AWS AmazonS3 documentation change
Summary
Updated API operation names and permissions for metadata table configurations, added V2 API operations with new permissions (s3tables:CreateTableBucket, s3tables:PutTableEncryption, kms:DescribeKey), and clarified encryption requirements
Security assessment
The changes add documentation about required KMS permissions for encrypting metadata tables with SSE-KMS, which is a security feature. However, there is no evidence this addresses an existing security vulnerability - it appears to be routine documentation of security controls for a feature.
Diff
diff --git a/AmazonS3/latest/userguide/using-with-s3-policy-actions.md b/AmazonS3/latest/userguide/using-with-s3-policy-actions.md index 46d7feae2..77030ec08 100644 --- a//AmazonS3/latest/userguide/using-with-s3-policy-actions.md +++ b//AmazonS3/latest/userguide/using-with-s3-policy-actions.md @@ -75 +75,2 @@ API operations | Policy actions | Description of policy actions -[CreateBucketMetadataTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html) | (Required) `s3:CreateBucketMetadataTableConfiguration`, `s3tables:CreateNamespace`, `s3tables:CreateTable`, `s3tables:GetTable`, `s3tables:PutTablePolicy` | Required to create a metadata table configuration on a general purpose bucket. To create the metadata table in the table bucket that's specified in your metadata table configuration, you must have the specified `s3tables` permissions. If you also want to integrate your table bucket with AWS analytics services so that you can query your metadata table, you need additional permissions. For more information, see [Integrating Amazon S3 Tables with AWS analytics services](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html). +[CreateBucketMetadataConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataConfiguration.html) (V2 API operation. The IAM policy action name is the same for the V1 and V2 API operations.) | (Required) `s3:CreateBucketMetadataTableConfiguration`, `s3tables:CreateTableBucket`, `s3tables:CreateNamespace`, `s3tables:CreateTable`, `s3tables:GetTable`, `s3tables:PutTablePolicy`, `s3tables:PutTableEncryption`, `kms:DescribeKey` | Required to create a metadata table configuration on a general purpose bucket. To create your AWS managed table bucket and the metadata tables that are specified in your metadata table configuration, you must have the specified `s3tables` permissions. If you want to encrypt your metadata tables with server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS), you need additional permissions in your KMS key policy. For more information, see [Setting up permissions for configuring metadata tables](./metadata-tables-permissions.html). If you also want to integrate your AWS managed table bucket with AWS analytics services so that you can query your metadata table, you need additional permissions. For more information, see [Integrating Amazon S3 Tables with AWS analytics services](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html). +[CreateBucketMetadataTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html) (V1 API operation) | (Required) `s3:CreateBucketMetadataTableConfiguration`, `s3tables:CreateNamespace`, `s3tables:CreateTable`, `s3tables:GetTable`, `s3tables:PutTablePolicy` | Required to create a metadata table configuration on a general purpose bucket. To create the metadata table in the table bucket that's specified in your metadata table configuration, you must have the specified `s3tables` permissions. If you want to encrypt your metadata tables with server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS), you need additional permissions. For more information, see [Setting up permissions for configuring metadata tables](./metadata-tables-permissions.html). If you also want to integrate your table bucket with AWS analytics services so that you can query your metadata table, you need additional permissions. For more information, see [Integrating Amazon S3 Tables with AWS analytics services](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html). @@ -83 +84,2 @@ API operations | Policy actions | Description of policy actions -[DeleteBucketMetadataTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetadataTableConfiguration.html) | (Required) `s3:DeleteBucketMetadataTableConfiguration` | Required to delete a metadata table configuration from a general purpose bucket. +[DeleteBucketMetadataConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetadataTableConfiguration.html) (V2 API operation. The IAM policy action name is the same for the V1 and V2 API operations.) | (Required) `s3:DeleteBucketMetadataTableConfiguration` | Required to delete a metadata table configuration from a general purpose bucket. +[DeleteBucketMetadataTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetadataTableConfiguration.html) (V1 API operation) | (Required) `s3:DeleteBucketMetadataTableConfiguration` | Required to delete a metadata table configuration from a general purpose bucket. @@ -101 +103,2 @@ API operations | Policy actions | Description of policy actions -[GetBucketMetadataTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetadataTableConfiguration.html) | (Required) `s3:GetBucketMetadataTableConfiguration` | Required to retrieve a metadata table configuration for a general purpose bucket. +[GetBucketMetadataConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetadataTableConfiguration.html) (V2 API operation. The IAM policy action name is the same for the V1 and V2 API operations.) | (Required) `s3:GetBucketMetadataTableConfiguration` | Required to retrieve a metadata table configuration for a general purpose bucket. +[GetBucketMetadataTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetadataTableConfiguration.html) (V1 API operation) | (Required) `s3:GetBucketMetadataTableConfiguration` | Required to retrieve a metadata table configuration for a general purpose bucket. @@ -143,0 +147,2 @@ API operations | Policy actions | Description of policy actions +[UpdateBucketMetadataInventoryTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_UpdateBucketMetadataInventoryTableConfiguration.html) | (Required) `s3:UpdateBucketMetadataInventoryTableConfiguration`, `s3tables:CreateTableBucket`, `s3tables:CreateNamespace`, `s3tables:CreateTable`, `s3tables:GetTable`, `s3tables:PutTablePolicy`, `s3tables:PutTableEncryption`, `kms:DescribeKey` | Required to enable or disable an inventory table for a metadata table configuration on a general purpose bucket. If you want to encrypt your inventory table with server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS), you need additional permissions in your KMS key policy. For more information, see [Setting up permissions for configuring metadata tables](./metadata-tables-permissions.html). +[UpdateBucketMetadataJournalTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_UpdateBucketMetadataJournalTableConfiguration.html) | (Required) `s3:UpdateBucketMetadataJournalTableConfiguration` | Required to enable or disable journal table record expiration for a metadata table configuration on a general purpose bucket.