AWS AmazonS3 medium security documentation change
Summary
Added s3:GetObjectVersionAnnotationForReplication permission requirement for annotation replication and provided bucket policy example to explicitly block annotation replication.
Security assessment
Introduces new IAM permission for sensitive metadata (annotations) replication and shows explicit denial controls. Addresses security through granular permission management for metadata replication.
Diff
diff --git a/AmazonS3/latest/userguide/setting-repl-config-perm-overview.md b/AmazonS3/latest/userguide/setting-repl-config-perm-overview.md index ec5c5a6d0..a7f7b3b86 100644 --- a//AmazonS3/latest/userguide/setting-repl-config-perm-overview.md +++ b//AmazonS3/latest/userguide/setting-repl-config-perm-overview.md @@ -270 +270,3 @@ Permissions for the `s3:ReplicateObject` action on the ``amzn-s3-demo-destinatio - * `s3:GetObjectVersionTagging` – Permissions for this action on objects in the ``amzn-s3-demo-source-bucket`` bucket allow Amazon S3 to read object tags for replication. For more information about object tags, see [Categorizing your objects using tags](./object-tagging.html). If Amazon S3 doesn't have the `s3:GetObjectVersionTagging` permission, it replicates the objects, but not the object tags. + * `s3:GetObjectVersionTagging` – Permissions for this action on objects in the ``amzn-s3-demo-source-bucket`` bucket allow Amazon S3 to read object tags for replication. For more information about object tags, see [Tagging your objects](./object-tagging.html). If Amazon S3 doesn't have the `s3:GetObjectVersionTagging` permission, it replicates the objects, but not the object tags. + + * `s3:GetObjectVersionAnnotationForReplication` – Permissions for this action on objects in the source bucket allow Amazon S3 to read annotations for replication. If Amazon S3 doesn't have this permission, annotation replication fails. For more information about annotations, see [Annotating your objects](./annotations-overview.html). @@ -361,0 +364,17 @@ If objects in the source bucket are tagged, note the following: + * Similarly, if the source bucket owner grants Amazon S3 permission for the `s3:GetObjectVersionAnnotationForReplication` action to replicate annotations (through the IAM role), Amazon S3 replicates the annotations along with the objects. For information about the IAM role, see Step 2: Creating an IAM role for Amazon S3 to assume. + +If the owner of the destination bucket doesn't want to replicate the annotations, they can add the following statement to the destination bucket policy to explicitly deny permission for the `s3:ReplicateObjectAnnotation` action. In this policy, ``amzn-s3-demo-destination-bucket`` is the destination bucket. + + ... + "Statement":[ + { + "Effect":"Deny", + "Principal":{ + "AWS":"arn:aws:iam::source-bucket-account-id:role/service-role/source-account-IAM-role" + }, + "Action":"s3:ReplicateObjectAnnotation", + "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/*" + } + ] + ... +