AWS cli documentation change
Summary
Updated documentation for S3 PutBucketMetricsConfiguration command to add detailed information about directory buckets support, including endpoint requirements, permissions differences (s3express:PutMetricsConfiguration for directory buckets), and limitations (tag filters not supported).
Security assessment
This change adds security documentation by clarifying permission requirements for directory buckets (s3express:PutMetricsConfiguration vs s3:PutMetricsConfiguration) and explicitly stating that cross-account access isn't supported for directory buckets. It also documents security-related limitations like tag filter unsupport. However, there's no evidence this addresses a specific security vulnerability.
Diff
diff --git a/cli/latest/reference/s3api/put-bucket-metrics-configuration.md b/cli/latest/reference/s3api/put-bucket-metrics-configuration.md index 0e14d81a9..f196ac6fd 100644 --- a//cli/latest/reference/s3api/put-bucket-metrics-configuration.md +++ b//cli/latest/reference/s3api/put-bucket-metrics-configuration.md @@ -15 +15 @@ - * [AWS CLI 2.34.20 Command Reference](../../index.html) » + * [AWS CLI 2.34.21 Command Reference](../../index.html) » @@ -59,0 +60,2 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c +Sets a metrics configuration (specified by the metrics configuration ID) for the bucket. You can have up to 1,000 metrics configurations per bucket. If you’re updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don’t include the elements you want to keep, they are erased. + @@ -62 +64 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -This operation is not supported for directory buckets. +> **Directory buckets** \- For directory buckets, you must make requests for this API operation to the Regional endpoint. These endpoints support path-style requests in the format ``<https://s3express-control.*region-code*> .amazonaws.com/_bucket-name_ `` . Virtual-hosted-style requests aren’t supported. For more information about endpoints in Availability Zones, see [Regional and Zonal endpoints for directory buckets in Availability Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/endpoint-directory-buckets-AZ.html) in the _Amazon S3 User Guide_ . For more information about endpoints in Local Zones, see [Concepts for directory buckets in Local Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-lzs-for-directory-buckets.html) in the _Amazon S3 User Guide_ . @@ -64 +66 @@ This operation is not supported for directory buckets. -Sets a metrics configuration (specified by the metrics configuration ID) for the bucket. You can have up to 1,000 metrics configurations per bucket. If you’re updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don’t include the elements you want to keep, they are erased. +Permissions @@ -67,0 +70,11 @@ To use this operation, you must have permissions to perform the `s3:PutMetricsCo + * **General purpose bucket permissions** \- The `s3:PutMetricsConfiguration` permission is required in a policy. For more information about general purpose buckets permissions, see [Using Bucket Policies and User Policies](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html) in the _Amazon S3 User Guide_ . + + * **Directory bucket permissions** \- To grant access to this API operation, you must have the `s3express:PutMetricsConfiguration` permission in an IAM identity-based policy instead of a bucket policy. Cross-account access to this API operation isn’t supported. This operation can only be performed by the Amazon Web Services account that owns the resource. For more information about directory bucket policies and permissions, see [Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html) in the _Amazon S3 User Guide_ . + +HTTP Host header syntax + + + + +> **Directory buckets** \- The HTTP Host header syntax is `s3express-control.*region-code* .amazonaws.com` . + @@ -127,0 +141,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +>> **Directory buckets** \- When you use this operation with a directory bucket, you must use path-style requests in the format `https://s3express-control.*region-code* .amazonaws.com/*bucket-name* `` . Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format `` *bucket-base-name* --*zone-id* --x-s3` (for example, `` _DOC-EXAMPLE-BUCKET_ – _usw2-az1_ –x-s3`` ). For information about bucket naming restrictions, see [Directory bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-bucket-naming-rules.html) in the _Amazon S3 User Guide_ @@ -144,0 +160,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +>> ### Note +>> +>> Metrics configurations for directory buckets do not support tag filters. +>> @@ -152,0 +172,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +>>> ### Note +>>> +>>> `Tag` filters are not supported for directory buckets. +>>> @@ -182,0 +206,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +>>>> ### Note +>>>> +>>>> `Tag` filters are not supported for directory buckets. +>>>> @@ -234,0 +262,4 @@ JSON Syntax: +> +> ### Note +> +> For directory buckets, this header is not supported in this API operation. If you specify this header, the request fails with the HTTP status code `501 Not Implemented` . @@ -382 +413 @@ None - * [AWS CLI 2.34.20 Command Reference](../../index.html) » + * [AWS CLI 2.34.21 Command Reference](../../index.html) »