AWS AmazonS3 documentation change
Summary
Replaced detailed Java SDK code examples with a reference link to API documentation for S3 Batch Operations with Object Lock retention governance
Security assessment
The change removes specific implementation examples for applying/removing Object Lock retention governance but does not address any security vulnerability. While Object Lock retention governance is a security feature, this change only restructures documentation format rather than introducing new security information or addressing a specific security issue. The removed examples demonstrated security-related configurations (retention policies and bypass permissions), but their removal doesn't indicate a security fix.
Diff
diff --git a/AmazonS3/latest/userguide/batch-ops-governance-mode.md b/AmazonS3/latest/userguide/batch-ops-governance-mode.md index 2dd1a9268..fb3f1eb24 100644 --- a//AmazonS3/latest/userguide/batch-ops-governance-mode.md +++ b//AmazonS3/latest/userguide/batch-ops-governance-mode.md @@ -149 +149 @@ The following example builds on the previous example of creating a trust policy, -The following example builds on the previous example of creating a trust policy, and setting S3 Batch Operations and S3 Object Lock configuration permissions. This example shows how to apply S3 Object Lock retention governance with the `retain until date` set to January 30, 2025 across multiple objects. This example creates a Batch Operations job that uses the manifest bucket and reports the results in the reports bucket. +The following AWS SDK for Java examples show how to apply S3 Object Lock retention governance with the `retain until date` set to January 30, 2025 across multiple objects, including applying Object Lock retention governance across multiple objects with a retain until date and bypassing retention governance across multiple objects. @@ -151,140 +151 @@ The following example builds on the previous example of creating a trust policy, -###### Example — Apply S3 Object Lock retention governance across multiple objects with the retain until date of January 30, 2025 - - - public String createGovernanceRetentionJob(final AWSS3ControlClient awss3ControlClient) throws ParseException { - final String manifestObjectArn = "arn:aws:s3:::amzn-s3-demo-manifest-bucket/governance-objects-manifest.csv"; - final String manifestObjectVersionId = "15ad5ba069e6bbc465c77bf83d541385"; - - final JobManifestLocation manifestLocation = new JobManifestLocation() - .withObjectArn(manifestObjectArn) - .withETag(manifestObjectVersionId); - - final JobManifestSpec manifestSpec = - new JobManifestSpec() - .withFormat(JobManifestFormat.S3BatchOperations_CSV_20180820) - .withFields("Bucket", "Key"); - - final JobManifest manifestToPublicApi = new JobManifest() - .withLocation(manifestLocation) - .withSpec(manifestSpec); - - final String jobReportBucketArn = "arn:aws:s3:::amzn-s3-demo-completion-report-bucket"; - final String jobReportPrefix = "reports/governance-objects"; - - final JobReport jobReport = new JobReport() - .withEnabled(true) - .withReportScope(JobReportScope.AllTasks) - .withBucket(jobReportBucketArn) - .withPrefix(jobReportPrefix) - .withFormat(JobReportFormat.Report_CSV_20180820); - - final SimpleDateFormat format = new SimpleDateFormat("dd/MM/yyyy"); - final Date jan30th = format.parse("30/01/2025"); - - final JobOperation jobOperation = new JobOperation() - .withS3PutObjectRetention(new S3SetObjectRetentionOperation() - .withRetention(new S3Retention() - .withMode(S3ObjectLockRetentionMode.GOVERNANCE) - .withRetainUntilDate(jan30th))); - - final String roleArn = "arn:aws:iam::123456789012:role/batch_operations-object-lock"; - final Boolean requiresConfirmation = true; - final int priority = 10; - - final CreateJobRequest request = new CreateJobRequest() - .withAccountId("123456789012") - .withDescription("Put governance retention") - .withManifest(manifestToPublicApi) - .withOperation(jobOperation) - .withPriority(priority) - .withRoleArn(roleArn) - .withReport(jobReport) - .withConfirmationRequired(requiresConfirmation); - - final CreateJobResult result = awss3ControlClient.createJob(request); - - return result.getJobId(); - } - -###### Example — Bypass retention governance across multiple objects - -The following example builds on the previous example of creating a trust policy, and setting S3 Batch Operations and S3 Object Lock configuration permissions. This example shows how to bypass retention governance across multiple objects and creates a Batch Operations job that uses the manifest bucket and reports the results in the reports bucket. - - - public void allowBypassGovernance() { - final String roleName = "batch_operations-object-lock"; - - final String bypassGovernancePermissions = "{" + - " \"Version\": \"2012-10-17\"," + - " \"Statement\": [" + - " {" + - " \"Effect\": \"Allow\"," + - " \"Action\": [" + - " \"s3:BypassGovernanceRetention\"" + - " ]," + - " \"Resource\": [" + - " \"arn:aws:s3:::amzn-s3-demo-manifest-bucket/*\"" + - " ]" + - " }" + - " ]" + - "}"; - - final AmazonIdentityManagement iam = - AmazonIdentityManagementClientBuilder.defaultClient(); - - final PutRolePolicyRequest putRolePolicyRequest = new PutRolePolicyRequest() - .withPolicyDocument(bypassGovernancePermissions) - .withPolicyName("bypass-governance-permissions") - .withRoleName(roleName); - - final PutRolePolicyResult putRolePolicyResult = iam.putRolePolicy(putRolePolicyRequest); - } - public String createRemoveGovernanceRetentionJob(final AWSS3ControlClient awss3ControlClient) { - final String manifestObjectArn = "arn:aws:s3:::amzn-s3-demo-manifest-bucket/governance-objects-manifest.csv"; - final String manifestObjectVersionId = "15ad5ba069e6bbc465c77bf83d541385"; - - final JobManifestLocation manifestLocation = new JobManifestLocation() - .withObjectArn(manifestObjectArn) - .withETag(manifestObjectVersionId); - - final JobManifestSpec manifestSpec = - new JobManifestSpec() - .withFormat(JobManifestFormat.S3BatchOperations_CSV_20180820) - .withFields("Bucket", "Key"); - - final JobManifest manifestToPublicApi = new JobManifest() - .withLocation(manifestLocation) - .withSpec(manifestSpec); - - final String jobReportBucketArn = "arn:aws:s3:::amzn-s3-demo-completion-report-bucket"; - final String jobReportPrefix = "reports/batch_operations-governance"; - - final JobReport jobReport = new JobReport() - .withEnabled(true) - .withReportScope(JobReportScope.AllTasks) - .withBucket(jobReportBucketArn) - .withPrefix(jobReportPrefix) - .withFormat(JobReportFormat.Report_CSV_20180820); - - final JobOperation jobOperation = new JobOperation() - .withS3PutObjectRetention(new S3SetObjectRetentionOperation() - .withRetention(new S3Retention())); - - final String roleArn = "arn:aws:iam::123456789012:role/batch_operations-object-lock"; - final Boolean requiresConfirmation = true; - final int priority = 10; - - final CreateJobRequest request = new CreateJobRequest() - .withAccountId("123456789012") - .withDescription("Remove governance retention") - .withManifest(manifestToPublicApi) - .withOperation(jobOperation) - .withPriority(priority) - .withRoleArn(roleArn) - .withReport(jobReport) - .withConfirmationRequired(requiresConfirmation); - - final CreateJobResult result = awss3ControlClient.createJob(request); - - return result.getJobId(); - } +For examples of how to use Batch Operations with S3 Object Lock retention governance mode with the AWS SDK for Java, see [Use CreateJob with an AWS SDK or CLI](https://docs.aws.amazon.com/AmazonS3/latest/API/s3-control_example_s3-control_CreateJob_section.html) in the _Amazon S3 API Reference_.