AWS cli documentation change
Summary
Updated documentation for S3 directory buckets support in list-bucket-metrics-configurations command, including endpoint requirements, permissions differences, and tag filter limitations
Security assessment
The changes add security documentation about required permissions for directory buckets (s3express:GetMetricsConfiguration) and clarify that cross-account access isn't supported for directory buckets. It also documents IAM identity-based policy requirements instead of bucket policies for directory buckets. However, there's no evidence this addresses a specific security vulnerability or incident - it appears to be routine documentation updates for a new feature (directory buckets).
Diff
diff --git a/cli/latest/reference/s3api/list-bucket-metrics-configurations.md b/cli/latest/reference/s3api/list-bucket-metrics-configurations.md index 892d7f0b4..59a9cb83c 100644 --- a//cli/latest/reference/s3api/list-bucket-metrics-configurations.md +++ b//cli/latest/reference/s3api/list-bucket-metrics-configurations.md @@ -15 +15 @@ - * [AWS CLI 2.34.20 Command Reference](../../index.html) » + * [AWS CLI 2.34.21 Command Reference](../../index.html) » @@ -60 +60 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -### Note +Lists the metrics configurations for the bucket. The metrics configurations are only for the request metrics of the bucket and do not provide information on daily storage metrics. You can have up to 1,000 configurations per bucket. @@ -62 +62 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -This operation is not supported for directory buckets. +### Note @@ -64 +64 @@ This operation is not supported for directory buckets. -Lists the metrics configurations for the bucket. The metrics configurations are only for the request metrics of the bucket and do not provide information on daily storage metrics. You can have up to 1,000 configurations per bucket. +**Directory buckets** \- For directory buckets, you must make requests for this API operation to the Regional endpoint. These endpoints support path-style requests in the format ``<https://s3express-control.*region-code*> .amazonaws.com/_bucket-name_ `` . Virtual-hosted-style requests aren’t supported. For more information about endpoints in Availability Zones, see [Regional and Zonal endpoints for directory buckets in Availability Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/endpoint-directory-buckets-AZ.html) in the _Amazon S3 User Guide_ . For more information about endpoints in Local Zones, see [Concepts for directory buckets in Local Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-lzs-for-directory-buckets.html) in the _Amazon S3 User Guide_ . @@ -67,0 +68,2 @@ This action supports list pagination and does not return more than 100 configura +> Permissions + @@ -69,0 +72,11 @@ To use this operation, you must have permissions to perform the `s3:GetMetricsCo + * **General purpose bucket permissions** \- The `s3:GetMetricsConfiguration` permission is required in a policy. For more information about general purpose buckets permissions, see [Using Bucket Policies and User Policies](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html) in the _Amazon S3 User Guide_ . + + * **Directory bucket permissions** \- To grant access to this API operation, you must have the `s3express:GetMetricsConfiguration` permission in an IAM identity-based policy instead of a bucket policy. Cross-account access to this API operation isn’t supported. This operation can only be performed by the Amazon Web Services account that owns the resource. For more information about directory bucket policies and permissions, see [Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html) in the _Amazon S3 User Guide_ . + +HTTP Host header syntax + + + + +> **Directory buckets** \- The HTTP Host header syntax is `s3express-control.*region-code* .amazonaws.com` . + @@ -120,0 +134,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +>> **Directory buckets** \- When you use this operation with a directory bucket, you must use path-style requests in the format `https://s3express-control.*region-code* .amazonaws.com/*bucket-name* `` . Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format `` *bucket-base-name* --*zone-id* --x-s3` (for example, `` _DOC-EXAMPLE-BUCKET_ – _usw2-az1_ –x-s3`` ). For information about bucket naming restrictions, see [Directory bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-bucket-naming-rules.html) in the _Amazon S3 User Guide_ @@ -128,0 +144,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +> ### Note +> +> For directory buckets, this header is not supported in this API operation. If you specify this header, the request fails with the HTTP status code `501 Not Implemented` . @@ -309,0 +329,4 @@ MetricsConfigurationList -> (list) +>>> ### Note +>>> +>>> Metrics configurations for directory buckets do not support tag filters. +>>> @@ -317,0 +341,4 @@ MetricsConfigurationList -> (list) +>>>> ### Note +>>>> +>>>> `Tag` filters are not supported for directory buckets. +>>>> @@ -347,0 +375,4 @@ MetricsConfigurationList -> (list) +>>>>> ### Note +>>>>> +>>>>> `Tag` filters are not supported for directory buckets. +>>>>> @@ -380 +411 @@ MetricsConfigurationList -> (list) - * [AWS CLI 2.34.20 Command Reference](../../index.html) » + * [AWS CLI 2.34.21 Command Reference](../../index.html) »