AWS cli documentation change

Service: cli · 2026-06-19 · Documentation low

File: cli/latest/reference/s3api/create-bucket-metadata-configuration.md

Summary

Added documentation for AnnotationTableConfiguration feature including IAM role requirements, encryption settings, and new IAM permissions

Security assessment

The change introduces documentation for security features including mandatory encryption configuration (SSE-KMS/SSE-S3), IAM role management (iam:PassRole), and detailed security policy requirements. However, there's no evidence this addresses a specific vulnerability.

Diff

diff --git a/cli/latest/reference/s3api/create-bucket-metadata-configuration.md b/cli/latest/reference/s3api/create-bucket-metadata-configuration.md
index 097f2321a..884f7528e 100644
--- a//cli/latest/reference/s3api/create-bucket-metadata-configuration.md
+++ b//cli/latest/reference/s3api/create-bucket-metadata-configuration.md
@@ -15 +15 @@
-  * [AWS CLI 2.35.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.8 Command Reference](../../index.html) »
@@ -83,0 +84 @@ The IAM policy action name is the same for the V1 and V2 API operations.
+  * `s3tables:PutTableBucketPolicy`
@@ -85,0 +87 @@ The IAM policy action name is the same for the V1 and V2 API operations.
+  * `iam:PassRole` \- required if you include an `AnnotationTableConfiguration` with an IAM role.
@@ -94,0 +97 @@ The following operations are related to `CreateBucketMetadataConfiguration` :
+  * [UpdateBucketMetadataAnnotationTableConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_UpdateBucketMetadataAnnotationTableConfiguration.html)
@@ -97,0 +101,2 @@ The following operations are related to `CreateBucketMetadataConfiguration` :
+If you include an `AnnotationTableConfiguration` with an IAM role, the role must have a trust policy that allows the Amazon S3 metadata service to assume it, and a permissions policy that grants the actions needed to read annotations from your bucket. The following examples show a trust policy and a permissions policy that you can adapt for your bucket and account.
+
@@ -243,0 +249,38 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200
+> 
+> AnnotationTableConfiguration -> (structure)
+>
+>> Optional annotation table configuration to include with the metadata configuration.
+>> 
+>> ConfigurationState -> (string) [required]
+>>
+>>> The state of the annotation table. Valid values are `ENABLED` and `DISABLED` .
+>>> 
+>>> Possible values:
+>>> 
+>>>   * `ENABLED`
+>>>   * `DISABLED`
+>>> 
+
+>> 
+>> EncryptionConfiguration -> (structure)
+>>
+>>> The encryption settings for an S3 Metadata journal table or inventory table configuration.
+>>> 
+>>> SseAlgorithm -> (string) [required]
+>>>
+>>>> The encryption type specified for a metadata table. To specify server-side encryption with Key Management Service (KMS) keys (SSE-KMS), use the `aws:kms` value. To specify server-side encryption with Amazon S3 managed keys (SSE-S3), use the `AES256` value.
+>>>> 
+>>>> Possible values:
+>>>> 
+>>>>   * `aws:kms`
+>>>>   * `AES256`
+>>>> 
+
+>>> 
+>>> KmsKeyArn -> (string)
+>>>
+>>>> If server-side encryption with Key Management Service (KMS) keys (SSE-KMS) is specified, you must also specify the KMS key Amazon Resource Name (ARN). You must specify a customer-managed KMS key that’s located in the same Region as the general purpose bucket that corresponds to the metadata table configuration.
+>> 
+>> Role -> (string)
+>>
+>>> The ARN of the IAM role used to manage the annotation table.
@@ -248 +291 @@ Shorthand Syntax:
-    JournalTableConfiguration={RecordExpiration={Expiration=string,Days=integer},EncryptionConfiguration={SseAlgorithm=string,KmsKeyArn=string}},InventoryTableConfiguration={ConfigurationState=string,EncryptionConfiguration={SseAlgorithm=string,KmsKeyArn=string}}
+    JournalTableConfiguration={RecordExpiration={Expiration=string,Days=integer},EncryptionConfiguration={SseAlgorithm=string,KmsKeyArn=string}},InventoryTableConfiguration={ConfigurationState=string,EncryptionConfiguration={SseAlgorithm=string,KmsKeyArn=string}},AnnotationTableConfiguration={ConfigurationState=string,EncryptionConfiguration={SseAlgorithm=string,KmsKeyArn=string},Role=string}
@@ -270,0 +314,8 @@ JSON Syntax:
+      },
+      "AnnotationTableConfiguration": {
+        "ConfigurationState": "ENABLED"|"DISABLED",
+        "EncryptionConfiguration": {
+          "SseAlgorithm": "aws:kms"|"AES256",
+          "KmsKeyArn": "string"
+        },
+        "Role": "string"
@@ -404 +455 @@ None
-  * [AWS CLI 2.35.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.8 Command Reference](../../index.html) »