to activate additional archiving capabilities.
The * S3 Intelligent-Tiering storage class is the ideal storage class for data with * unknown, changing, or unpredictable access patterns, independent of object size * or retention period. If the size of an object is less than 128 KB, it is not * monitored and not eligible for auto-tiering. Smaller objects can be stored, but * they are always charged at the Frequent Access tier rates in the S3 * Intelligent-Tiering storage class.
For more information, see Storage * class for automatically optimizing frequently and infrequently accessed * objects.
Operations related to
* GetBucketIntelligentTieringConfiguration
include:
Returns an inventory configuration (identified by the inventory configuration * ID) from the bucket.
To use this operation, you must have permissions to
* perform the s3:GetInventoryConfiguration
action. The bucket owner
* has this permission by default and can grant this permission to others. For more
* information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For information about * the Amazon S3 inventory feature, see Amazon * S3 Inventory.
The following operations are related to
* GetBucketInventoryConfiguration
:
Bucket lifecycle configuration now supports specifying a lifecycle * rule using an object key name prefix, one or more object tags, or a combination * of both. Accordingly, this section describes the latest API. The response * describes the new filter element that you can use to specify a filter to select * a subset of objects to which the rule applies. If you are using a previous * version of the lifecycle configuration, it still works. For the earlier action, * see GetBucketLifecycle.
*Returns the lifecycle configuration information set on the bucket. * For information about lifecycle configuration, see Object * Lifecycle Management.
To use this operation, you must have permission
* to perform the s3:GetLifecycleConfiguration
action. The bucket
* owner has this permission, by default. The bucket owner can grant this
* permission to others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
* GetBucketLifecycleConfiguration
has the following special
* error:
Error code: NoSuchLifecycleConfiguration
*
Description: The lifecycle configuration does not exist.
*HTTP Status Code: 404 Not Found
SOAP Fault Code * Prefix: Client
The following operations are
* related to GetBucketLifecycleConfiguration
:
Returns the Region the bucket resides in. You set the bucket's Region using
* the LocationConstraint
request parameter in a
* CreateBucket
request. For more information, see CreateBucket.
To use this implementation of the operation, you must be the bucket * owner.
To use this API against an access point, provide the alias of the * access point in place of the bucket name.
The following operations are
* related to GetBucketLocation
:
Returns the logging status of a bucket and the permissions users have to view * and modify that status. To use GET, you must be the bucket owner.
The
* following operations are related to GetBucketLogging
:
Gets a metrics configuration (specified by the metrics configuration ID) from * the bucket. Note that this doesn't include the daily storage metrics.
To
* use this operation, you must have permissions to perform the
* s3:GetMetricsConfiguration
action. The bucket owner has this
* permission by default. The bucket owner can grant this permission to others. For
* more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For information * about CloudWatch request metrics for Amazon S3, see Monitoring * Metrics with Amazon CloudWatch.
The following operations are related
* to GetBucketMetricsConfiguration
:
Returns the notification configuration of a bucket.
If notifications
* are not enabled on the bucket, the action returns an empty
* NotificationConfiguration
element.
By default, you must be
* the bucket owner to read the notification configuration of a bucket. However,
* the bucket owner can use a bucket policy to grant permission to other users to
* read this configuration with the s3:GetBucketNotification
* permission.
For more information about setting and reading the * notification configuration on a bucket, see Setting * Up Notification of Bucket Events. For more information about bucket * policies, see Using * Bucket Policies.
The following action is related to
* GetBucketNotification
:
Retrieves OwnershipControls
for an Amazon S3 bucket. To use this
* operation, you must have the s3:GetBucketOwnershipControls
* permission. For more information about Amazon S3 permissions, see Specifying
* permissions in a policy.
For information about Amazon S3 Object * Ownership, see Using * Object Ownership.
The following operations are related to
* GetBucketOwnershipControls
:
Returns the policy of a specified bucket. If you are using an identity other
* than the root user of the Amazon Web Services account that owns the bucket, the
* calling identity must have the GetBucketPolicy
permissions on the
* specified bucket and belong to the bucket owner's account in order to use this
* operation.
If you don't have GetBucketPolicy
permissions,
* Amazon S3 returns a 403 Access Denied
error. If you have the
* correct permissions, but you're not using an identity that belongs to the bucket
* owner's account, Amazon S3 returns a 405 Method Not Allowed
* error.
As a security precaution, the root user of the Amazon * Web Services account that owns a bucket can always use this operation, even if * the policy explicitly denies the root user the ability to perform this * action.
For more information about bucket policies, see Using * Bucket Policies and User Policies.
The following action is related to
* GetBucketPolicy
:
Retrieves the policy status for an Amazon S3 bucket, indicating whether the
* bucket is public. In order to use this operation, you must have the
* s3:GetBucketPolicyStatus
permission. For more information about
* Amazon S3 permissions, see Specifying
* Permissions in a Policy.
For more information about when Amazon S3 * considers a bucket public, see The * Meaning of "Public".
The following operations are related to
* GetBucketPolicyStatus
:
Returns the replication configuration of a bucket.
It can take * a while to propagate the put or delete a replication configuration to all Amazon * S3 systems. Therefore, a get request soon after put or delete can return a wrong * result.
For information about replication configuration, see Replication * in the Amazon S3 User Guide.
This action requires permissions for
* the s3:GetReplicationConfiguration
action. For more information
* about permissions, see Using
* Bucket Policies and User Policies.
If you include the
* Filter
element in a replication configuration, you must also
* include the DeleteMarkerReplication
and Priority
* elements. The response also returns those elements.
For information about
* GetBucketReplication
errors, see List
* of replication-related error codes
The following operations are
* related to GetBucketReplication
:
Returns the request payment configuration of a bucket. To use this version of * the operation, you must be the bucket owner. For more information, see Requester * Pays Buckets.
The following operations are related to
* GetBucketRequestPayment
:
Returns the tag set associated with the bucket.
To use this operation,
* you must have permission to perform the s3:GetBucketTagging
action.
* By default, the bucket owner has this permission and can grant this permission
* to others.
GetBucketTagging
has the following special
* error:
Error code: NoSuchTagSet
Description: There is no tag set associated with the bucket.
The following operations are related to
* GetBucketTagging
:
Returns the versioning state of a bucket.
To retrieve the versioning * state of a bucket, you must be the bucket owner.
This implementation also
* returns the MFA Delete status of the versioning state. If the MFA Delete status
* is enabled
, the bucket owner must use an authentication device to
* change the versioning state of the bucket.
The following operations are
* related to GetBucketVersioning
:
Returns the website configuration for a bucket. To host website on Amazon S3, * you can configure a bucket as website by adding a website configuration. For * more information about hosting websites, see Hosting * Websites on Amazon S3.
This GET action requires the
* S3:GetBucketWebsite
permission. By default, only the bucket owner
* can read the bucket website configuration. However, bucket owners can allow
* other users to read the website configuration by writing a bucket policy
* granting them the S3:GetBucketWebsite
permission.
The
* following operations are related to DeleteBucketWebsite
:
Retrieves objects from Amazon S3. To use GET
, you must have
* READ
access to the object. If you grant READ
access to
* the anonymous user, you can return the object without using an authorization
* header.
An Amazon S3 bucket has no directory hierarchy such as you would
* find in a typical computer file system. You can, however, create a logical
* hierarchy by using object key names that imply a folder structure. For example,
* instead of naming an object sample.jpg
, you can name it
* photos/2006/February/sample.jpg
.
To get an object from such
* a logical hierarchy, specify the full key name for the object in the
* GET
operation. For a virtual hosted-style request example, if you
* have the object photos/2006/February/sample.jpg
, specify the
* resource as /photos/2006/February/sample.jpg
. For a path-style
* request example, if you have the object
* photos/2006/February/sample.jpg
in the bucket named
* examplebucket
, specify the resource as
* /examplebucket/photos/2006/February/sample.jpg
. For more
* information about request types, see HTTP
* Host Header Bucket Specification.
For more information about * returning the ACL of an object, see GetObjectAcl.
*If the object you are retrieving is stored in the S3 Glacier or S3 Glacier
* Deep Archive storage class, or S3 Intelligent-Tiering Archive or S3
* Intelligent-Tiering Deep Archive tiers, before you can retrieve the object you
* must first restore a copy using RestoreObject.
* Otherwise, this action returns an InvalidObjectStateError
error.
* For information about restoring archived objects, see Restoring
* Archived Objects.
Encryption request headers, like
* x-amz-server-side-encryption
, should not be sent for GET requests
* if your object uses server-side encryption with KMS keys (SSE-KMS) or
* server-side encryption with Amazon S3–managed encryption keys (SSE-S3). If your
* object does use these types of keys, you’ll get an HTTP 400 BadRequest
* error.
If you encrypt an object by using server-side encryption with * customer-provided encryption keys (SSE-C) when you store the object in Amazon * S3, then when you GET the object, you must use the following headers:
x-amz-server-side-encryption-customer-algorithm
x-amz-server-side-encryption-customer-key
x-amz-server-side-encryption-customer-key-MD5
For more * information about SSE-C, see Server-Side * Encryption (Using Customer-Provided Encryption Keys).
Assuming you
* have the relevant permission to read object tags, the response also returns the
* x-amz-tagging-count
header that provides the count of number of
* tags associated with the object. You can use GetObjectTagging
* to retrieve the tag set associated with an object.
Permissions *
You need the relevant read object (or version) permission for this
* operation. For more information, see Specifying
* Permissions in a Policy. If the object you request does not exist, the error
* Amazon S3 returns depends on whether you also have the
* s3:ListBucket
permission.
If you have the
* s3:ListBucket
permission on the bucket, Amazon S3 will return an
* HTTP status code 404 ("no such key") error.
If you don’t have
* the s3:ListBucket
permission, Amazon S3 will return an HTTP status
* code 403 ("access denied") error.
Versioning
*By default, the GET action returns the current version of an object. To
* return a different version, use the versionId
subresource.
If you supply a versionId
, you need the
* s3:GetObjectVersion
permission to access a specific version of an
* object. If you request a specific version, you do not need to have the
* s3:GetObject
permission.
If the current version
* of the object is a delete marker, Amazon S3 behaves as if the object was deleted
* and includes x-amz-delete-marker: true
in the response.
For more information about versioning, see PutBucketVersioning. *
Overriding Response Header Values
There are times when
* you want to override certain response header values in a GET response. For
* example, you might override the Content-Disposition
response header
* value in your GET request.
You can override values for a set of response
* headers using the following query parameters. These response header values are
* sent only on a successful request, that is, when status code 200 OK is returned.
* The set of headers you can override using these parameters is a subset of the
* headers that Amazon S3 accepts when you create an object. The response headers
* that you can override for the GET response are Content-Type
,
* Content-Language
, Expires
, Cache-Control
,
* Content-Disposition
, and Content-Encoding
. To override
* these header values in the GET response, you use the following request
* parameters.
You must sign the request, either using an * Authorization header or a presigned URL, when using these parameters. They * cannot be used with an unsigned (anonymous) request.
* response-content-type
* response-content-language
* response-expires
* response-cache-control
* response-content-disposition
* response-content-encoding
Additional * Considerations about Request Headers
If both of the
* If-Match
and If-Unmodified-Since
headers are present
* in the request as follows: If-Match
condition evaluates to
* true
, and; If-Unmodified-Since
condition evaluates to
* false
; then, S3 returns 200 OK and the data requested.
If
* both of the If-None-Match
and If-Modified-Since
* headers are present in the request as follows: If-None-Match
* condition evaluates to false
, and; If-Modified-Since
* condition evaluates to true
; then, S3 returns 304 Not Modified
* response code.
For more information about conditional requests, see RFC 7232.
The following
* operations are related to GetObject
:
Returns the access control list (ACL) of an object. To use this operation,
* you must have s3:GetObjectAcl
permissions or READ_ACP
* access to the object. For more information, see Mapping
* of ACL permissions and access policy permissions in the Amazon S3 User
* Guide
This action is not supported by Amazon S3 on Outposts.
* Versioning
By default, GET returns ACL information about the * current version of an object. To return ACL information about a different * version, use the versionId subresource.
If your bucket uses the
* bucket owner enforced setting for S3 Object Ownership, requests to read ACLs are
* still supported and return the bucket-owner-full-control
ACL with
* the owner being the account that created the bucket. For more information, see
*
* Controlling object ownership and disabling ACLs in the Amazon S3 User
* Guide.
The following operations are related to
* GetObjectAcl
:
Retrieves all the metadata from an object without returning the object
* itself. This action is useful if you're interested only in an object's metadata.
* To use GetObjectAttributes
, you must have READ access to the
* object.
GetObjectAttributes
combines the functionality of
* GetObjectAcl
, GetObjectLegalHold
,
* GetObjectLockConfiguration
, GetObjectRetention
,
* GetObjectTagging
, HeadObject
, and
* ListParts
. All of the data returned with each of those individual
* calls can be returned with a single call to
* GetObjectAttributes
.
If you encrypt an object by using * server-side encryption with customer-provided encryption keys (SSE-C) when you * store the object in Amazon S3, then when you retrieve the metadata from the * object, you must use the following headers:
* x-amz-server-side-encryption-customer-algorithm
* x-amz-server-side-encryption-customer-key
* x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side * Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 * User Guide.
Encryption request headers, such as
* x-amz-server-side-encryption
, should not be sent for GET requests
* if your object uses server-side encryption with Amazon Web Services KMS keys
* stored in Amazon Web Services Key Management Service (SSE-KMS) or server-side
* encryption with Amazon S3 managed encryption keys (SSE-S3). If your object does
* use these types of keys, you'll get an HTTP 400 Bad Request
* error.
The last modified property in this case is the * creation date of the object.
Consider the following * when using request headers:
If both of the
* If-Match
and If-Unmodified-Since
headers are present
* in the request as follows, then Amazon S3 returns the HTTP status code 200
* OK
and the data requested:
If-Match
* condition evaluates to true
.
* If-Unmodified-Since
condition evaluates to false
.
If both of the If-None-Match
and
* If-Modified-Since
headers are present in the request as follows,
* then Amazon S3 returns the HTTP status code 304 Not Modified
:
If-None-Match
condition evaluates to
* false
.
If-Modified-Since
condition
* evaluates to true
.
For more * information about conditional requests, see RFC 7232.
* Permissions
The permissions that you need to use this operation
* depend on whether the bucket is versioned. If the bucket is versioned, you need
* both the s3:GetObjectVersion
and
* s3:GetObjectVersionAttributes
permissions for this operation. If
* the bucket is not versioned, you need the s3:GetObject
and
* s3:GetObjectAttributes
permissions. For more information, see Specifying
* Permissions in a Policy in the Amazon S3 User Guide. If the object
* that you request does not exist, the error Amazon S3 returns depends on whether
* you also have the s3:ListBucket
permission.
If you
* have the s3:ListBucket
permission on the bucket, Amazon S3 returns
* an HTTP status code 404 Not Found
("no such key") error.
If you don't have the s3:ListBucket
permission, Amazon S3
* returns an HTTP status code 403 Forbidden
("access denied")
* error.
The following actions are related to
* GetObjectAttributes
:
Gets an object's current legal hold status. For more information, see Locking * Objects.
This action is not supported by Amazon S3 on Outposts.
*The following action is related to GetObjectLegalHold
:
Gets the Object Lock configuration for a bucket. The rule specified in the * Object Lock configuration will be applied by default to every new object placed * in the specified bucket. For more information, see Locking * Objects.
The following action is related to
* GetObjectLockConfiguration
:
Retrieves an object's retention settings. For more information, see Locking * Objects.
This action is not supported by Amazon S3 on Outposts.
*The following action is related to GetObjectRetention
:
Returns the tag-set of an object. You send the GET request against the * tagging subresource associated with the object.
To use this operation,
* you must have permission to perform the s3:GetObjectTagging
action.
* By default, the GET action returns information about current version of an
* object. For a versioned bucket, you can have multiple versions of an object in
* your bucket. To retrieve tags of any other version, use the versionId query
* parameter. You also need permission for the
* s3:GetObjectVersionTagging
action.
By default, the bucket * owner has this permission and can grant this permission to others.
For * information about the Amazon S3 object tagging feature, see Object * Tagging.
The following actions are related to
* GetObjectTagging
:
Returns torrent files from a bucket. BitTorrent can save you bandwidth when * you're distributing large files. For more information about BitTorrent, see Using * BitTorrent with Amazon S3.
You can get torrent only for * objects that are less than 5 GB in size, and that are not encrypted using * server-side encryption with a customer-provided encryption key.
*To use GET, you must have READ access to the object.
This action is * not supported by Amazon S3 on Outposts.
The following action is related
* to GetObjectTorrent
:
Retrieves the PublicAccessBlock
configuration for an Amazon S3
* bucket. To use this operation, you must have the
* s3:GetBucketPublicAccessBlock
permission. For more information
* about Amazon S3 permissions, see Specifying
* Permissions in a Policy.
When Amazon S3 evaluates the
* PublicAccessBlock
configuration for a bucket or an object, it
* checks the PublicAccessBlock
configuration for both the bucket (or
* the bucket that contains the object) and the bucket owner's account. If the
* PublicAccessBlock
settings are different between the bucket and the
* account, Amazon S3 uses the most restrictive combination of the bucket-level and
* account-level settings.
For more information about when * Amazon S3 considers a bucket or an object public, see The * Meaning of "Public".
The following operations are related to
* GetPublicAccessBlock
:
This action is useful to determine if a bucket exists and you have permission
* to access it. The action returns a 200 OK
if the bucket exists and
* you have permission to access it.
If the bucket does not exist or you do
* not have permission to access it, the HEAD
request returns a
* generic 404 Not Found
or 403 Forbidden
code. A message
* body is not included, so you cannot determine the exception beyond these error
* codes.
To use this operation, you must have permissions to perform the
* s3:ListBucket
action. The bucket owner has this permission by
* default and can grant this permission to others. For more information about
* permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
To use this API * against an access point, you must provide the alias of the access point in place * of the bucket name or specify the access point ARN. When using the access point * ARN, you must direct requests to the access point hostname. The access point * hostname takes the form * AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com. When using the * Amazon Web Services SDKs, you provide the ARN in place of the bucket name. For * more information see, Using * access points.
The HEAD action retrieves metadata from an object without returning the * object itself. This action is useful if you're only interested in an object's * metadata. To use HEAD, you must have READ access to the object.
A
* HEAD
request has the same options as a GET
action on
* an object. The response is identical to the GET
response except
* that there is no response body. Because of this, if the HEAD
* request generates an error, it returns a generic 404 Not Found
or
* 403 Forbidden
code. It is not possible to retrieve the exact
* exception beyond these error codes.
If you encrypt an object by using * server-side encryption with customer-provided encryption keys (SSE-C) when you * store the object in Amazon S3, then when you retrieve the metadata from the * object, you must use the following headers:
x-amz-server-side-encryption-customer-algorithm
x-amz-server-side-encryption-customer-key
x-amz-server-side-encryption-customer-key-MD5
For more * information about SSE-C, see Server-Side * Encryption (Using Customer-Provided Encryption Keys).
Encryption request headers, like x-amz-server-side-encryption
,
* should not be sent for GET requests if your object uses server-side encryption
* with KMS keys (SSE-KMS) or server-side encryption with Amazon S3–managed
* encryption keys (SSE-S3). If your object does use these types of keys, you’ll
* get an HTTP 400 BadRequest error.
The last modified property * in this case is the creation date of the object.
Request headers are limited to 8 KB in size. For more information, see Common * Request Headers.
Consider the following when using request * headers:
Consideration 1 – If both of the
* If-Match
and If-Unmodified-Since
headers are present
* in the request as follows:
If-Match
condition
* evaluates to true
, and;
* If-Unmodified-Since
condition evaluates to false
;
Then Amazon S3 returns 200 OK
and the data
* requested.
Consideration 2 – If both of the
* If-None-Match
and If-Modified-Since
headers are
* present in the request as follows:
If-None-Match
* condition evaluates to false
, and;
* If-Modified-Since
condition evaluates to true
;
Then Amazon S3 returns the 304 Not Modified
response
* code.
For more information about conditional requests, see RFC 7232.
* Permissions
You need the relevant read object (or version) * permission for this operation. For more information, see Specifying * Permissions in a Policy. If the object you request does not exist, the error * Amazon S3 returns depends on whether you also have the s3:ListBucket * permission.
If you have the s3:ListBucket
* permission on the bucket, Amazon S3 returns an HTTP status code 404 ("no such
* key") error.
If you don’t have the s3:ListBucket
* permission, Amazon S3 returns an HTTP status code 403 ("access denied")
* error.
The following actions are related to
* HeadObject
:
Lists the analytics configurations for the bucket. You can have up to 1,000 * analytics configurations per bucket.
This action supports list pagination
* and does not return more than 100 configurations at a time. You should always
* check the IsTruncated
element in the response. If there are no more
* configurations to list, IsTruncated
is set to false. If there are
* more configurations to list, IsTruncated
is set to true, and there
* will be a value in NextContinuationToken
. You use the
* NextContinuationToken
value to continue the pagination of the list
* by passing the value in continuation-token in the request to GET
* the next page.
To use this operation, you must have permissions to
* perform the s3:GetAnalyticsConfiguration
action. The bucket owner
* has this permission by default. The bucket owner can grant this permission to
* others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For information about * Amazon S3 analytics feature, see Amazon * S3 Analytics – Storage Class Analysis.
The following operations are
* related to ListBucketAnalyticsConfigurations
:
Lists the S3 Intelligent-Tiering configuration from the specified bucket.
*The S3 Intelligent-Tiering storage class is designed to optimize storage * costs by automatically moving data to the most cost-effective storage access * tier, without performance impact or operational overhead. S3 Intelligent-Tiering * delivers automatic cost savings in three low latency and high throughput access * tiers. To get the lowest storage cost on data that can be accessed in minutes to * hours, you can choose to activate additional archiving capabilities.
The * S3 Intelligent-Tiering storage class is the ideal storage class for data with * unknown, changing, or unpredictable access patterns, independent of object size * or retention period. If the size of an object is less than 128 KB, it is not * monitored and not eligible for auto-tiering. Smaller objects can be stored, but * they are always charged at the Frequent Access tier rates in the S3 * Intelligent-Tiering storage class.
For more information, see Storage * class for automatically optimizing frequently and infrequently accessed * objects.
Operations related to
* ListBucketIntelligentTieringConfigurations
include:
Returns a list of inventory configurations for the bucket. You can have up to * 1,000 analytics configurations per bucket.
This action supports list
* pagination and does not return more than 100 configurations at a time. Always
* check the IsTruncated
element in the response. If there are no more
* configurations to list, IsTruncated
is set to false. If there are
* more configurations to list, IsTruncated
is set to true, and there
* is a value in NextContinuationToken
. You use the
* NextContinuationToken
value to continue the pagination of the list
* by passing the value in continuation-token in the request to GET
* the next page.
To use this operation, you must have permissions to
* perform the s3:GetInventoryConfiguration
action. The bucket owner
* has this permission by default. The bucket owner can grant this permission to
* others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For information about * the Amazon S3 inventory feature, see Amazon * S3 Inventory
The following operations are related to
* ListBucketInventoryConfigurations
:
Lists the metrics configurations for the bucket. The metrics configurations * are only for the request metrics of the bucket and do not provide information on * daily storage metrics. You can have up to 1,000 configurations per bucket.
*This action supports list pagination and does not return more than 100
* configurations at a time. Always check the IsTruncated
element in
* the response. If there are no more configurations to list,
* IsTruncated
is set to false. If there are more configurations to
* list, IsTruncated
is set to true, and there is a value in
* NextContinuationToken
. You use the
* NextContinuationToken
value to continue the pagination of the list
* by passing the value in continuation-token
in the request to
* GET
the next page.
To use this operation, you must have
* permissions to perform the s3:GetMetricsConfiguration
action. The
* bucket owner has this permission by default. The bucket owner can grant this
* permission to others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For more information * about metrics configurations and CloudWatch request metrics, see Monitoring * Metrics with Amazon CloudWatch.
The following operations are related
* to ListBucketMetricsConfigurations
:
Returns a list of all buckets owned by the authenticated sender of the
* request. To use this operation, you must have the
* s3:ListAllMyBuckets
permission.
This action lists in-progress multipart uploads. An in-progress multipart * upload is a multipart upload that has been initiated using the Initiate * Multipart Upload request, but has not yet been completed or aborted.
This
* action returns at most 1,000 multipart uploads in the response. 1,000 multipart
* uploads is the maximum number of uploads a response can include, which is also
* the default value. You can further limit the number of uploads in a response by
* specifying the max-uploads
parameter in the response. If additional
* multipart uploads satisfy the list criteria, the response will contain an
* IsTruncated
element with the value true. To list the additional
* multipart uploads, use the key-marker
and
* upload-id-marker
request parameters.
In the response, the * uploads are sorted by key. If your application has initiated more than one * multipart upload using the same object key, then uploads in the response are * first sorted by key. Additionally, uploads are sorted in ascending order within * each key by the upload initiation time.
For more information on multipart * uploads, see Uploading * Objects Using Multipart Upload.
For information on permissions * required to use the multipart upload API, see Multipart * Upload and Permissions.
The following operations are related to
* ListMultipartUploads
:
Returns metadata about all versions of the objects in a bucket. You can also * use request parameters as selection criteria to return metadata about a subset * of all the object versions.
To use this operation, you must
* have permissions to perform the s3:ListBucketVersions
action. Be
* aware of the name difference.
A 200 OK response can * contain valid or invalid XML. Make sure to design your application to parse the * contents of the response and handle it appropriately.
To use this * operation, you must have READ access to the bucket.
This action is not * supported by Amazon S3 on Outposts.
The following operations are related
* to ListObjectVersions
:
Returns some or all (up to 1,000) of the objects in a bucket. You can use the * request parameters as selection criteria to return a subset of the objects in a * bucket. A 200 OK response can contain valid or invalid XML. Be sure to design * your application to parse the contents of the response and handle it * appropriately.
This action has been revised. We recommend
* that you use the newer version, ListObjectsV2,
* when developing applications. For backward compatibility, Amazon S3 continues to
* support ListObjects
.
The following operations
* are related to ListObjects
:
Returns some or all (up to 1,000) of the objects in a bucket with each
* request. You can use the request parameters as selection criteria to return a
* subset of the objects in a bucket. A 200 OK
response can contain
* valid or invalid XML. Make sure to design your application to parse the contents
* of the response and handle it appropriately. Objects are returned sorted in an
* ascending order of the respective key names in the list. For more information
* about listing objects, see Listing
* object keys programmatically
To use this operation, you must have * READ access to the bucket.
To use this action in an Identity and Access
* Management (IAM) policy, you must have permissions to perform the
* s3:ListBucket
action. The bucket owner has this permission by
* default and can grant this permission to others. For more information about
* permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
This * section describes the latest revision of this action. We recommend that you use * this revised API for application development. For backward compatibility, Amazon * S3 continues to support the prior version of this API, ListObjects.
*To get a list of your buckets, see ListBuckets.
*The following operations are related to ListObjectsV2
:
Lists the parts that have been uploaded for a specific multipart upload. This
* operation must include the upload ID, which you obtain by sending the initiate
* multipart upload request (see CreateMultipartUpload).
* This request returns a maximum of 1,000 uploaded parts. The default number of
* parts returned is 1,000 parts. You can restrict the number of parts returned by
* specifying the max-parts
request parameter. If your multipart
* upload consists of more than 1,000 parts, the response returns an
* IsTruncated
field with the value of true, and a
* NextPartNumberMarker
element. In subsequent ListParts
* requests you can include the part-number-marker query string parameter and set
* its value to the NextPartNumberMarker
field value from the previous
* response.
If the upload was created using a checksum algorithm, you will
* need to have permission to the kms:Decrypt
action for the request
* to succeed.
For more information on multipart uploads, see Uploading * Objects Using Multipart Upload.
For information on permissions * required to use the multipart upload API, see Multipart * Upload and Permissions.
The following operations are related to
* ListParts
:
Sets the accelerate configuration of an existing bucket. Amazon S3 Transfer * Acceleration is a bucket-level feature that enables you to perform faster data * transfers to Amazon S3.
To use this operation, you must have permission
* to perform the s3:PutAccelerateConfiguration
action. The bucket
* owner has this permission by default. The bucket owner can grant this permission
* to others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
The Transfer * Acceleration state of a bucket can be set to one of the following two * values:
Enabled – Enables accelerated data transfers to the * bucket.
Suspended – Disables accelerated data transfers to * the bucket.
The GetBucketAccelerateConfiguration * action returns the transfer acceleration state of a bucket.
After setting * the Transfer Acceleration state of a bucket to Enabled, it might take up to * thirty minutes before the data transfer rates to the bucket increase.
* The name of the bucket used for Transfer Acceleration must be DNS-compliant and * must not contain periods (".").
For more information about transfer * acceleration, see Transfer * Acceleration.
The following operations are related to
* PutBucketAccelerateConfiguration
:
Sets the permissions on an existing bucket using access control lists (ACL).
* For more information, see Using
* ACLs. To set the ACL of a bucket, you must have WRITE_ACP
* permission.
You can use one of the following two ways to set a bucket's * permissions:
Specify the ACL in the request body
Specify permissions using request headers
You * cannot specify access permission using both the body and the request * headers.
Depending on your application needs, you may choose to * set the ACL on a bucket using either the request body or the headers. For * example, if you have an existing application that updates a bucket ACL using the * request body, then you can continue to use that approach.
If
* your bucket uses the bucket owner enforced setting for S3 Object Ownership, ACLs
* are disabled and no longer affect permissions. You must use policies to grant
* access to your bucket and the objects in it. Requests to set ACLs or update ACLs
* fail and return the AccessControlListNotSupported
error code.
* Requests to read ACLs are still supported. For more information, see Controlling
* object ownership in the Amazon S3 User Guide.
* Access Permissions
You can set access permissions using one of * the following methods:
Specify a canned ACL with the
* x-amz-acl
request header. Amazon S3 supports a set of predefined
* ACLs, known as canned ACLs. Each canned ACL has a predefined set of
* grantees and permissions. Specify the canned ACL name as the value of
* x-amz-acl
. If you use this header, you cannot use other access
* control-specific headers in your request. For more information, see Canned
* ACL.
Specify access permissions explicitly with the
* x-amz-grant-read
, x-amz-grant-read-acp
,
* x-amz-grant-write-acp
, and x-amz-grant-full-control
* headers. When using these headers, you specify explicit access permissions and
* grantees (Amazon Web Services accounts or Amazon S3 groups) who will receive the
* permission. If you use these ACL-specific headers, you cannot use the
* x-amz-acl
header to set a canned ACL. These parameters map to the
* set of permissions that Amazon S3 supports in an ACL. For more information, see
* Access
* Control List (ACL) Overview.
You specify each grantee as a type=value * pair, where the type is one of the following:
id
* – if the value specified is the canonical user ID of an Amazon Web Services
* account
uri
– if you are granting permissions to
* a predefined group
emailAddress
– if the value
* specified is the email address of an Amazon Web Services account
Using email addresses to specify a grantee is only supported in the following * Amazon Web Services Regions:
US East (N. Virginia)
US West (N. California)
US West (Oregon)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
*Asia Pacific (Tokyo)
Europe (Ireland)
South America (São Paulo)
For a list of all the * Amazon S3 supported Regions and endpoints, see Regions * and Endpoints in the Amazon Web Services General Reference.
*For example, the following x-amz-grant-write
header
* grants create, overwrite, and delete objects permission to LogDelivery group
* predefined by Amazon S3 and two Amazon Web Services accounts identified by their
* email addresses.
x-amz-grant-write:
* uri="http://acs.amazonaws.com/groups/s3/LogDelivery", id="111122223333",
* id="555566667777"
You can use either a canned ACL or * specify access permissions explicitly. You cannot do both.
Grantee * Values
You can specify the person (grantee) to whom you're assigning * access rights (using request elements) in the following ways:
By the person's ID:
<Grantee
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="CanonicalUser"><ID><>ID<></ID><DisplayName><>GranteesEmail<></DisplayName>
* </Grantee>
DisplayName is optional and ignored in the * request
By URI:
<Grantee
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="Group"><URI><>http://acs.amazonaws.com/groups/global/AuthenticatedUsers<></URI></Grantee>
*
By Email address:
<Grantee
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="AmazonCustomerByEmail"><EmailAddress><>Grantees@email.com<></EmailAddress>lt;/Grantee>
*
The grantee is resolved to the CanonicalUser and, in a response to a GET * Object acl request, appears as the CanonicalUser.
Using email * addresses to specify a grantee is only supported in the following Amazon Web * Services Regions:
US East (N. Virginia)
US * West (N. California)
US West (Oregon)
Asia * Pacific (Singapore)
Asia Pacific (Sydney)
Asia Pacific (Tokyo)
Europe (Ireland)
South America (São Paulo)
For a list of all the Amazon S3 * supported Regions and endpoints, see Regions * and Endpoints in the Amazon Web Services General Reference.
*Related Resources
Sets an analytics configuration for the bucket (specified by the analytics * configuration ID). You can have up to 1,000 analytics configurations per * bucket.
You can choose to have storage class analysis export analysis
* reports sent to a comma-separated values (CSV) flat file. See the
* DataExport
request element. Reports are updated daily and are based
* on the object filters that you configure. When selecting data export, you
* specify a destination bucket and an optional destination prefix where the file
* is written. You can export the data to a destination bucket in a different
* account. However, the destination bucket must be in the same Region as the
* bucket that you are making the PUT analytics configuration to. For more
* information, see Amazon
* S3 Analytics – Storage Class Analysis.
You must create a * bucket policy on the destination bucket where the exported file is written to * grant permissions to Amazon S3 to write objects to the bucket. For an example * policy, see Granting * Permissions for Amazon S3 Inventory and Storage Class Analysis.
*To use this operation, you must have permissions to perform the
* s3:PutAnalyticsConfiguration
action. The bucket owner has this
* permission by default. The bucket owner can grant this permission to others. For
* more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
* Special Errors
HTTP Error: HTTP 400 Bad * Request
Code: InvalidArgument
* Cause: Invalid argument.
* HTTP Error: HTTP 400 Bad Request
Code: * TooManyConfigurations
Cause: You are attempting to * create a new configuration but have already reached the 1,000-configuration * limit.
HTTP Error: HTTP 403 * Forbidden
Code: AccessDenied
* Cause: You are not the owner of the specified bucket, or you do not have the * s3:PutAnalyticsConfiguration bucket permission to set the configuration on the * bucket.
Related * Resources
Sets the cors
configuration for your bucket. If the
* configuration exists, Amazon S3 replaces it.
To use this operation, you
* must be allowed to perform the s3:PutBucketCORS
action. By default,
* the bucket owner has this permission and can grant it to others.
You set
* this configuration on a bucket so that the bucket can service cross-origin
* requests. For example, you might want to enable a request whose origin is
* http://www.example.com
to access your Amazon S3 bucket at
* my.example.bucket.com
by using the browser's
* XMLHttpRequest
capability.
To enable cross-origin resource
* sharing (CORS) on a bucket, you add the cors
subresource to the
* bucket. The cors
subresource is an XML document in which you
* configure rules that identify origins and the HTTP methods that can be executed
* on your bucket. The document is limited to 64 KB in size.
When Amazon S3
* receives a cross-origin request (or a pre-flight OPTIONS request) against a
* bucket, it evaluates the cors
configuration on the bucket and uses
* the first CORSRule
rule that matches the incoming browser request
* to enable a cross-origin request. For a rule to match, the following conditions
* must be met:
The request's Origin
header must
* match AllowedOrigin
elements.
The request method
* (for example, GET, PUT, HEAD, and so on) or the
* Access-Control-Request-Method
header in case of a pre-flight
* OPTIONS
request must be one of the AllowedMethod
* elements.
Every header specified in the
* Access-Control-Request-Headers
request header of a pre-flight
* request must match an AllowedHeader
element.
* For more information about CORS, go to Enabling * Cross-Origin Resource Sharing in the Amazon S3 User Guide.
Related Resources
This action uses the encryption
subresource to configure default
* encryption and Amazon S3 Bucket Key for an existing bucket.
Default * encryption for a bucket can use server-side encryption with Amazon S3-managed * keys (SSE-S3) or customer managed keys (SSE-KMS). If you specify default * encryption using SSE-KMS, you can also configure Amazon S3 Bucket Key. When the * default encryption is SSE-KMS, if you upload an object to the bucket and do not * specify the KMS key to use for encryption, Amazon S3 uses the default Amazon Web * Services managed KMS key for your account. For information about default * encryption, see Amazon * S3 default bucket encryption in the Amazon S3 User Guide. For more * information about S3 Bucket Keys, see Amazon S3 * Bucket Keys in the Amazon S3 User Guide.
This * action requires Amazon Web Services Signature Version 4. For more information, * see * Authenticating Requests (Amazon Web Services Signature Version 4).
*To use this operation, you must have permissions to perform the
* s3:PutEncryptionConfiguration
action. The bucket owner has this
* permission by default. The bucket owner can grant this permission to others. For
* more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources in the Amazon S3 User Guide.
*
Related Resources
Puts a S3 Intelligent-Tiering configuration to the specified bucket. You can * have up to 1,000 S3 Intelligent-Tiering configurations per bucket.
The S3 * Intelligent-Tiering storage class is designed to optimize storage costs by * automatically moving data to the most cost-effective storage access tier, * without performance impact or operational overhead. S3 Intelligent-Tiering * delivers automatic cost savings in three low latency and high throughput access * tiers. To get the lowest storage cost on data that can be accessed in minutes to * hours, you can choose to activate additional archiving capabilities.
The * S3 Intelligent-Tiering storage class is the ideal storage class for data with * unknown, changing, or unpredictable access patterns, independent of object size * or retention period. If the size of an object is less than 128 KB, it is not * monitored and not eligible for auto-tiering. Smaller objects can be stored, but * they are always charged at the Frequent Access tier rates in the S3 * Intelligent-Tiering storage class.
For more information, see Storage * class for automatically optimizing frequently and infrequently accessed * objects.
Operations related to
* PutBucketIntelligentTieringConfiguration
include:
You only need S3 Intelligent-Tiering enabled on a * bucket if you want to automatically move objects stored in the S3 * Intelligent-Tiering storage class to the Archive Access or Deep Archive Access * tier.
Special Errors
HTTP 400 Bad Request Error
Code: * InvalidArgument
Cause: Invalid Argument
HTTP 400 Bad Request Error
Code: TooManyConfigurations
Cause: You * are attempting to create a new configuration but have already reached the * 1,000-configuration limit.
HTTP * 403 Forbidden Error
Code: AccessDenied
Cause: You are not the owner of the specified bucket, or you do
* not have the s3:PutIntelligentTieringConfiguration
bucket
* permission to set the configuration on the bucket.
This implementation of the PUT
action adds an inventory
* configuration (identified by the inventory ID) to the bucket. You can have up to
* 1,000 inventory configurations per bucket.
Amazon S3 inventory generates * inventories of the objects in the bucket on a daily or weekly basis, and the * results are published to a flat file. The bucket that is inventoried is called * the source bucket, and the bucket where the inventory flat file is stored * is called the destination bucket. The destination bucket must be * in the same Amazon Web Services Region as the source bucket.
When * you configure an inventory for a source bucket, you specify the * destination bucket where you want the inventory to be stored, and whether * to generate the inventory daily or weekly. You can also configure what object * metadata to include and whether to inventory all object versions or only current * versions. For more information, see Amazon * S3 Inventory in the Amazon S3 User Guide.
You must create * a bucket policy on the destination bucket to grant permissions to Amazon * S3 to write objects to the bucket in the defined location. For an example * policy, see * Granting Permissions for Amazon S3 Inventory and Storage Class Analysis.
*To use this operation, you must have permissions to perform the
* s3:PutInventoryConfiguration
action. The bucket owner has this
* permission by default and can grant this permission to others. For more
* information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources in the Amazon S3 User
* Guide.
Special Errors
HTTP 400 Bad Request Error
Code: * InvalidArgument
Cause: Invalid Argument
HTTP 400 Bad Request Error
Code: TooManyConfigurations
Cause: You * are attempting to create a new configuration but have already reached the * 1,000-configuration limit.
HTTP * 403 Forbidden Error
Code: AccessDenied
Cause: You are not the owner of the specified bucket, or you do
* not have the s3:PutInventoryConfiguration
bucket permission to set
* the configuration on the bucket.
* Related Resources
Creates a new lifecycle configuration for the bucket or replaces an existing * lifecycle configuration. Keep in mind that this will overwrite an existing * lifecycle configuration, so if you want to retain any configuration details, * they must be included in the new lifecycle configuration. For information about * lifecycle configuration, see Managing * your storage lifecycle.
Bucket lifecycle configuration now * supports specifying a lifecycle rule using an object key name prefix, one or * more object tags, or a combination of both. Accordingly, this section describes * the latest API. The previous version of the API supported filtering based only * on an object key name prefix, which is supported for backward compatibility. For * the related API description, see PutBucketLifecycle.
*Rules
You specify the lifecycle configuration in your * request body. The lifecycle configuration is specified as XML consisting of one * or more rules. An Amazon S3 Lifecycle configuration can have up to 1,000 rules. * This limit is not adjustable. Each rule consists of the following:
Filter identifying a subset of objects to which the rule applies. The filter * can be based on a key name prefix, object tags, or a combination of both.
*Status whether the rule is in effect.
One or * more lifecycle transition and expiration actions that you want Amazon S3 to * perform on the objects identified by the filter. If the state of your bucket is * versioning-enabled or versioning-suspended, you can have many versions of the * same object (one current version and zero or more noncurrent versions). Amazon * S3 provides predefined actions that you can specify for current and noncurrent * object versions.
For more information, see Object * Lifecycle Management and Lifecycle * Configuration Elements.
Permissions
By default, all
* Amazon S3 resources are private, including buckets, objects, and related
* subresources (for example, lifecycle configuration and website configuration).
* Only the resource owner (that is, the Amazon Web Services account that created
* it) can access the resource. The resource owner can optionally grant access
* permissions to others by writing an access policy. For this operation, a user
* must get the s3:PutLifecycleConfiguration
permission.
You * can also explicitly deny permissions. Explicit deny also supersedes any other * permissions. If you want to block users or accounts from removing or deleting * objects from your bucket, you must deny them permissions for the following * actions:
s3:DeleteObject
* s3:DeleteObjectVersion
* s3:PutLifecycleConfiguration
For more * information about permissions, see Managing * Access Permissions to Your Amazon S3 Resources.
The following are
* related to PutBucketLifecycleConfiguration
:
Set the logging parameters for a bucket and to specify permissions for who * can view and modify the logging parameters. All logs are saved to buckets in the * same Amazon Web Services Region as the source bucket. To set the logging status * of a bucket, you must be the bucket owner.
The bucket owner is
* automatically granted FULL_CONTROL to all logs. You use the Grantee
* request element to grant access to other people. The Permissions
* request element specifies the kind of access the grantee has to the logs.
If the target bucket for log delivery uses the bucket owner
* enforced setting for S3 Object Ownership, you can't use the Grantee
* request element to grant access to others. Permissions can only be granted using
* policies. For more information, see Permissions
* for server access log delivery in the Amazon S3 User Guide.
Grantee Values
You can specify the person * (grantee) to whom you're assigning access rights (using request elements) in the * following ways:
By the person's ID:
<Grantee
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="CanonicalUser"><ID><>ID<></ID><DisplayName><>GranteesEmail<></DisplayName>
* </Grantee>
DisplayName is optional and ignored in the * request.
By Email address:
<Grantee
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="AmazonCustomerByEmail"><EmailAddress><>Grantees@email.com<></EmailAddress></Grantee>
*
The grantee is resolved to the CanonicalUser and, in a response to a GET * Object acl request, appears as the CanonicalUser.
By URI:
* <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="Group"><URI><>http://acs.amazonaws.com/groups/global/AuthenticatedUsers<></URI></Grantee>
*
To enable logging, you use LoggingEnabled and its children * request elements. To disable logging, you use an empty BucketLoggingStatus * request element:
<BucketLoggingStatus
* xmlns="http://doc.s3.amazonaws.com/2006-03-01" />
For more * information about server access logging, see Server * Access Logging in the Amazon S3 User Guide.
For more * information about creating a bucket, see CreateBucket. * For more information about returning the logging status of a bucket, see GetBucketLogging.
*The following operations are related to PutBucketLogging
:
Sets a metrics configuration (specified by the metrics configuration ID) for * the bucket. You can have up to 1,000 metrics configurations per bucket. If * you're updating an existing metrics configuration, note that this is a full * replacement of the existing metrics configuration. If you don't include the * elements you want to keep, they are erased.
To use this operation, you
* must have permissions to perform the s3:PutMetricsConfiguration
* action. The bucket owner has this permission by default. The bucket owner can
* grant this permission to others. For more information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
For information about * CloudWatch request metrics for Amazon S3, see Monitoring * Metrics with Amazon CloudWatch.
The following operations are related
* to PutBucketMetricsConfiguration
:
GetBucketLifecycle
has the following special
* error:
Error code: TooManyConfigurations
Description: You are attempting to create a new configuration but have * already reached the 1,000-configuration limit.
HTTP Status * Code: HTTP 400 Bad Request
Enables notifications of specified events for a bucket. For more information * about event notifications, see Configuring * Event Notifications.
Using this API, you can replace an existing * notification configuration. The configuration is an XML file that defines the * event types that you want Amazon S3 to publish and the destination where you * want Amazon S3 to publish an event notification when it detects an event of the * specified type.
By default, your bucket has no event notifications
* configured. That is, the notification configuration will be an empty
* NotificationConfiguration
.
* <NotificationConfiguration>
* </NotificationConfiguration>
This action replaces the * existing notification configuration with the configuration you include in the * request body.
After Amazon S3 receives this request, it first verifies * that any Amazon Simple Notification Service (Amazon SNS) or Amazon Simple Queue * Service (Amazon SQS) destination exists, and that the bucket owner has * permission to publish to it by sending a test notification. In the case of * Lambda destinations, Amazon S3 verifies that the Lambda function permissions * grant Amazon S3 permission to invoke the function from the Amazon S3 bucket. For * more information, see Configuring * Notifications for Amazon S3 Events.
You can disable notifications by * adding the empty NotificationConfiguration element.
For more information * about the number of event notification configurations that you can create per * bucket, see Amazon S3 * service quotas in Amazon Web Services General Reference.
By
* default, only the bucket owner can configure notifications on a bucket. However,
* bucket owners can use a bucket policy to grant permission to other users to set
* this configuration with s3:PutBucketNotification
permission.
The PUT notification is an atomic operation. For example, suppose your * notification configuration includes SNS topic, SQS queue, and Lambda function * configurations. When you send a PUT request with this configuration, Amazon S3 * sends test messages to your SNS topic. If the message fails, the entire PUT * action will fail, and Amazon S3 will not add the configuration to your * bucket.
Responses
If the configuration in the
* request body includes only one TopicConfiguration
specifying only
* the s3:ReducedRedundancyLostObject
event type, the response will
* also include the x-amz-sns-test-message-id
header containing the
* message ID of the test notification sent to the topic.
The following
* action is related to PutBucketNotificationConfiguration
:
Creates or modifies OwnershipControls
for an Amazon S3 bucket.
* To use this operation, you must have the
* s3:PutBucketOwnershipControls
permission. For more information
* about Amazon S3 permissions, see Specifying
* permissions in a policy.
For information about Amazon S3 Object * Ownership, see Using * object ownership.
The following operations are related to
* PutBucketOwnershipControls
:
Applies an Amazon S3 bucket policy to an Amazon S3 bucket. If you are using
* an identity other than the root user of the Amazon Web Services account that
* owns the bucket, the calling identity must have the PutBucketPolicy
* permissions on the specified bucket and belong to the bucket owner's account in
* order to use this operation.
If you don't have
* PutBucketPolicy
permissions, Amazon S3 returns a 403 Access
* Denied
error. If you have the correct permissions, but you're not using
* an identity that belongs to the bucket owner's account, Amazon S3 returns a
* 405 Method Not Allowed
error.
As a security * precaution, the root user of the Amazon Web Services account that owns a bucket * can always use this operation, even if the policy explicitly denies the root * user the ability to perform this action.
For more * information, see Bucket * policy examples.
The following operations are related to
* PutBucketPolicy
:
Creates a replication configuration or replaces an existing one. For more * information, see Replication * in the Amazon S3 User Guide.
Specify the replication * configuration in the request body. In the replication configuration, you provide * the name of the destination bucket or buckets where you want Amazon S3 to * replicate objects, the IAM role that Amazon S3 can assume to replicate objects * on your behalf, and other relevant information.
A replication * configuration must include at least one rule, and can contain a maximum of * 1,000. Each rule identifies a subset of objects to replicate by filtering the * objects in the source bucket. To choose additional subsets of objects to * replicate, add a rule for each subset.
To specify a subset of the objects
* in the source bucket to apply a replication rule to, add the Filter element as a
* child of the Rule element. You can filter objects based on an object key prefix,
* one or more object tags, or both. When you add the Filter element in the
* configuration, you must also add the following elements:
* DeleteMarkerReplication
, Status
, and
* Priority
.
If you are using an earlier version of the * replication configuration, Amazon S3 handles replication of delete markers * differently. For more information, see Backward * Compatibility.
For information about enabling versioning on a * bucket, see Using * Versioning.
Handling Replication of Encrypted Objects
*By default, Amazon S3 doesn't replicate objects that are stored at rest using
* server-side encryption with KMS keys. To replicate Amazon Web Services
* KMS-encrypted objects, add the following: SourceSelectionCriteria
,
* SseKmsEncryptedObjects
, Status
,
* EncryptionConfiguration
, and ReplicaKmsKeyID
. For
* information about replication configuration, see Replicating
* Objects Created with SSE Using KMS keys.
For information on
* PutBucketReplication
errors, see List
* of replication-related error codes
Permissions
To
* create a PutBucketReplication
request, you must have
* s3:PutReplicationConfiguration
permissions for the bucket.
By default, a resource owner, in this case the Amazon Web Services account * that created the bucket, can perform this operation. The resource owner can also * grant others permissions to perform the operation. For more information about * permissions, see Specifying * Permissions in a Policy and Managing * Access Permissions to Your Amazon S3 Resources.
To perform * this operation, the user or role performing the action must have the iam:PassRole * permission.
The following operations are related to
* PutBucketReplication
:
Sets the request payment configuration for a bucket. By default, the bucket * owner pays for downloads from the bucket. This configuration parameter enables * the bucket owner (only) to specify that the person requesting the download will * be charged for the download. For more information, see Requester * Pays Buckets.
The following operations are related to
* PutBucketRequestPayment
:
Sets the tags for a bucket.
Use tags to organize your Amazon Web * Services bill to reflect your own cost structure. To do this, sign up to get * your Amazon Web Services account bill with tag key values included. Then, to see * the cost of combined resources, organize your billing information according to * resources with the same tag key values. For example, you can tag several * resources with a specific application name, and then organize your billing * information to see the total cost of that application across several services. * For more information, see Cost * Allocation and Tagging and Using * Cost Allocation in Amazon S3 Bucket Tags.
When this operation * sets the tags for a bucket, it will overwrite any current tags the bucket * already has. You cannot use this operation to add tags to an existing list of * tags.
To use this operation, you must have permissions to perform
* the s3:PutBucketTagging
action. The bucket owner has this
* permission by default and can grant this permission to others. For more
* information about permissions, see Permissions
* Related to Bucket Subresource Operations and Managing
* Access Permissions to Your Amazon S3 Resources.
* PutBucketTagging
has the following special errors:
Error code: InvalidTagError
Description: The * tag provided was not a valid tag. This error can occur if the tag did not pass * input validation. For information about tag restrictions, see User-Defined * Tag Restrictions and Amazon * Web Services-Generated Cost Allocation Tag Restrictions.
Error code: MalformedXMLError
Description: The XML provided does not match the schema.
Error code: OperationAbortedError
Description: A conflicting conditional action is currently in progress * against this resource. Please try again.
Error
* code: InternalError
Description: The service was * unable to apply the provided tag to the bucket.
The following operations are related to PutBucketTagging
:
Sets the versioning state of an existing bucket.
You can set the * versioning state with one of the following values:
* Enabled—Enables versioning for the objects in the bucket. All objects * added to the bucket receive a unique version ID.
* Suspended—Disables versioning for the objects in the bucket. All objects * added to the bucket receive the version ID null.
If the versioning state * has never been set on a bucket, it has no versioning state; a GetBucketVersioning * request does not return a versioning state value.
In order to enable MFA
* Delete, you must be the bucket owner. If you are the bucket owner and want to
* enable MFA Delete in the bucket versioning configuration, you must include the
* x-amz-mfa request
header and the Status
and the
* MfaDelete
request elements in a request to set the versioning state
* of the bucket.
If you have an object expiration lifecycle * policy in your non-versioned bucket and you want to maintain the same permanent * delete behavior when you enable versioning, you must add a noncurrent expiration * policy. The noncurrent expiration lifecycle policy will manage the deletes of * the noncurrent object versions in the version-enabled bucket. (A version-enabled * bucket maintains one current and zero or more noncurrent object versions.) For * more information, see Lifecycle * and Versioning.
Related Resources *
Sets the configuration of the website that is specified in the
* website
subresource. To configure a bucket as a website, you can
* add this subresource on the bucket with website configuration information such
* as the file name of the index document and any redirect rules. For more
* information, see Hosting
* Websites on Amazon S3.
This PUT action requires the
* S3:PutBucketWebsite
permission. By default, only the bucket owner
* can configure the website attached to a bucket; however, bucket owners can allow
* other users to set the website configuration by writing a bucket policy that
* grants them the S3:PutBucketWebsite
permission.
To redirect * all website requests sent to the bucket's website endpoint, you add a website * configuration with the following elements. Because all requests are sent to * another website, you don't need to provide index document name for the * bucket.
WebsiteConfiguration
* RedirectAllRequestsTo
HostName
*
Protocol
If you want * granular control over redirects, you can use the following elements to add * routing rules that describe conditions for redirecting requests and information * about the redirect destination. In this case, the website configuration must * provide an index document for the bucket, because some requests might not be * redirected.
WebsiteConfiguration
IndexDocument
Suffix
ErrorDocument
Key
*
RoutingRules
* RoutingRule
Condition
HttpErrorCodeReturnedEquals
* KeyPrefixEquals
Redirect
Protocol
HostName
*
ReplaceKeyPrefixWith
* ReplaceKeyWith
HttpRedirectCode
*
Amazon S3 has a limitation of 50 routing rules per website * configuration. If you require more than 50 routing rules, you can use object * redirect. For more information, see Configuring * an Object Redirect in the Amazon S3 User Guide.
Adds an object to a bucket. You must have WRITE permissions on a bucket to * add an object to it.
Amazon S3 never adds partial objects; if you receive * a success response, Amazon S3 added the entire object to the bucket.
*Amazon S3 is a distributed system. If it receives multiple write requests for * the same object simultaneously, it overwrites all but the last object written. * Amazon S3 does not provide object locking; if you need this, make sure to build * it into your application layer or use versioning instead.
To ensure that
* data is not corrupted traversing the network, use the Content-MD5
* header. When you use this header, Amazon S3 checks the object against the
* provided MD5 value and, if they do not match, returns an error. Additionally,
* you can calculate the MD5 while putting an object to Amazon S3 and compare the
* returned ETag to the calculated MD5 value.
To
* successfully complete the PutObject
request, you must have the
* s3:PutObject
in your IAM permissions.
To
* successfully change the objects acl of your PutObject
request, you
* must have the s3:PutObjectAcl
in your IAM permissions.
The Content-MD5
header is required for any request to
* upload an object with a retention period configured using Amazon S3 Object Lock.
* For more information about Amazon S3 Object Lock, see Amazon
* S3 Object Lock Overview in the Amazon S3 User Guide.
Server-side Encryption
You can optionally request * server-side encryption. With server-side encryption, Amazon S3 encrypts your * data as it writes it to disks in its data centers and decrypts the data when you * access it. You have the option to provide your own encryption key or use Amazon * Web Services managed encryption keys (SSE-S3 or SSE-KMS). For more information, * see Using * Server-Side Encryption.
If you request server-side encryption using * Amazon Web Services Key Management Service (SSE-KMS), you can enable an S3 * Bucket Key at the object-level. For more information, see Amazon S3 * Bucket Keys in the Amazon S3 User Guide.
Access Control * List (ACL)-Specific Request Headers
You can use headers to grant * ACL- based permissions. By default, all objects are private. Only the owner has * full access control. When adding a new object, you can grant permissions to * individual Amazon Web Services accounts or to predefined groups defined by * Amazon S3. These permissions are then added to the ACL on the object. For more * information, see Access * Control List (ACL) Overview and Managing * ACLs Using the REST API.
If the bucket that you're uploading objects
* to uses the bucket owner enforced setting for S3 Object Ownership, ACLs are
* disabled and no longer affect permissions. Buckets that use this setting only
* accept PUT requests that don't specify an ACL or PUT requests that specify
* bucket owner full control ACLs, such as the
* bucket-owner-full-control
canned ACL or an equivalent form of this
* ACL expressed in the XML format. PUT requests that contain other ACLs (for
* example, custom grants to certain Amazon Web Services accounts) fail and return
* a 400
error with the error code
* AccessControlListNotSupported
.
For more information, see * Controlling ownership of objects and disabling ACLs in the Amazon S3 User * Guide.
If your bucket uses the bucket owner enforced setting * for Object Ownership, all objects written to the bucket by any account will be * owned by the bucket owner.
Storage Class Options
*By default, Amazon S3 uses the STANDARD Storage Class to store newly created * objects. The STANDARD storage class provides high durability and high * availability. Depending on performance needs, you can specify a different * Storage Class. Amazon S3 on Outposts only uses the OUTPOSTS Storage Class. For * more information, see Storage * Classes in the Amazon S3 User Guide.
Versioning
*If you enable versioning for a bucket, Amazon S3 automatically generates a * unique version ID for the object being stored. Amazon S3 returns this ID in the * response. When you enable versioning for a bucket, if Amazon S3 receives * multiple write requests for the same object simultaneously, it stores all of the * objects.
For more information about versioning, see Adding * Objects to Versioning Enabled Buckets. For information about returning the * versioning state of a bucket, see GetBucketVersioning. *
Related Resources
Uses the acl
subresource to set the access control list (ACL)
* permissions for a new or existing object in an S3 bucket. You must have
* WRITE_ACP
permission to set the ACL of an object. For more
* information, see What
* permissions can I grant? in the Amazon S3 User Guide.
This * action is not supported by Amazon S3 on Outposts.
Depending on your * application needs, you can choose to set the ACL on an object using either the * request body or the headers. For example, if you have an existing application * that updates a bucket ACL using the request body, you can continue to use that * approach. For more information, see Access * Control List (ACL) Overview in the Amazon S3 User Guide.
*If your bucket uses the bucket owner enforced setting for S3
* Object Ownership, ACLs are disabled and no longer affect permissions. You must
* use policies to grant access to your bucket and the objects in it. Requests to
* set ACLs or update ACLs fail and return the
* AccessControlListNotSupported
error code. Requests to read ACLs are
* still supported. For more information, see Controlling
* object ownership in the Amazon S3 User Guide.
* Access Permissions
You can set access permissions using one of * the following methods:
Specify a canned ACL with the
* x-amz-acl
request header. Amazon S3 supports a set of predefined
* ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and
* permissions. Specify the canned ACL name as the value of x-amz-ac
l.
* If you use this header, you cannot use other access control-specific headers in
* your request. For more information, see Canned
* ACL.
Specify access permissions explicitly with the
* x-amz-grant-read
, x-amz-grant-read-acp
,
* x-amz-grant-write-acp
, and x-amz-grant-full-control
* headers. When using these headers, you specify explicit access permissions and
* grantees (Amazon Web Services accounts or Amazon S3 groups) who will receive the
* permission. If you use these ACL-specific headers, you cannot use
* x-amz-acl
header to set a canned ACL. These parameters map to the
* set of permissions that Amazon S3 supports in an ACL. For more information, see
* Access
* Control List (ACL) Overview.
You specify each grantee as a type=value * pair, where the type is one of the following:
id
* – if the value specified is the canonical user ID of an Amazon Web Services
* account
uri
– if you are granting permissions to
* a predefined group
emailAddress
– if the value
* specified is the email address of an Amazon Web Services account
Using email addresses to specify a grantee is only supported in the following * Amazon Web Services Regions:
US East (N. Virginia)
US West (N. California)
US West (Oregon)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
*Asia Pacific (Tokyo)
Europe (Ireland)
South America (São Paulo)
For a list of all the * Amazon S3 supported Regions and endpoints, see Regions * and Endpoints in the Amazon Web Services General Reference.
*For example, the following x-amz-grant-read
header
* grants list objects permission to the two Amazon Web Services accounts
* identified by their email addresses.
x-amz-grant-read:
* emailAddress="xyz@amazon.com", emailAddress="abc@amazon.com"
You can use either a canned ACL or specify access permissions * explicitly. You cannot do both.
Grantee Values
You can * specify the person (grantee) to whom you're assigning access rights (using * request elements) in the following ways:
By the person's * ID:
<Grantee
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="CanonicalUser"><ID><>ID<></ID><DisplayName><>GranteesEmail<></DisplayName>
* </Grantee>
DisplayName is optional and ignored in the * request.
By URI:
<Grantee
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="Group"><URI><>http://acs.amazonaws.com/groups/global/AuthenticatedUsers<></URI></Grantee>
*
By Email address:
<Grantee
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:type="AmazonCustomerByEmail"><EmailAddress><>Grantees@email.com<></EmailAddress>lt;/Grantee>
*
The grantee is resolved to the CanonicalUser and, in a response to a GET * Object acl request, appears as the CanonicalUser.
Using email * addresses to specify a grantee is only supported in the following Amazon Web * Services Regions:
US East (N. Virginia)
US * West (N. California)
US West (Oregon)
Asia * Pacific (Singapore)
Asia Pacific (Sydney)
Asia Pacific (Tokyo)
Europe (Ireland)
South America (São Paulo)
For a list of all the Amazon S3 * supported Regions and endpoints, see Regions * and Endpoints in the Amazon Web Services General Reference.
*Versioning
The ACL of an object is set at the
* object version level. By default, PUT sets the ACL of the current version of an
* object. To set the ACL of a different version, use the versionId
* subresource.
Related Resources
* CopyObject *
Applies a legal hold configuration to the specified object. For more * information, see Locking * Objects.
This action is not supported by Amazon S3 on * Outposts.
Places an Object Lock configuration on the specified bucket. The rule * specified in the Object Lock configuration will be applied by default to every * new object placed in the specified bucket. For more information, see Locking * Objects.
The DefaultRetention
settings
* require both a mode and a period.
The
* DefaultRetention
period can be either Days
or
* Years
but you must select one. You cannot specify Days
* and Years
at the same time.
You can only enable * Object Lock for new buckets. If you want to turn on Object Lock for an existing * bucket, contact Amazon Web Services Support.
Places an Object Retention configuration on an object. For more information,
* see Locking
* Objects. Users or accounts require the s3:PutObjectRetention
* permission in order to place an Object Retention configuration on objects.
* Bypassing a Governance Retention configuration requires the
* s3:BypassGovernanceRetention
permission.
This action is not * supported by Amazon S3 on Outposts.
Sets the supplied tag-set to an object that already exists in a bucket.
*A tag is a key-value pair. You can associate tags with an object by sending a * PUT request against the tagging subresource that is associated with the object. * You can retrieve tags by sending a GET request. For more information, see