AWS AmazonS3 medium security documentation change
Summary
Updated documentation to clarify access point policy management, added note about mandatory 's3express:CreateSession' action for session-based authorization, and expanded supported tools to include AWS SDKs.
Security assessment
The change explicitly states that policies must include 's3express:CreateSession' for session-based authorization. This is a security requirement to ensure proper access control, making it directly security-related and adding security documentation.
Diff
diff --git a/AmazonS3/latest/userguide/access-points-directory-buckets-policy.md b/AmazonS3/latest/userguide/access-points-directory-buckets-policy.md index 736d040a8..7ea10256a 100644 --- a//AmazonS3/latest/userguide/access-points-directory-buckets-policy.md +++ b//AmazonS3/latest/userguide/access-points-directory-buckets-policy.md @@ -5 +5 @@ -# Editing or deleting a policy for an access point for directory buckets +# Editing or deleting policies for an access point for directory buckets @@ -7 +7 @@ -Access point for directory buckets can include an IAM policy to control access to objects stored in the bucket with which the access point is associated. You can create, edit, and delete this policy using the AWS Command Line Interface or REST API. +Access points for directory buckets can include an AWS Identity and Access Management (IAM) policy to control access to the access point. You can create, edit, and delete this policy using the AWS Command Line Interface, REST API, or AWS SDKs. @@ -9 +9 @@ Access point for directory buckets can include an IAM policy to control access t -You can use the `get-acccess-point-policy`, `put-access-point-policy`, and `delete-access-point-policy` commands to view, edit, or delete an access point policy. For more information, see [`get-access-point-policy`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/get-access-point-policy.html#get-access-point-policy), [`put-access-point-policy`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/put-access-point-policy.html#put-access-point-policy), or [`delete-access-point-policy`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/delete-access-point-policy.html#delete-access-point-policy) in the AWS CLI Command Reference. +###### Note @@ -11 +11,7 @@ You can use the `get-acccess-point-policy`, `put-access-point-policy`, and `dele -You can use the REST API `GetAccessPointPolicy`, `PutAccessPointPolicy`, and `DeleteAccessPointPolicy` actions to view, create, edit, or delete an access point bucket IAM policy. For more information, see [PutAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicy.html), [GetAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicy.html), or [DeleteAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicy.html) in the Amazon Simple Storage Service API Reference. +Since directory buckets use session-based authorization, your policy must always include the `s3express:CreateSession` action. + +You can use the `get-acccess-point-policy`, `put-access-point-policy`, and `delete-access-point-policy` commands to view, edit, or delete an access point policy. For more information, see [get-access-point-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/get-access-point-policy.html#get-access-point-policy), [put-access-point-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/put-access-point-policy.html#put-access-point-policy), or [delete-access-point-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/delete-access-point-policy.html#delete-access-point-policy) in the AWS CLI Command Reference. + +You can use the REST API `GetAccessPointPolicy`, `PutAccessPointPolicy`, and `DeleteAccessPointPolicy` operations to view, create, edit, or delete an access point policy. For more information, see [PutAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicy.html), [GetAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicy.html), or [DeleteAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicy.html) in the Amazon Simple Storage Service API Reference. + +You can use the AWS SDKs to edit policies of your access points. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s @@ -19 +25 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -View details for your access point for directory buckets +View details for your access points for directory buckets