AWS cli documentation change
Summary
Updated documentation for directory buckets support in list-bucket-inventory-configurations, including endpoint requirements, permissions differences, and supported optional fields
Security assessment
This change adds detailed documentation about security permissions for directory buckets, specifically noting that directory buckets require IAM identity-based policies with s3express:GetInventoryConfiguration permission instead of bucket policies. It also documents that the x-amz-expected-bucket-owner header is not supported for directory buckets. While this adds security documentation about proper access control mechanisms, there's no evidence it addresses a specific security vulnerability.
Diff
diff --git a/cli/latest/reference/s3api/list-bucket-inventory-configurations.md b/cli/latest/reference/s3api/list-bucket-inventory-configurations.md index d5a9628ae..897119bcb 100644 --- a//cli/latest/reference/s3api/list-bucket-inventory-configurations.md +++ b//cli/latest/reference/s3api/list-bucket-inventory-configurations.md @@ -15 +15 @@ - * [AWS CLI 2.34.34 Command Reference](../../index.html) » + * [AWS CLI 2.34.37 Command Reference](../../index.html) » @@ -60,4 +59,0 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -### Note - -This operation is not supported for directory buckets. - @@ -67,0 +64,6 @@ This action supports list pagination and does not return more than 100 configura +### Note + +> **Directory buckets** \- For directory buckets, you must make requests for this API operation to the Regional endpoint. These endpoints support path-style requests in the format ``<https://s3express-control.*region-code*> .amazonaws.com/_bucket-name_ `` . Virtual-hosted-style requests aren’t supported. For more information about endpoints in Availability Zones, see [Regional and Zonal endpoints for directory buckets in Availability Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/endpoint-directory-buckets-AZ.html) in the _Amazon S3 User Guide_ . For more information about endpoints in Local Zones, see [Concepts for directory buckets in Local Zones](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-lzs-for-directory-buckets.html) in the _Amazon S3 User Guide_ . + +Permissions + @@ -69,0 +72,11 @@ To use this operation, you must have permissions to perform the `s3:GetInventory + * **General purpose bucket permissions** \- The `s3:GetInventoryConfiguration` permission is required in a policy. For more information about general purpose buckets permissions, see [Using Bucket Policies and User Policies](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html) in the _Amazon S3 User Guide_ . + + * **Directory bucket permissions** \- To grant access to this API operation, you must have the `s3express:GetInventoryConfiguration` permission in an IAM identity-based policy instead of a bucket policy. For more information about directory bucket policies and permissions, see [Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html) in the _Amazon S3 User Guide_ . + +HTTP Host header syntax + + + + +> **Directory buckets** \- The HTTP Host header syntax is `s3express-control.*region-code* .amazonaws.com` . + @@ -120,0 +134,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +>> **Directory buckets** \- When you use this operation with a directory bucket, you must use path-style requests in the format `https://s3express-control.*region-code* .amazonaws.com/*bucket-name* `` . Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format `` *bucket-base-name* --*zone-id* --x-s3` (for example, `` _DOC-EXAMPLE-BUCKET_ – _usw2-az1_ –x-s3`` ). For information about bucket naming restrictions, see [Directory bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-bucket-naming-rules.html) in the _Amazon S3 User Guide_ @@ -128,0 +144,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200 +> +> ### Note +> +> For directory buckets, this header is not supported in this API operation. If you specify this header, the request fails with the HTTP status code `501 Not Implemented` . @@ -394,0 +414,4 @@ InventoryConfigurationList -> (list) +>>> ### Note +>>> +>>> The following optional fields are supported for directory buckets `Size | LastModifiedDate | StorageClass | ETag | IsMultipartUploaded | EncryptionStatus | BucketKeyStatus | ChecksumAlgorithm | LifecycleExpirationDate.` Throws MalformedXML error if unsupported optional field is provided. +>>> @@ -451 +474 @@ NextContinuationToken -> (string) - * [AWS CLI 2.34.34 Command Reference](../../index.html) » + * [AWS CLI 2.34.37 Command Reference](../../index.html) »