AWS AmazonS3 documentation change
Summary
Added documentation for access points specific to directory buckets, including new API operations and policy actions. Updated existing references to differentiate between general purpose buckets and directory buckets in policy configurations.
Security assessment
The changes introduce documentation for configuring IAM policies for directory bucket access points, which is a security feature. However, there is no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/AmazonS3/latest/userguide/using-with-s3-policy-actions.md b/AmazonS3/latest/userguide/using-with-s3-policy-actions.md index 2f34101ee..2d0507a5a 100644 --- a/AmazonS3/latest/userguide/using-with-s3-policy-actions.md +++ b/AmazonS3/latest/userguide/using-with-s3-policy-actions.md @@ -5 +5 @@ -Bucket operations and permissionsObject operations and permissionsAccess point operations and permissionsObject Lambda Access Point operations and permissionsMulti-Region Access Point operations and permissionsBatch job operations and permissionsS3 Storage Lens configuration operations and permissionsS3 Storage Lens groups operations and permissionsS3 Access Grants instance operations and permissionsS3 Access Grants location operations and permissionsS3 Access Grants grant operations and permissionsAccount operations and permissions +Bucket operations and permissionsObject operations and permissionsAccess point for general purpose buckets operations and permissionsAccess point for directory buckets operations and permissionsObject Lambda Access Point operations and permissionsMulti-Region Access Point operations and permissionsBatch job operations and permissionsS3 Storage Lens configuration operations and permissionsS3 Storage Lens groups operations and permissionsS3 Access Grants instance operations and permissionsS3 Access Grants location operations and permissionsS3 Access Grants grant operations and permissionsAccount operations and permissions @@ -25 +25,3 @@ For more information on how to address the HTTP `403 Forbidden` errors in S3, se - * Access point operations and permissions + * Access point for general purpose buckets operations and permissions + + * Access point for directory buckets operations and permissions @@ -60 +62 @@ To grant permissions to bucket operations in access point policies, note the fol - * In access point policies that grant permissions to bucket operations, the `Resource` element must be the `accesspoint` ARN. For more information about the `Resource` element format and example policies, see [Bucket operations in access point policies](./security_iam_service-with-iam.html#bucket-operations-ap). For more information about access point policies, see [Configuring IAM policies for using access points](./access-points-policies.html). + * In access point policies that grant permissions to bucket operations, the `Resource` element must be the `accesspoint` ARN. For more information about the `Resource` element format and example policies, see [Bucket operations in policies for access points for general purpose buckets](./security_iam_service-with-iam.html#bucket-operations-ap). For more information about access point policies, see [Configuring IAM policies for using access points for general purpose buckets](./access-points-policies.html). @@ -62 +64 @@ To grant permissions to bucket operations in access point policies, note the fol - * Not all bucket operations are supported by access points. For more information, see [Access point compatibility with S3 operations](./access-points-service-api-support.html#access-points-operations-support). + * Not all bucket operations are supported by access points. For more information, see [Access points for general purpose buckets compatibility with S3 operations](./access-points-service-api-support.html#access-points-operations-support). @@ -159 +161 @@ In the policies, the `Resource` element must be the object ARN. For more informa - * Not all object operations are supported by access points. For more information, see [Access point compatibility with S3 operations](./access-points-service-api-support.html#access-points-operations-support). + * Not all object operations are supported by access points. For more information, see [Access points for general purpose buckets compatibility with S3 operations](./access-points-service-api-support.html#access-points-operations-support). @@ -290 +292 @@ API operations | Policy actions | Description of policy actions -## Access point operations and permissions +## Access point for general purpose buckets operations and permissions @@ -294 +296 @@ Access point operations are S3 API operations that operate on the `accesspoint` -In the policies, the `Resource` element must be the `accesspoint` ARN. For more information about the `Resource` element format and example policies, see [Access point operations](./security_iam_service-with-iam.html#using-with-s3-actions-related-to-accesspoint). +In the policies, the `Resource` element must be the `accesspoint` ARN. For more information about the `Resource` element format and example policies, see [Access point for general purpose bucket operations](./security_iam_service-with-iam.html#using-with-s3-actions-related-to-accesspoint). @@ -300 +302 @@ If you want to use access points to control access to bucket or object operation - * For using access points to control access to bucket operations, see [Bucket operations in access point policies](./security_iam_service-with-iam.html#bucket-operations-ap). + * For using access points to control access to bucket operations, see [Bucket operations in policies for access points for general purpose buckets](./security_iam_service-with-iam.html#bucket-operations-ap). @@ -304 +306 @@ If you want to use access points to control access to bucket or object operation - * For more information about how to configure access point policies, see [Configuring IAM policies for using access points](./access-points-policies.html). + * For more information about how to configure access point policies, see [Configuring IAM policies for using access points for general purpose buckets](./access-points-policies.html). @@ -319,0 +322,32 @@ API operations | Policy actions | Description of policy actions +## Access point for directory buckets operations and permissions + +Access point for directory buckets operations are S3 API operations that operate on the `accesspoint` resource type. You must specify S3 policy actions for access point operations in IAM identity-based policies, not in bucket policies or access point policies. + +###### Note + +If you want to use access points for directory buckets to control access to bucket or object operations, note the following: + + * For using access points to control access to bucket operations, see [Bucket operations in policies for access points for directory buckets](./security_iam_service-with-iam.html#bucket-operations-ap-directory-buckets). + + * For using access points to control access to object operations, see [Object operations in policies for access points for directory buckets](./security_iam_service-with-iam.html#object-operations-ap-directory-buckets). + + * For more information about how to configure access point policies, see [Configuring IAM policies for using access points for directory buckets](./access-points-directory-buckets-policies.html). + + + + +The following is the mapping of operations for access points for directory buckets and required policy actions. + +API operations | Policy actions | Description of policy actions +---|---|--- +[CreateAccessPoint](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessPoint.html) | (Required) `s3express:CreateAccessPoint` | Required to create an access point that's associated with an directory bucket. +ListAccessPointsForDirectoryBuckets | (required) `s3express:ListAccessPointsForDirectoryBuckets` | Required to list access points for directory buckets. +[GetAccessPoint](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPoint.html) | (required) `s3express:GetAccessPoint` | Required to view configuration information about an access point. +[DeleteAccessPoint](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPoint.html) | (Required) `s3express:DeleteAccessPoint` | Required to delete an access point. +[DeleteAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicy.html) | (Required) `s3express:DeleteAccessPointPolicy` | Required to delete an access point policy. +[GetAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicy.html) | (Required) `s3express:GetAccessPointPolicy` | Required to retrieve an access point policy. +[PutAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicy.html) | (Required) `s3express:PutAccessPointPolicy` | Required to put an access point policy. +DeleteAccessPointScope | (Required) `s3express:DeleteAccessPointScope` | Required to delete an access points for directory buckets scope. +GetAccessPointScope | (Required) `s3express:GetAccessPointScope` | Required to retrieve an access points for directory buckets scope. +PutAccessPointScope | (Required `s3express:PutAccessPointScope` | Required to put an access points for directory buckets scope. +