AWS AmazonS3 high security documentation change
Summary
Updated documentation to include AWS SDK support, corrected action names (e.g., ListBucket instead of ListBucketsAction), fixed CLI syntax examples, added wildcard usage notes, and adjusted prefix size limit from 256 KB to 256 bytes
Security assessment
Corrected action names (e.g., ListBucket vs ListBucketsAction) prevent policy misconfiguration. Prefix size limit reduction (256 bytes) addresses potential over-permission risks. Wildcard usage notes clarify secure pattern matching to prevent unintended access.
Diff
diff --git a/AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md b/AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md index 59eeee4ed..716f23085 100644 --- a//AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md +++ b//AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md @@ -5 +5 @@ -View the scope of your access points for directory bucketsModify the scope of your access point for directory bucketsDelete the scope of your access point for directory buckets +View the scope of your access points for directory bucketsModify the scope of your access point for directory bucketsDelete the scope of your access points for directory buckets @@ -9 +9 @@ View the scope of your access points for directory bucketsModify the scope of yo -This section explains how to view and modify the scope of your access points for directory buckets using the AWS Command Line Interface or REST API. You can use the access point scope to restrict access to specific prefixes or API operations. +This section explains how to view and modify the scope of your access points for directory buckets using the AWS Command Line Interface, REST API, or AWS SDKs. You can use the access point scope to restrict access to specific prefixes or API operations. @@ -17 +17 @@ This section explains how to view and modify the scope of your access points for - * Delete the scope of your access point for directory buckets + * Delete the scope of your access points for directory buckets @@ -31 +31 @@ The following `get-access-point-scope` example command shows how you can use the -The following `GetAccessPointScope` example command shows how you can use the REST API to view the scope of your access point. +The following `GetAccessPointScope` example request shows how you can use the REST API to view the scope of your access point. @@ -33 +33 @@ The following `GetAccessPointScope` example command shows how you can use the RE -The following method shows the scope of the access point ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. +The following request shows the scope of the access point ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. @@ -49,2 +49,2 @@ The following method shows the scope of the access point ``my-access-point`--usw - <Prefix>"*Cats*"</Prefix> - <Prefix>"*Dogs*"</Prefix> + <Prefix>*Cats*</Prefix> + <Prefix>*Dogs*</Prefix> @@ -53,2 +53,2 @@ The following method shows the scope of the access point ``my-access-point`--usw - <Permission>ListBucketsAction</Permission> - <Permission>PutObjectAction</Permission> + <Permission>ListBucket</Permission> + <Permission>PutObject</Permission> @@ -59,0 +60,2 @@ The following method shows the scope of the access point ``my-access-point`--usw +You can use the AWS SDKs to view the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s + @@ -62 +64 @@ The following method shows the scope of the access point ``my-access-point`--usw -You can use the AWS Command Line Interface or REST API to modify the scope of your access points for directory buckets. access point scope is used to restrict access to specific prefixes, API operations, or a combination of both. +You can use the AWS Command Line Interface or REST API to modify the scope of your access points for directory buckets. Access point scope is used to restrict access to specific prefixes, API operations, or a combination of both. @@ -76 +78 @@ You can include one or more of the following actions as permissions: - * `AbortMultipartUpload` + * `AbortMultipartUploads` @@ -78 +80 @@ You can include one or more of the following actions as permissions: - * `ListBucketMultiPartUpload` + * `ListBucketMultipartUploads` @@ -80 +82 @@ You can include one or more of the following actions as permissions: - * `ListMultiPartUploadParts` + * `ListMultipartUploadParts` @@ -87 +89 @@ You can include one or more of the following actions as permissions: - * You can specify any amount of prefixes, but the total length of characters of all prefixes must be less than 256 KB in size. + * You can specify any amount of prefixes, but the total length of characters of all prefixes must be less than 256 bytes in size. @@ -99 +101,7 @@ The following command modifies the access point scope of ``my-access-point`--usw - aws s3control put-access-point-scope --name my-access-point--usw2-az1--xa-s3 --account-id 111122223333 --prefix prefix-1 --permission ListBuckets + aws s3control put-access-point-scope --name my-access-point--usw2-az1--xa-s3 --account-id 111122223333 --scope Prefixes=prefix-1 Permissions=ListBuckets + +###### Note + +You can use wildcards in prefixes by using the asterisk (*) character. If you want to use the asterisk character as a literal, add a backslash character (\\) before it to escape it. + +Also, all prefixes have an implicit '*' ending, meaning all paths withing the prefix will be included. @@ -101 +109 @@ The following command modifies the access point scope of ``my-access-point`--usw -The following `PutAccessPointScope` example command shows how you can use the REST API to modify the scope of your access point. +The following `PutAccessPointScope` example request shows how you can use the REST API to modify the scope of your access point. @@ -103 +111 @@ The following `PutAccessPointScope` example command shows how you can use the RE -The following method modifies the access point scope of ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. +The following request modifies the access point scope of ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. @@ -123 +131,5 @@ The following method modifies the access point scope of ``my-access-point`--usw2 -## Delete the scope of your access point for directory buckets +###### Note + +You can use wildcards in prefixes by using the asterisk (*) character. If you want to use the asterisk character as a literal, add a backslash character (\\) before it to escape it. + +Also, all prefixes have an implicit '*' ending, meaning all paths withing the prefix will be included. @@ -125 +137,5 @@ The following method modifies the access point scope of ``my-access-point`--usw2 -You can use the AWS Command Line Interface or REST API to delete the scope of your access point for directory buckets. +You can use the AWS SDKs to modify the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s + +## Delete the scope of your access points for directory buckets + +You can use the AWS Command Line Interface, REST API, or AWS SDKs to delete the scope of your access points for directory buckets. @@ -138 +154 @@ The following command deletes the scope of the access point ``my-access-point`-- -The following method deletes the scope of the access point ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. +The following request deletes the scope of the access point ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. @@ -145,0 +162,2 @@ The following method deletes the scope of the access point ``my-access-point`--u +You can use the AWS SDKs to delete the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s + @@ -152 +170 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Editing or deleting a policy for an access point for directory buckets +Editing or deleting policies for an access point for directory buckets