AWS cli documentation change
Summary
Updated tag-resource documentation to include directory buckets support, clarified tag purposes (cost tracking/access control), added s3express:TagResource permission requirement for directory buckets, and updated HTTP Host header syntax
Security assessment
The changes add documentation about required permissions (s3express:TagResource) for directory buckets and emphasize tag usage for access control. While this improves security documentation, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/cli/latest/reference/s3control/tag-resource.md b/cli/latest/reference/s3control/tag-resource.md index 5574722be..086c604cf 100644 --- a//cli/latest/reference/s3control/tag-resource.md +++ b//cli/latest/reference/s3control/tag-resource.md @@ -15 +15 @@ - * [AWS CLI 2.27.46 Command Reference](../../index.html) » + * [AWS CLI 2.27.49 Command Reference](../../index.html) » @@ -59 +59 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Creates a new Amazon Web Services resource tag or updates an existing resource tag. Each tag is a label consisting of a user-defined key and value. Tags can help you manage, identify, organize, search for, and filter resources. You can add up to 50 Amazon Web Services resource tags for each S3 resource. +Creates a new user-defined tag or updates an existing tag. Each tag is a label consisting of a key and value that is applied to your resource. Tags can help you organize, track costs for, and control access to your resources. You can add up to 50 Amazon Web Services resource tags for each S3 resource. @@ -63 +63,7 @@ Creates a new Amazon Web Services resource tag or updates an existing resource t -This operation is only supported for [S3 Storage Lens groups](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-lens-groups.html) and for [S3 Access Grants](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-tagging.html) . The tagged resource can be an S3 Storage Lens group or S3 Access Grants instance, registered location, or grant. +This operation is only supported for the following Amazon S3 resource: + + * [Directory buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-tagging.html) + * [S3 Storage Lens groups](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-lens-groups.html) + * [S3 Access Grants instances, registered locations, or grants](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-tagging.html) . + + @@ -67 +73 @@ Permissions -You must have the `s3:TagResource` permission to use this operation. +For Storage Lens groups and S3 Access Grants, you must have the `s3:TagResource` permission to use this operation. @@ -70,0 +77,8 @@ For more information about the required Storage Lens Groups permissions, see [Se +> Directory bucket permissions + +For directory buckets, you must have the `s3express:TagResource` permission to use this operation. For more information about directory buckets policies and permissions, see [Identity and Access Management (IAM) for S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-permissions.html) in the _Amazon S3 User Guide_ . + +> > HTTP Host header syntax +> +> **Directory buckets** \- The HTTP Host header syntax is `s3express-control.*region* .amazonaws.com` . + @@ -112 +126 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3cont -> The Amazon Resource Name (ARN) of the S3 resource that you’re trying to add tags to. The tagged resource can be an S3 Storage Lens group or S3 Access Grants instance, registered location, or grant. +> The Amazon Resource Name (ARN) of the S3 resource that you’re applying tags to. The tagged resource can be a directory bucket, S3 Storage Lens group or S3 Access Grants instance, registered location, or grant. @@ -120,5 +134 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3cont ->> An Amazon Web Services resource tag that’s associated with your S3 resource. You can add tags to new objects when you upload them, or you can add object tags to existing objects. ->> ->> ### Note ->> ->> This operation is only supported for [S3 Storage Lens groups](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-lens-groups.html) and for [S3 Access Grants](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-tagging.html) . The tagged resource can be an S3 Storage Lens group or S3 Access Grants instance, registered location, or grant. +>> A key-value pair that you use to label your resources. You can add tags to new resources when you create them, or you can add tags to existing resources. Tags can help you organize, track costs for, and control access to resources. @@ -263 +273 @@ None - * [AWS CLI 2.27.46 Command Reference](../../index.html) » + * [AWS CLI 2.27.49 Command Reference](../../index.html) »