AWS AmazonS3 documentation change
Summary
Updated documentation for managing access point scopes in directory buckets with expanded examples, corrected syntax, and added AWS SDK support. Added detailed examples for get/put/delete-access-point-scope operations, clarified wildcard usage in prefixes, and fixed API reference links.
Security assessment
The changes improve documentation about access control scopes (permissions and prefixes) which are security features, but there is no evidence of addressing a specific security vulnerability. The updates clarify how to properly restrict access using security controls like ListBucket/PutObject permissions and prefix patterns.
Diff
diff --git a/AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md b/AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md index 716f23085..ac7f21dda 100644 --- a//AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md +++ b//AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md @@ -24 +24 @@ This section explains how to view and modify the scope of your access points for -You can use the AWS Command Line Interface or REST API to view the scope of your access point for directory buckets. +You can use the AWS Command Line Interface, REST API, or AWS SDKs to view the scope of your access point for directory buckets. @@ -27,0 +28,22 @@ The following `get-access-point-scope` example command shows how you can use the +The following command shows the scope of the access point ``my-access-point``\--`zoneID`\--xa-s3 for AWS account `111122223333`. + + + aws s3control get-access-point-scope --name my-access-point--zoneID--xa-s3 --account-id 111122223333 + +For more information and examples, see [get-access-point-scope](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/get-access-point-scope.html) in the AWS CLI Command Reference. + +###### Example result of `get-access-point-scope` + + + { + "Scope": { + "Permissions": [ + "ListBucket", + "PutObject" + ] + "Prefixes": [ + "Prefix": "MyPrefix1*", + "Prefix": "MyObjectName.csv" + ] + } + } @@ -29 +50,0 @@ The following `get-access-point-scope` example command shows how you can use the - aws s3control get-access-point-scope --name my-access-point--usw2-az1--xa-s3 --account-id 111122223333 @@ -33 +54 @@ The following `GetAccessPointScope` example request shows how you can use the RE -The following request shows the scope of the access point ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. +The following request shows the scope of the access point ``my-access-point``\--`region`-`zoneID`\--xa-s3 for AWS account `111122223333`. @@ -36,2 +57,2 @@ The following request shows the scope of the access point ``my-access-point`--us - GET /v20180820/accesspoint/my-access-point--usw2-az1--xa-s3/scope HTTP/1.1 - Host: s3express-control.us-west-2.amazonaws.com + GET /v20180820/accesspoint/my-access-point--zoneID--xa-s3/scope HTTP/1.1 + Host: s3express-control.region.amazonaws.com @@ -49,2 +70,2 @@ The following request shows the scope of the access point ``my-access-point`--us - <Prefix>*Cats*</Prefix> - <Prefix>*Dogs*</Prefix> + <Prefix>MyPrefix1*</Prefix> + <Prefix>MyObjectName.csv</Prefix> @@ -60 +81 @@ The following request shows the scope of the access point ``my-access-point`--us -You can use the AWS SDKs to view the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s +You can use the AWS SDKs to view the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointScope.html#API_control_GetAccessPointScope_SeeAlso) in the Amazon Simple Storage Service API Reference. @@ -64 +85 @@ You can use the AWS SDKs to view the scope of your access point. For more inform -You can use the AWS Command Line Interface or REST API to modify the scope of your access points for directory buckets. Access point scope is used to restrict access to specific prefixes, API operations, or a combination of both. +You can use the AWS Command Line Interface, REST API, or AWS SDKs to modify the scope of your access points for directory buckets. Access point scope is used to restrict access to specific prefixes, API operations, or a combination of both. @@ -66 +87 @@ You can use the AWS Command Line Interface or REST API to modify the scope of yo -You can include one or more of the following actions as permissions: +You can include one or more of the following API operations as permissions: @@ -74 +95 @@ You can include one or more of the following actions as permissions: - * `ListBucket` + * `ListBucket` (required for `ListObjectsV2`) @@ -98,4 +119 @@ The following `put-access-point-scope` example command shows how you can use the -The following command modifies the access point scope of ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. - - - aws s3control put-access-point-scope --name my-access-point--usw2-az1--xa-s3 --account-id 111122223333 --scope Prefixes=prefix-1 Permissions=ListBuckets +The following command modifies the access point scope of ``my-access-point``\--`zoneID`\--xa-s3 for AWS account `111122223333`. @@ -108,0 +127,5 @@ Also, all prefixes have an implicit '*' ending, meaning all paths withing the pr + + aws s3control put-access-point-scope --name my-access-point--zoneID--xa-s3 --account-id 111122223333 --scope Prefixes=string,Permissions=string + +For more information and examples, see [put-access-point-scope](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/put-access-point-scope.html) in the AWS CLI Command Reference. + @@ -111 +134,7 @@ The following `PutAccessPointScope` example request shows how you can use the RE -The following request modifies the access point scope of ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. +The following request modifies the access point scope of ``my-access-point``\--`zoneID`\--xa-s3 for AWS account `111122223333`. + +###### Note + +You can use wildcards in prefixes by using the asterisk (*) character. If you want to use the asterisk character as a literal, add a backslash character (\\) before it to escape it. + +Also, all prefixes have an implicit '*' ending, meaning all paths withing the prefix will be included. @@ -114,2 +143,2 @@ The following request modifies the access point scope of ``my-access-point`--usw - PUT /v20180820/accesspoint/my-access-point--usw2-az1--xa-s3/scope HTTP/1.1 - Host: s3express-control.us-west-2.amazonaws.com + PUT /v20180820/accesspoint/my-access-point--zoneID--xa-s3/scope HTTP/1.1 + Host: s3express-control.region.amazonaws.com @@ -131,7 +160 @@ The following request modifies the access point scope of ``my-access-point`--usw -###### Note - -You can use wildcards in prefixes by using the asterisk (*) character. If you want to use the asterisk character as a literal, add a backslash character (\\) before it to escape it. - -Also, all prefixes have an implicit '*' ending, meaning all paths withing the prefix will be included. - -You can use the AWS SDKs to modify the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s +You can use the AWS CLI, AWS SDKs, or REST API to modify the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointScope.html#API_control_PutAccessPointScope_SeeAlso) in the Amazon Simple Storage Service API Reference. @@ -147 +170,3 @@ When you delete the scope of an access point, all prefixes and permissions are d -The following `put-access-point-scope` example command shows how you can use the AWS CLI to delete the scope of your access point. +The following `delete-access-point-scope` example command shows how you can use the AWS CLI to delete the scope of your access point. + +The following command deletes the scope of the access point ``my-access-point``\--`zoneID`\--xa-s3 for AWS account `111122223333`. @@ -149 +173,0 @@ The following `put-access-point-scope` example command shows how you can use the -The following command deletes the scope of the access point ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. @@ -150,0 +175 @@ The following command deletes the scope of the access point ``my-access-point`-- + aws s3control delete-access-point-scope --name my-access-point--region-zoneID--xa-s3 --account-id 111122223333 @@ -152 +177 @@ The following command deletes the scope of the access point ``my-access-point`-- - aws s3control delete-access-point-scope --name my-access-point--usw2-az1--xa-s3 --account-id 111122223333 +For more information and examples, see [delete-access-point-scope](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/delete-access-point-scope.html) in the AWS CLI Command Reference. @@ -154 +179 @@ The following command deletes the scope of the access point ``my-access-point`-- -The following request deletes the scope of the access point ``my-access-point`--usw2-az1--xa-s3` for AWS account `111122223333`. +The following request deletes the scope of the access point ``my-access-point``\--`zoneID`\--xa-s3 for AWS account `111122223333`. @@ -157,2 +182,2 @@ The following request deletes the scope of the access point ``my-access-point`-- - DELETE /v20180820/accesspoint/my-access-point--usw2-az1--xa-s3/scope HTTP/1.1 - Host: s3express-control.us-west-2.amazonaws.com + DELETE /v20180820/accesspoint/my-access-point--zoneID--xa-s3/scope HTTP/1.1 + Host: s3express-control.region.amazonaws.com @@ -162 +187 @@ The following request deletes the scope of the access point ``my-access-point`-- -You can use the AWS SDKs to delete the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s +You can use the AWS SDKs to delete the scope of your access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointScope.html#API_control_DeleteAccessPointScope_SeeAlso) in the Amazon Simple Storage Service API Reference. @@ -170 +195 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Editing or deleting policies for an access point for directory buckets +Viewing, editing or deleting access point policies