AWS AmazonS3 documentation change

Service: AmazonS3 · 2026-04-22 · Documentation low

File: AmazonS3/latest/userguide/example-bucket-policies.md

Summary

Updated documentation to include directory bucket-specific condition key (s3express:InventoryAccessibleOptionalFields) and an example IAM policy for controlling S3 Inventory report configuration.

Security assessment

Enhances security documentation by specifying the correct condition key for fine-grained access control in directory buckets, but does not indicate a fix for a security issue.

Diff

diff --git a/AmazonS3/latest/userguide/example-bucket-policies.md b/AmazonS3/latest/userguide/example-bucket-policies.md
index 86f7da00a..0f8290014 100644
--- a//AmazonS3/latest/userguide/example-bucket-policies.md
+++ b//AmazonS3/latest/userguide/example-bucket-policies.md
@@ -788,0 +789,4 @@ Some object metadata fields in S3 Inventory report configurations are optional,
+###### Note
+
+For directory buckets, use the `s3express:InventoryAccessibleOptionalFields` condition key instead of `s3:InventoryAccessibleOptionalFields`. For more information about configuring S3 Inventory for directory buckets, see [Configuring Amazon S3 Inventory](./configure-inventory.html).
+
@@ -875,0 +880,23 @@ To learn more about the `ForAllValues` and `ForAnyValue` condition set operators
+#### Control S3 Inventory report configuration creation for directory buckets
+
+For directory buckets, you use the `s3express:InventoryAccessibleOptionalFields` condition key in an IAM identity-based policy instead of a bucket policy. The following example IAM policy grants a user permission to create an inventory configuration for a directory bucket. The `ForAllValues:StringEquals` condition uses the `s3express:InventoryAccessibleOptionalFields` condition key to specify the allowed optional metadata fields.
+    
+    
+    {
+    	"Version": "2012-10-17",
+    	"Statement": [{
+    		"Sid": "AllowInventoryCreationForDirectoryBucket",
+    		"Effect": "Allow",
+    		"Action": "s3express:PutInventoryConfiguration",
+    		"Resource": "arn:aws:s3express:region:account-id:bucket/bucket-base-name--zone-id--x-s3",
+    		"Condition": {
+    			"ForAllValues:StringEquals": {
+    				"s3express:InventoryAccessibleOptionalFields": [
+    					"Size",
+    					"StorageClass"
+    				]
+    			}
+    		}
+    	}]
+    }
+