AWS cli documentation change
Summary
Added documentation for directory buckets support, including permissions, endpoint requirements, and request syntax
Security assessment
This change adds security documentation about required permissions (s3express:PutMetricsConfiguration) and IAM policies for directory buckets, and clarifies security boundaries (cross-account access not supported). It also adds operational security details about endpoint requirements and header restrictions. However, there is no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/cli/latest/reference/s3api/delete-bucket-metrics-configuration.md b/cli/latest/reference/s3api/delete-bucket-metrics-configuration.md index 603b9786b..c66a3e0b0 100644 --- a//cli/latest/reference/s3api/delete-bucket-metrics-configuration.md +++ b//cli/latest/reference/s3api/delete-bucket-metrics-configuration.md @@ -15 +15 @@ - * [AWS CLI 2.34.20 Command Reference](../../index.html) » + * [AWS CLI 2.34.21 Command Reference](../../index.html) » @@ -59,0 +60,2 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c +Deletes a metrics configuration for the Amazon CloudWatch request metrics (specified by the metrics configuration ID) from the bucket. Note that this doesn’t include the daily storage metrics. + @@ -62 +64 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -This operation is not supported for directory buckets. +> **Directory buckets** \- For directory buckets, you must make requests for this API operation to the Regional endpoint. These endpoints support path-style requests in the format ``<https://s3express-control.*region-code*> .amazonaws.com/_bucket-name_ `` . Virtual-hosted-style requests aren’t supported. For more information about endpoints in Availability Zones, see [Regional and Zonal endpoints for directory buckets in Availability Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/endpoint-directory-buckets-AZ.html) in the _Amazon S3 User Guide_ . For more information about endpoints in Local Zones, see [Concepts for directory buckets in Local Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-lzs-for-directory-buckets.html) in the _Amazon S3 User Guide_ . @@ -64 +66 @@ This operation is not supported for directory buckets. -Deletes a metrics configuration for the Amazon CloudWatch request metrics (specified by the metrics configuration ID) from the bucket. Note that this doesn’t include the daily storage metrics. +Permissions @@ -67,0 +70,11 @@ To use this operation, you must have permissions to perform the `s3:PutMetricsCo + * **General purpose bucket permissions** \- The `s3:PutMetricsConfiguration` permission is required in a policy. For more information about general purpose buckets permissions, see [Using Bucket Policies and User Policies](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html) in the _Amazon S3 User Guide_ . + + * **Directory bucket permissions** \- To grant access to this API operation, you must have the `s3express:PutMetricsConfiguration` permission in an IAM identity-based policy instead of a bucket policy. Cross-account access to this API operation isn’t supported. This operation can only be performed by the Amazon Web Services account that owns the resource. For more information about directory bucket policies and permissions, see [Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html) in the _Amazon S3 User Guide_ . + +HTTP Host header syntax + + + + +> **Directory buckets** \- The HTTP Host header syntax is `s3express-control.*region-code* .amazonaws.com` . + @@ -119,0 +133,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +>> **Directory buckets** \- When you use this operation with a directory bucket, you must use path-style requests in the format `https://s3express-control.*region-code* .amazonaws.com/*bucket-name* `` . Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format `` *bucket-base-name* --*zone-id* --x-s3` (for example, `` _DOC-EXAMPLE-BUCKET_ – _usw2-az1_ –x-s3`` ). For information about bucket naming restrictions, see [Directory bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-bucket-naming-rules.html) in the _Amazon S3 User Guide_ @@ -127,0 +143,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +> ### Note +> +> For directory buckets, this header is not supported in this API operation. If you specify this header, the request fails with the HTTP status code `501 Not Implemented` . @@ -274 +293 @@ None - * [AWS CLI 2.34.20 Command Reference](../../index.html) » + * [AWS CLI 2.34.21 Command Reference](../../index.html) »