AWS AmazonS3 documentation change

Service: AmazonS3 · 2026-04-22 · Documentation low

File: AmazonS3/latest/userguide/configure-inventory.md

Summary

Added documentation for configuring S3 Inventory on directory buckets, including permissions, policies, condition keys, destination bucket policy, KMS key policy, and console support notes specific to S3 Express.

Security assessment

The change adds security-related documentation for IAM permissions, condition keys, and KMS key policies to secure S3 Inventory configurations for directory buckets, but there is no evidence of addressing a specific security vulnerability or incident.

Diff

diff --git a/AmazonS3/latest/userguide/configure-inventory.md b/AmazonS3/latest/userguide/configure-inventory.md
index fea7f02dd..7ee9a8441 100644
--- a//AmazonS3/latest/userguide/configure-inventory.md
+++ b//AmazonS3/latest/userguide/configure-inventory.md
@@ -76,0 +77,13 @@ If you can’t access your S3 Inventory report, use the [GetBucketEncryption](ht
+###### Directory buckets
+
+S3 Inventory is supported for directory buckets. When configuring S3 Inventory for a directory bucket, note the following differences:
+
+  * **Permissions** – For directory buckets, you must use the `s3express:PutInventoryConfiguration` and `s3express:GetInventoryConfiguration` permissions in an IAM identity-based policy instead of a bucket policy. These permissions use the `s3express:` namespace rather than the `s3:` namespace used for general purpose buckets. For more information, see [Authorizing Regional endpoint API operations with IAM](./s3-express-security-iam.html).
+
+  * **Supported optional fields** – The following optional fields are supported for directory buckets: `Size`, `LastModifiedDate`, `StorageClass`, `ETag`, `IsMultipartUploaded`, `EncryptionStatus`, `BucketKeyStatus`, `ChecksumAlgorithm`, and `LifecycleExpirationDate`.
+
+  * **Condition key** – For directory buckets, use the `s3express:InventoryAccessibleOptionalFields` condition key to control access to optional metadata fields in inventory reports.
+
+
+
+
@@ -118,0 +132,31 @@ For more information, see [Grant permissions for S3 Inventory and S3 analytics](
+###### Directory buckets
+
+For directory buckets, you must manually add a destination bucket policy. The destination bucket policy uses a different service principal and ARN format than general purpose buckets. Specify `s3express.amazonaws.com` as the service principal, and use the directory bucket ARN format for the source bucket. The following example shows a destination bucket policy for directory buckets.
+    
+    
+    {
+        "Version": "2012-10-17", 
+        "Statement": [
+            {
+                "Sid": "InventoryExamplePolicy",
+                "Effect": "Allow",
+                "Principal": {
+                    "Service": "s3express.amazonaws.com"
+                },
+                "Action": "s3:PutObject",
+                "Resource": [
+                    "arn:aws:s3:::DOC-EXAMPLE-DESTINATION-BUCKET/*"
+                ],
+                "Condition": {
+                    "ArnLike": {
+                        "aws:SourceARN": "arn:aws:s3express:region:source-account-id:bucket/DOC-EXAMPLE-SOURCE-BUCKET--zone-id--x-s3"
+                    },
+                    "StringEquals": {
+                        "aws:SourceAccount": "source-account-id",
+                        "s3:x-amz-acl": "bucket-owner-full-control"
+                    }
+                }
+            }
+        ]
+    }
+
@@ -182,0 +227,25 @@ For more information about creating customer managed keys and using key policies
+###### Directory buckets
+
+For directory buckets, the KMS key policy uses a different service principal and source ARN format than general purpose buckets. Specify `s3express.amazonaws.com` as the service principal, and use the directory bucket ARN format for the source ARN. The following example shows the key policy statement for directory buckets.
+    
+    
+    {
+        "Sid": "Allow S3 Express use of the KMS key",
+        "Effect": "Allow",
+        "Principal": {
+            "Service": "s3express.amazonaws.com"
+        },
+        "Action": [
+            "kms:GenerateDataKey"
+        ],
+        "Resource": "*",
+        "Condition": {
+            "StringEquals": {
+                "aws:SourceAccount": "source-account-id"
+            },
+            "ArnLike": {
+                "aws:SourceARN": "arn:aws:s3express:region:source-account-id:bucket/DOC-EXAMPLE-SOURCE-BUCKET--zone-id--x-s3"
+            }
+        }
+    }
+
@@ -198,0 +268,4 @@ It might take up to 48 hours for Amazon S3 to deliver the first inventory report
+###### Note
+
+Configuring S3 Inventory for directory buckets is not supported in the Amazon Simple Storage Service console. To configure S3 Inventory for directory buckets, use the Amazon S3 REST API, AWS Command Line Interface (AWS CLI), or AWS SDKs.
+