AWS AmazonS3 documentation change
Summary
Added clarification that SessionMode parameter cannot be modified when using AWS CLI or SDKs
Security assessment
The change provides usage clarification about SessionMode restrictions but does not address security vulnerabilities or introduce new security features.
Diff
diff --git a/AmazonS3/latest/userguide/s3-express-create-session.md b/AmazonS3/latest/userguide/s3-express-create-session.md index da20fd32a..5b5e2fe18 100644 --- a//AmazonS3/latest/userguide/s3-express-create-session.md +++ b//AmazonS3/latest/userguide/s3-express-create-session.md @@ -7 +7 @@ -To use Zonal endpoint API operations (object-level, or data plane operations), except for `CopyObject` and `HeadBucket`, you use the `CreateSession` API operation to create and manage sessions that are optimized for low-latency authorization of data requests. To retrieve and use a session token, you must allow the `s3express:CreateSession` action for your directory bucket in an identity-based policy or a bucket policy. For more information, see [Authorizing Regional endpoint API operations with IAM](./s3-express-security-iam.html). If you're accessing S3 Express One Zone in the Amazon S3 console, through the AWS Command Line Interface (AWS CLI), or by using the AWS SDKs, S3 Express One Zone creates a session on your behalf. +To use Zonal endpoint API operations (object-level, or data plane operations), except for `CopyObject` and `HeadBucket`, you use the `CreateSession` API operation to create and manage sessions that are optimized for low-latency authorization of data requests. To retrieve and use a session token, you must allow the `s3express:CreateSession` action for your directory bucket in an identity-based policy or a bucket policy. For more information, see [Authorizing Regional endpoint API operations with IAM](./s3-express-security-iam.html). If you're accessing S3 Express One Zone in the Amazon S3 console, through the AWS Command Line Interface (AWS CLI), or by using the AWS SDKs, S3 Express One Zone creates a session on your behalf. However, you can't modify the `SessionMode` parameter when using the AWS CLI or AWS SDKs.