AWS cli documentation change
Summary
Updated documentation for S3 GetBucketMetricsConfiguration to include directory bucket support, permissions, endpoint requirements, and clarifications about unsupported features like tag filters and x-amz-expected-bucket-owner header.
Security assessment
The changes add a detailed permissions section specifying required IAM permissions (s3:GetMetricsConfiguration for general purpose buckets and s3express:GetMetricsConfiguration for directory buckets) and explicitly state that cross-account access is not supported for directory buckets. This enhances security documentation but does not indicate a specific security vulnerability being addressed.
Diff
diff --git a/cli/latest/reference/s3api/get-bucket-metrics-configuration.md b/cli/latest/reference/s3api/get-bucket-metrics-configuration.md index 80ce784a4..9ca4bf395 100644 --- a//cli/latest/reference/s3api/get-bucket-metrics-configuration.md +++ b//cli/latest/reference/s3api/get-bucket-metrics-configuration.md @@ -15 +15 @@ - * [AWS CLI 2.34.20 Command Reference](../../index.html) » + * [AWS CLI 2.34.21 Command Reference](../../index.html) » @@ -59,0 +60,2 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c +Gets a metrics configuration (specified by the metrics configuration ID) from the bucket. Note that this doesn’t include the daily storage metrics. + @@ -62 +64 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -This operation is not supported for directory buckets. +> **Directory buckets** \- For directory buckets, you must make requests for this API operation to the Regional endpoint. These endpoints support path-style requests in the format ``<https://s3express-control.*region-code*> .amazonaws.com/_bucket-name_ `` . Virtual-hosted-style requests aren’t supported. For more information about endpoints in Availability Zones, see [Regional and Zonal endpoints for directory buckets in Availability Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/endpoint-directory-buckets-AZ.html) in the _Amazon S3 User Guide_ . For more information about endpoints in Local Zones, see [Concepts for directory buckets in Local Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-lzs-for-directory-buckets.html) in the _Amazon S3 User Guide_ . @@ -64 +66 @@ This operation is not supported for directory buckets. -Gets a metrics configuration (specified by the metrics configuration ID) from the bucket. Note that this doesn’t include the daily storage metrics. +Permissions @@ -67,0 +70,11 @@ To use this operation, you must have permissions to perform the `s3:GetMetricsCo + * **General purpose bucket permissions** \- The `s3:GetMetricsConfiguration` permission is required in a policy. For more information about general purpose buckets permissions, see [Using Bucket Policies and User Policies](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html) in the _Amazon S3 User Guide_ . + + * **Directory bucket permissions** \- To grant access to this API operation, you must have the `s3express:GetMetricsConfiguration` permission in an IAM identity-based policy instead of a bucket policy. Cross-account access to this API operation isn’t supported. This operation can only be performed by the Amazon Web Services account that owns the resource. For more information about directory bucket policies and permissions, see [Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html) in the _Amazon S3 User Guide_ . + +HTTP Host header syntax + + + + +> **Directory buckets** \- The HTTP Host header syntax is `s3express-control.*region-code* .amazonaws.com` . + @@ -119,0 +133,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +>> **Directory buckets** \- When you use this operation with a directory bucket, you must use path-style requests in the format `https://s3express-control.*region-code* .amazonaws.com/*bucket-name* `` . Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format `` *bucket-base-name* --*zone-id* --x-s3` (for example, `` _DOC-EXAMPLE-BUCKET_ – _usw2-az1_ –x-s3`` ). For information about bucket naming restrictions, see [Directory bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-bucket-naming-rules.html) in the _Amazon S3 User Guide_ @@ -127,0 +143,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +> ### Note +> +> For directory buckets, this header is not supported in this API operation. If you specify this header, the request fails with the HTTP status code `501 Not Implemented` . @@ -284,0 +304,4 @@ MetricsConfiguration -> (structure) +>> ### Note +>> +>> Metrics configurations for directory buckets do not support tag filters. +>> @@ -292,0 +316,4 @@ MetricsConfiguration -> (structure) +>>> ### Note +>>> +>>> `Tag` filters are not supported for directory buckets. +>>> @@ -322,0 +350,4 @@ MetricsConfiguration -> (structure) +>>>> ### Note +>>>> +>>>> `Tag` filters are not supported for directory buckets. +>>>> @@ -355 +386 @@ MetricsConfiguration -> (structure) - * [AWS CLI 2.34.20 Command Reference](../../index.html) » + * [AWS CLI 2.34.21 Command Reference](../../index.html) »