AWS AmazonS3 documentation change

Service: AmazonS3 · 2025-08-22 · Documentation low

File: AmazonS3/latest/userguide/batch-ops-object-lock.md

Summary

Replaced detailed IAM role creation code example with a link to a GitHub repository for S3 Object Lock Batch Operations

Security assessment

The change removes a Java SDK implementation example for IAM role configuration and replaces it with an external code reference. While IAM permissions are security-related, this is a documentation reorganization rather than a security update. No specific security vulnerability or new security guidance is introduced.

Diff

diff --git a/AmazonS3/latest/userguide/batch-ops-object-lock.md b/AmazonS3/latest/userguide/batch-ops-object-lock.md
index 4cd723213..360a71fae 100644
--- a//AmazonS3/latest/userguide/batch-ops-object-lock.md
+++ b//AmazonS3/latest/userguide/batch-ops-object-lock.md
@@ -91 +91 @@ In this step, you allow the role to do the following:
-The following examples show how to create an IAM role with S3 Batch Operations permissions, and update the role permissions to create jobs that enable Object Lock by using the AWS SDK for Java. You must also have a `CSV` manifest identifying the objects for your S3 Batch Operations job. For more information, see [Specifying a manifest](./batch-ops-create-job.html#specify-batchjob-manifest).
+You can create an IAM role with S3 Batch Operations permissions, and update the role permissions to create jobs that enable Object Lock by using the AWS SDK for Java. You must also have a `CSV` manifest identifying the objects for your S3 Batch Operations job. For more information, see [Specifying a manifest](./batch-ops-create-job.html#specify-batchjob-manifest).
@@ -110,69 +110 @@ You allow the role to do the following:
-    
-    public void createObjectLockRole() {
-        final String roleName = "batch_operations-object-lock";
-    
-        final String trustPolicy = "{" +
-                "  \"Version\": \"2012-10-17\", " +
-                "  \"Statement\": [ " +
-                "    { " +
-                "      \"Effect\": \"Allow\", " +
-                "      \"Principal\": { " +
-                "        \"Service\": [" +
-                "          \"batchoperations.s3.amazonaws.com\"" +
-                "        ]" +
-                "      }, " +
-                "      \"Action\": \"sts:AssumeRole\" " +
-                "    } " +
-                "  ]" +
-                "}";
-    
-        final String bopsPermissions = "{" +
-                "    \"Version\": \"2012-10-17\"," +
-                "    \"Statement\": [" +
-                "        {" +
-                "            \"Effect\": \"Allow\"," +
-                "            \"Action\": \"s3:GetBucketObjectLockConfiguration\"," +
-                "            \"Resource\": [" +
-                "                \"arn:aws:s3:::amzn-s3-demo-manifest-bucket\"" +
-                "            ]" +
-                "        }," +
-                "        {" +
-                "            \"Effect\": \"Allow\"," +
-                "            \"Action\": [" +
-                "                \"s3:GetObject\"," +
-                "                \"s3:GetObjectVersion\"," +
-                "                \"s3:GetBucketLocation\"" +
-                "            ]," +
-                "            \"Resource\": [" +
-                "                \"arn:aws:s3:::amzn-s3-demo-manifest-bucket/*\"" +
-                "            ]" +
-                "        }," +
-                "        {" +
-                "            \"Effect\": \"Allow\"," +
-                "            \"Action\": [" +
-                "                \"s3:PutObject\"," +
-                "                \"s3:GetBucketLocation\"" +
-                "            ]," +
-                "            \"Resource\": [" +
-                "                \"arn:aws:s3:::amzn-s3-demo-completion-report-bucket/*\"" +
-                "            ]" +
-                "        }" +
-                "    ]" +
-                "}";
-    
-        final AmazonIdentityManagement iam =
-                AmazonIdentityManagementClientBuilder.defaultClient();
-    
-        final CreateRoleRequest createRoleRequest = new CreateRoleRequest()
-                .withAssumeRolePolicyDocument(bopsPermissions)
-                .withRoleName(roleName);
-    
-        final CreateRoleResult createRoleResult = iam.createRole(createRoleRequest);
-    
-        final PutRolePolicyRequest putRolePolicyRequest = new PutRolePolicyRequest()
-                .withPolicyDocument(bopsPermissions)
-                .withPolicyName("batch_operations-permissions")
-                .withRoleName(roleName);
-    
-        final PutRolePolicyResult putRolePolicyResult = iam.putRolePolicy(putRolePolicyRequest);
-    } 
+For a code example that demonstrates how to create an IAM role for enabling S3 Object Lock using S3 Batch Operations with the AWS SDK for Java, see [CreateObjectLockRole.java](https://github.com/awsdocs/aws-doc-sdk-examples/blob/main/javav2/example_code/s3/src/main/java/com/example/s3/batch/CreateObjectLockRole.java) in the _AWS SDK for Java 2.x Code Examples_.