AWS AmazonS3 documentation change
Summary
Updated access point naming conventions, added VPC configuration examples, and restructured cross-account access point creation documentation.
Security assessment
The changes introduce documentation for restricting access points via VPC configurations (e.g., --vpc parameter and VpcConfiguration XML block), which is a security feature for network isolation. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/AmazonS3/latest/userguide/creating-access-points-directory-buckets.md b/AmazonS3/latest/userguide/creating-access-points-directory-buckets.md index 04e805412..e616a03c6 100644 --- a//AmazonS3/latest/userguide/creating-access-points-directory-buckets.md +++ b//AmazonS3/latest/userguide/creating-access-points-directory-buckets.md @@ -7 +7 @@ -You can create an access point for any directory bucket with the AWS CLI, REST API, or AWS SDKs. Each access point is associated with a single directory bucket, and you can create hundreds of access points per bucket. When creating an access point, you choose the name of the access point and the directory bucket to associate it with. The access point name consists of a base name that you provide and suffix that includes the AWS Dedicated Local Zone (DLZ) ID of your bucket location, followed by `--xa-s3`. For example, ``myaccesspoint`-`zoneid`--xa-s3`. +You can create an access point for any directory bucket with the AWS CLI, REST API, or AWS SDKs. Each access point is associated with a single directory bucket, and you can create hundreds of access points per bucket. When creating an access point, you choose the name of the access point and the directory bucket to associate it with. The access point name consists of a base name that you provide and suffix that includes the Zone ID of your bucket location, followed by `--xa-s3`. For example, ``myaccesspoint`-`zoneID`--xa-s3`. @@ -11 +11 @@ When creating an access point, you can also restrict access to the access point -After you create the access point, you can configure your access point IAM resource policy and use access point scope to restrict access to specific prefixes or API operations or a combination of both. For more information, see [Managing your access points for directory buckets](./access-points-directory-buckets-manage.html). +After you create the access point, you can configure your access point IAM resource policy and use the access point scope to restrict access to specific prefixes, API operations, or a combination of both. For more information, see [Managing your access points for directory buckets](./access-points-directory-buckets-manage.html). @@ -13 +13 @@ After you create the access point, you can configure your access point IAM resou -The following example command creates an access point named `example-ap` for the bucket `amzn-s3-demo-bucket-usw2-az1--x-s3` in the account `111122223333`. To create the access point for a directory bucket, you send a request to Amazon S3 that specifies the following: +The following example command creates an access point named `example-ap` for the bucket ``amzn-s3-demo-bucket`--`zone-id`--x-s3` in the account `111122223333`. @@ -15 +14,0 @@ The following example command creates an access point named `example-ap` for the - * The access point name, consisting of a base name that you provide and suffix that includes the ZoneID (AWS Availability Zone) of your bucket location, followed by `--xa-s3`. For information about naming rules, see [Referencing access points for directory buckets](./access-points-directory-buckets-naming.html). @@ -17 +16 @@ The following example command creates an access point named `example-ap` for the - * The name of the bucket that you want to associate the access point with. + aws s3control create-access-point --name example-ap--zoneID--xa-s3 --account-id 111122223333 --bucket amzn-s3-demo-bucket--zone-id--x-s3 @@ -19 +18 @@ The following example command creates an access point named `example-ap` for the - * The AWS account ID that owns the access point. +To restrict access to the access point through a VPC, include the `--vpc` parameter and the VPC ID. @@ -21,0 +21 @@ The following example command creates an access point named `example-ap` for the + aws s3control create-access-point --name example-ap--zoneID--xa-s3 --account-id 111122223333 --bucket amzn-s3-demo-bucket--zone-id--x-s3 --vpc vpc-id @@ -22,0 +23 @@ The following example command creates an access point named `example-ap` for the +When you create an access point for a cross-account bucket, include the `--bucket-account-id` parameter. The following example command creates an access point in the AWS account `111122223333`, for the bucket ``amzn-s3-demo-bucket`--`zone-id`--x-s3`, owned by the AWS account `444455556666`. @@ -25 +26 @@ The following example command creates an access point named `example-ap` for the - aws s3control create-access-point --name example-ap--usw2-az1--xa-s3 --account-id 111122223333 --bucket amzn-s3-demo-bucket--usw2-az2--x-s3 + aws s3control create-access-point --name example-ap--zoneID--xa-s3 --account-id 111122223333 --bucket amzn-s3-demo-bucket--zone-id--x-s3 --bucket-account-id 444455556666 @@ -27 +28 @@ The following example command creates an access point named `example-ap` for the -When you create an access point for a cross-account bucket, include the `--bucket-account-id` parameter. The following example command creates an access point in the AWS account `111122223333`, for the bucket `amzn-s3-demo-bucket2--usw2-az1--x-s3`, owned by the AWS account `444455556666`. +For more information and examples, see [create-access-point](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/create-access-point.html) in the AWS CLI Command Reference. @@ -28,0 +30 @@ When you create an access point for a cross-account bucket, include the `--bucke +The following example command creates an access point named `example-ap` for the bucket ``amzn-s3-demo-bucket`--`zone-id`--x-s3` in the account `111122223333` and access restricted through the VPC `vpc-id` (optional). @@ -30 +31,0 @@ When you create an access point for a cross-account bucket, include the `--bucke - aws s3control create-access-point --name example-ap--usw2-az1--xa-s3 --account-id 111122223333 --bucket amzn-s3-demo-bucket--usw2-az1--x-s3 --bucket-account-id 444455556666 @@ -32,16 +33,2 @@ When you create an access point for a cross-account bucket, include the `--bucke -After you create the access point, modify it to add a scope and a policy, if necessary. For more information, see [Managing your access points for directory buckets](./access-points-directory-buckets-manage.html) - -The following example command creates an access point named `example-ap` for the bucket `amzn-s3-demo-bucket``-usw2-az1--x-s3` in the account `111122223333`. To create the access point for a directory bucket, you send a request to Amazon S3 that specifies the following: - - * The access point name. For information about naming rules, see [Referencing access points for directory buckets](./access-points-directory-buckets-naming.html). - - * The bucket name that you want to associate the access point with. - - * The AWS account that owns the access point. - - - - - - PUT /v20180820/accesspoint/example-ap--usw2-az1--xa-s3 HTTP/1.1 - Host: s3express-control.us-west-2.amazonaws.com + PUT /v20180820/accesspoint/example-ap--zoneID--xa-s3 HTTP/1.1 + Host: s3express-control.region.amazonaws.com @@ -51 +38 @@ The following example command creates an access point named `example-ap` for the - <Bucket>amzn-s3-demo-bucket--usw2-az1--x-s3</Bucket> + <Bucket>amzn-s3-demo-bucket--zone-id--x-s3s</Bucket> @@ -52,0 +40,3 @@ The following example command creates an access point named `example-ap` for the + <VpcConfiguration> + <VpcId>vpc-id</VpcId> + </VpcConfiguration> @@ -63 +53 @@ Response: - "arn:aws:s3express:us-west-2:111122223333:accesspoint/example-ap--usw2-az1--xa-s3" + "arn:aws:s3express:region:111122223333:accesspoint/example-ap--zoneID--xa-s3" @@ -65 +55 @@ Response: - <Alias>example-ap--usw2-az1--xa-s3</Alias> + <Alias>example-ap--zoneID--xa-s3</Alias> @@ -69,3 +59 @@ Response: -After you create the access point, modify it to add a scope and a policy, if necessary. For more information, see [Managing your access points for directory buckets](./access-points-directory-buckets-manage.html) - -You can use the AWS SDKs to create an access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html#API_CreateBucketMetadataTableConfiguration_SeeAlso) in the Amazon Simple Storage Service API Reference.s +You can use the AWS SDKs to create an access point. For more information, see [list of supported SDKs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessPoint.html#API_control_CreateAccessPoint_SeeAlso) in the Amazon Simple Storage Service API Reference.