AWS cli medium security documentation change
Summary
Updated documentation to deprecate V1 API operations and add warnings/notes about required permissions and migration to V2 APIs
Security assessment
The changes add explicit warnings about required permissions (including s3tables and kms permissions) and KMS key policies for encryption. These updates help prevent misconfigurations that could lead to AccessDenied errors or insecure resource policies. The documentation now emphasizes proper security controls for metadata table configurations.
Diff
diff --git a/cli/latest/reference/s3api/get-bucket-metadata-table-configuration.md b/cli/latest/reference/s3api/get-bucket-metadata-table-configuration.md index 6f9abf6b5..cba8040b6 100644 --- a//cli/latest/reference/s3api/get-bucket-metadata-table-configuration.md +++ b//cli/latest/reference/s3api/get-bucket-metadata-table-configuration.md @@ -14,2 +14,2 @@ - * [previous](get-bucket-logging.html "get-bucket-logging") | - * [AWS CLI 2.27.50 Command Reference](../../index.html) » + * [previous](get-bucket-metadata-configuration.html "get-bucket-metadata-configuration") | + * [AWS CLI 2.27.51 Command Reference](../../index.html) » @@ -22 +22 @@ - * [← get-bucket-logging](get-bucket-logging.html "previous chapter \(use the left arrow\)") / + * [← get-bucket-metadata-configuration](get-bucket-metadata-configuration.html "previous chapter \(use the left arrow\)") / @@ -59 +59 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Retrieves the metadata table configuration for a general purpose bucket. For more information, see [Accelerating data discovery with S3 Metadata](https://docs.aws.amazon.com/AmazonS3/latest/userguide/metadata-tables-overview.html) in the _Amazon S3 User Guide_ . +### Warning @@ -61 +61,13 @@ Retrieves the metadata table configuration for a general purpose bucket. For mor -> Permissions +We recommend that you retrieve your S3 Metadata configurations by using the V2 [GetBucketMetadataTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetadataTableConfiguration.html) API operation. We no longer recommend using the V1 `GetBucketMetadataTableConfiguration` API operation. + +If you created your S3 Metadata configuration before July 15, 2025, we recommend that you delete and re-create your configuration by using [CreateBucketMetadataConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataConfiguration.html) so that you can expire journal table records and create a live inventory table. + +Retrieves the V1 S3 Metadata configuration for a general purpose bucket. For more information, see [Accelerating data discovery with S3 Metadata](https://docs.aws.amazon.com/AmazonS3/latest/userguide/metadata-tables-overview.html) in the _Amazon S3 User Guide_ . + +### Note + +You can use the V2 `GetBucketMetadataConfiguration` API operation with V1 or V2 metadata table configurations. However, if you try to use the V1 `GetBucketMetadataTableConfiguration` API operation with V2 configurations, you will receive an HTTP `405 Method Not Allowed` error. + +Make sure that you update your processes to use the new V2 API operations (`CreateBucketMetadataConfiguration` , `GetBucketMetadataConfiguration` , and `DeleteBucketMetadataConfiguration` ) instead of the V1 API operations. + +Permissions @@ -106 +118 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 -> The general purpose bucket that contains the metadata table configuration that you want to retrieve. +> The general purpose bucket that corresponds to the metadata table configuration that you want to retrieve. @@ -110 +122 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 -> The expected owner of the general purpose bucket that you want to retrieve the metadata table configuration from. +> The expected owner of the general purpose bucket that you want to retrieve the metadata table configuration for. @@ -217 +229 @@ GetBucketMetadataTableConfigurationResult -> (structure) ->> The metadata table configuration for a general purpose bucket. +>> The V1 S3 Metadata configuration for a general purpose bucket. @@ -244 +256 @@ GetBucketMetadataTableConfigurationResult -> (structure) ->> * `ACTIVE` \- The metadata table has been created successfully and records are being delivered to the table. +>> * `ACTIVE` \- The metadata table has been created successfully, and records are being delivered to the table. @@ -255 +267 @@ GetBucketMetadataTableConfigurationResult -> (structure) ->>> If the `CreateBucketMetadataTableConfiguration` request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows: +>>> If the V1 `CreateBucketMetadataTableConfiguration` request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows: @@ -264,0 +277,13 @@ GetBucketMetadataTableConfigurationResult -> (structure) +>>> +>>> If the V2 `CreateBucketMetadataConfiguration` request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows: +>>> +>>> * `AccessDeniedCreatingResources` \- You don’t have sufficient permissions to create the required resources. Make sure that you have `s3tables:CreateTableBucket` , `s3tables:CreateNamespace` , `s3tables:CreateTable` , `s3tables:GetTable` , `s3tables:PutTablePolicy` , `kms:DescribeKey` , and `s3tables:PutTableEncryption` permissions. Additionally, ensure that the KMS key used to encrypt the table still exists, is active and has a resource policy granting access to the S3 service principals ‘`maintenance.s3tables.amazonaws.com` ‘ and ‘`metadata.s3.amazonaws.com` ‘. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `AccessDeniedWritingToTable` \- Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `DestinationTableNotFound` \- The destination table doesn’t exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `ServerInternalError` \- An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `JournalTableAlreadyExists` \- A journal table already exists in the Amazon Web Services managed table bucket’s namespace. Delete the journal table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `InventoryTableAlreadyExists` \- An inventory table already exists in the Amazon Web Services managed table bucket’s namespace. Delete the inventory table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `JournalTableNotAvailable` \- The journal table that the inventory table relies on has a `FAILED` status. An inventory table requires a journal table with an `ACTIVE` status. To create a new journal or inventory table, you must delete the metadata configuration for this bucket, along with any journal or inventory tables, and then create a new metadata configuration. +>>> * `NoSuchBucket` \- The specified general purpose bucket does not exist. +>>> + @@ -268 +293 @@ GetBucketMetadataTableConfigurationResult -> (structure) ->>> If the `CreateBucketMetadataTableConfiguration` request succeeds, but S3 Metadata was unable to create the table, this structure contains the error message. The possible error codes and error messages are as follows: +>>> If the V1 `CreateBucketMetadataTableConfiguration` request succeeds, but S3 Metadata was unable to create the table, this structure contains the error message. The possible error codes and error messages are as follows: @@ -277,0 +303,13 @@ GetBucketMetadataTableConfigurationResult -> (structure) +>>> +>>> If the V2 `CreateBucketMetadataConfiguration` request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows: +>>> +>>> * `AccessDeniedCreatingResources` \- You don’t have sufficient permissions to create the required resources. Make sure that you have `s3tables:CreateTableBucket` , `s3tables:CreateNamespace` , `s3tables:CreateTable` , `s3tables:GetTable` , `s3tables:PutTablePolicy` , `kms:DescribeKey` , and `s3tables:PutTableEncryption` permissions. Additionally, ensure that the KMS key used to encrypt the table still exists, is active and has a resource policy granting access to the S3 service principals ‘`maintenance.s3tables.amazonaws.com` ‘ and ‘`metadata.s3.amazonaws.com` ‘. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `AccessDeniedWritingToTable` \- Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `DestinationTableNotFound` \- The destination table doesn’t exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `ServerInternalError` \- An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `JournalTableAlreadyExists` \- A journal table already exists in the Amazon Web Services managed table bucket’s namespace. Delete the journal table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `InventoryTableAlreadyExists` \- An inventory table already exists in the Amazon Web Services managed table bucket’s namespace. Delete the inventory table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration. +>>> * `JournalTableNotAvailable` \- The journal table that the inventory table relies on has a `FAILED` status. An inventory table requires a journal table with an `ACTIVE` status. To create a new journal or inventory table, you must delete the metadata configuration for this bucket, along with any journal or inventory tables, and then create a new metadata configuration. +>>> * `NoSuchBucket` \- The specified general purpose bucket does not exist. +>>> + @@ -279 +317 @@ GetBucketMetadataTableConfigurationResult -> (structure) - * [← get-bucket-logging](get-bucket-logging.html "previous chapter \(use the left arrow\)") / + * [← get-bucket-metadata-configuration](get-bucket-metadata-configuration.html "previous chapter \(use the left arrow\)") / @@ -288,2 +326,2 @@ GetBucketMetadataTableConfigurationResult -> (structure) - * [previous](get-bucket-logging.html "get-bucket-logging") | - * [AWS CLI 2.27.50 Command Reference](../../index.html) » + * [previous](get-bucket-metadata-configuration.html "get-bucket-metadata-configuration") | + * [AWS CLI 2.27.51 Command Reference](../../index.html) »