AWS cli documentation change
Summary
Updated AWS CLI version from 2.34.34 to 2.34.37 and added comprehensive documentation for directory bucket support including endpoint requirements, permissions differences (s3express:GetInventoryConfiguration vs s3:GetInventoryConfiguration), HTTP Host header syntax, and specific field support limitations.
Security assessment
The changes primarily document feature support for directory buckets rather than addressing a specific security vulnerability. However, they add important security documentation by clarifying permission requirements (s3express:GetInventoryConfiguration for directory buckets vs s3:GetInventoryConfiguration for general purpose buckets) and emphasizing that directory buckets require IAM identity-based policies instead of bucket policies, which is a security best practice for S3 Express One Zone. No evidence of a security incident or vulnerability being fixed.
Diff
diff --git a/cli/latest/reference/s3api/get-bucket-inventory-configuration.md b/cli/latest/reference/s3api/get-bucket-inventory-configuration.md index 249886995..3200d4291 100644 --- a//cli/latest/reference/s3api/get-bucket-inventory-configuration.md +++ b//cli/latest/reference/s3api/get-bucket-inventory-configuration.md @@ -15 +15 @@ - * [AWS CLI 2.34.34 Command Reference](../../index.html) » + * [AWS CLI 2.34.37 Command Reference](../../index.html) » @@ -59,0 +60,2 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c +Returns an S3 Inventory configuration (identified by the inventory configuration ID) from the bucket. + @@ -62 +64,11 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -This operation is not supported for directory buckets. +> **Directory buckets** \- For directory buckets, you must make requests for this API operation to the Regional endpoint. These endpoints support path-style requests in the format ``<https://s3express-control.*region-code*> .amazonaws.com/_bucket-name_ `` . Virtual-hosted-style requests aren’t supported. For more information about endpoints in Availability Zones, see [Regional and Zonal endpoints for directory buckets in Availability Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/endpoint-directory-buckets-AZ.html) in the _Amazon S3 User Guide_ . For more information about endpoints in Local Zones, see [Concepts for directory buckets in Local Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-lzs-for-directory-buckets.html) in the _Amazon S3 User Guide_ . + +Permissions + +To use this operation, you must have permissions to perform the `s3:GetInventoryConfiguration` action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see [Permissions Related to Bucket Subresource Operations](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html#using-with-s3-actions-related-to-bucket-subresources) and [Managing Access Permissions to Your Amazon S3 Resources](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html) . + + * **General purpose bucket permissions** \- The `s3:GetInventoryConfiguration` permission is required in a policy. For more information about general purpose buckets permissions, see [Using Bucket Policies and User Policies](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html) in the _Amazon S3 User Guide_ . + + * **Directory bucket permissions** \- To grant access to this API operation, you must have the `s3express:GetInventoryConfiguration` permission in an IAM identity-based policy instead of a bucket policy. For more information about directory bucket policies and permissions, see [Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html) in the _Amazon S3 User Guide_ . + +HTTP Host header syntax @@ -64 +75,0 @@ This operation is not supported for directory buckets. -Returns an S3 Inventory configuration (identified by the inventory configuration ID) from the bucket. @@ -66 +77,3 @@ Returns an S3 Inventory configuration (identified by the inventory configuration -To use this operation, you must have permissions to perform the `s3:GetInventoryConfiguration` action. The bucket owner has this permission by default and can grant this permission to others. For more information about permissions, see [Permissions Related to Bucket Subresource Operations](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html#using-with-s3-actions-related-to-bucket-subresources) and [Managing Access Permissions to Your Amazon S3 Resources](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html) . + + +> **Directory buckets** \- The HTTP Host header syntax is `s3express-control.*region-code* .amazonaws.com` . @@ -118,0 +132,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +>> **Directory buckets** \- When you use this operation with a directory bucket, you must use path-style requests in the format `https://s3express-control.*region-code* .amazonaws.com/*bucket-name* `` . Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format `` *bucket-base-name* --*zone-id* --x-s3` (for example, `` _DOC-EXAMPLE-BUCKET_ – _usw2-az1_ –x-s3`` ). For information about bucket naming restrictions, see [Directory bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-bucket-naming-rules.html) in the _Amazon S3 User Guide_ @@ -126,0 +142,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +> ### Note +> +> For directory buckets, this header is not supported in this API operation. If you specify this header, the request fails with the HTTP status code `501 Not Implemented` . @@ -367,0 +387,4 @@ InventoryConfiguration -> (structure) +>> ### Note +>> +>> The following optional fields are supported for directory buckets `Size | LastModifiedDate | StorageClass | ETag | IsMultipartUploaded | EncryptionStatus | BucketKeyStatus | ChecksumAlgorithm | LifecycleExpirationDate.` Throws MalformedXML error if unsupported optional field is provided. +>> @@ -416 +439 @@ InventoryConfiguration -> (structure) - * [AWS CLI 2.34.34 Command Reference](../../index.html) » + * [AWS CLI 2.34.37 Command Reference](../../index.html) »