AWS AmazonS3 documentation change
Summary
Updated documentation for creating access points for directory buckets, including naming conventions, VPC restrictions, IAM policy configuration, and SDK support. Added details about access point scope management and updated links.
Security assessment
The changes clarify security-related configurations (VPC restrictions, IAM policies, and session-based authorization requirements) but do not address a specific security vulnerability. The updates enhance documentation about existing security features.
Diff
diff --git a/AmazonS3/latest/userguide/creating-access-points-directory-buckets.md b/AmazonS3/latest/userguide/creating-access-points-directory-buckets.md index 8d050d0da..04e805412 100644 --- a//AmazonS3/latest/userguide/creating-access-points-directory-buckets.md +++ b//AmazonS3/latest/userguide/creating-access-points-directory-buckets.md @@ -5 +5 @@ -# Creating an access point for directory buckets +# Creating access points for directory buckets @@ -7 +7 @@ -You can create access points for directory buckets by using the AWS Command Line Interface (AWS CLI) or Amazon S3 REST API. +You can create an access point for any directory bucket with the AWS CLI, REST API, or AWS SDKs. Each access point is associated with a single directory bucket, and you can create hundreds of access points per bucket. When creating an access point, you choose the name of the access point and the directory bucket to associate it with. The access point name consists of a base name that you provide and suffix that includes the AWS Dedicated Local Zone (DLZ) ID of your bucket location, followed by `--xa-s3`. For example, ``myaccesspoint`-`zoneid`--xa-s3`. @@ -9 +9 @@ You can create access points for directory buckets by using the AWS Command Line -You can create an access point in three steps. First, you can create an access point for any new or existing directory bucket with the AWS CLI, REST API, or AWS SDK. Each access point is associated with a single directory bucket, and you can create hundreds of access points per bucket. The access point name consists of a base name that you provide and suffix that includes the `ZoneID` (AWS Dedicated Local Zone (DLZ)) of your bucket location, followed by `--xa-s3`. For example, `myaccesspoint-zoneid--xa-s3`. Second, in the access point configuration, you can restrict access to a Virtual Private Cloud (VPC), prefixes, or API actions. Third, configure your access point IAM resource policy. Since directory buckets use session-based authorization, your policy must always include the `s3express:CreateSession` action. Then, you can immediately begin reading and writing data through your access point, just like you use a directory bucket name. +When creating an access point, you can also restrict access to the access point through a Virtual Private Cloud (VPC). Then, you can immediately begin reading and writing data through your access point by using its name, just like you use a directory bucket name. @@ -11 +11 @@ You can create an access point in three steps. First, you can create an access p -After you create the access point, you can modify its scope or create an IAM policy for it. For more information, see [Managing your access points for directory buckets](./access-points-directory-buckets-manage.html). +After you create the access point, you can configure your access point IAM resource policy and use access point scope to restrict access to specific prefixes or API operations or a combination of both. For more information, see [Managing your access points for directory buckets](./access-points-directory-buckets-manage.html). @@ -15 +15 @@ The following example command creates an access point named `example-ap` for the - * The access point name, consisting of a base name that you provide and suffix that includes the ZoneID (AWS Availability Zone) of your bucket location, followed by `--xa-s3`. For information about naming rules, see [Naming rules for access points for directory buckets](./access-points-directory-buckets-restrictions-limitations-naming-rules.html#access-points-directory-buckets-names). + * The access point name, consisting of a base name that you provide and suffix that includes the ZoneID (AWS Availability Zone) of your bucket location, followed by `--xa-s3`. For information about naming rules, see [Referencing access points for directory buckets](./access-points-directory-buckets-naming.html). @@ -36 +36 @@ The following example command creates an access point named `example-ap` for the - * The access point name. For information about naming rules, see [Naming rules for access points for directory buckets](./access-points-directory-buckets-restrictions-limitations-naming-rules.html#access-points-directory-buckets-names). + * The access point name. For information about naming rules, see [Referencing access points for directory buckets](./access-points-directory-buckets-naming.html). @@ -68,0 +69,4 @@ Response: +After you create the access point, modify it to add a scope and a policy, if necessary. For more information, see [Managing your access points for directory buckets](./access-points-directory-buckets-manage.html) + +You can use the AWS SDKs to create an access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s +