Skip to content

Commit cee2e72

Browse files
author
awstools
committed
feat(client-s3): Adds support for blocking SSE-C writes to general purpose buckets.
1 parent 2e8472d commit cee2e72

File tree

13 files changed

+259
-109
lines changed

13 files changed

+259
-109
lines changed

‎clients/client-s3/src/commands/DeleteBucketTaggingCommand.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ export interface DeleteBucketTaggingCommandOutput extends __MetadataBearer {}
3030
* <note>
3131
* <p>This operation is not supported for directory buckets.</p>
3232
* </note>
33-
* <p>Deletes the tags from the bucket.</p>
33+
* <p>Deletes tags from the bucket.</p>
3434
* <p>To use this operation, you must have permission to perform the <code>s3:PutBucketTagging</code>
3535
* action. By default, the bucket owner has this permission and can grant this permission to others. </p>
3636
* <p>The following operations are related to <code>DeleteBucketTagging</code>:</p>

‎clients/client-s3/src/commands/DeleteObjectCommand.ts‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -103,16 +103,21 @@ export interface DeleteObjectCommandOutput extends DeleteObjectOutput, __Metadat
103103
* <p>
104104
* <b>
105105
* <code>s3:DeleteObject</code>
106-
* </b> - To delete an
107-
* object from a bucket, you must always have the <code>s3:DeleteObject</code>
108-
* permission.</p>
106+
* </b> - To
107+
* delete an object from a bucket, you must always have the
108+
* <code>s3:DeleteObject</code> permission.</p>
109109
* </li>
110110
* <li>
111111
* <p>
112112
* <b>
113113
* <code>s3:DeleteObjectVersion</code>
114114
* </b> - To delete a specific version of an object from a versioning-enabled
115115
* bucket, you must have the <code>s3:DeleteObjectVersion</code> permission.</p>
116+
* <note>
117+
* <p>If the <code>s3:DeleteObject</code> or <code>s3:DeleteObjectVersion</code> permissions are explicitly
118+
* denied in your bucket policy, attempts to delete any unversioned objects
119+
* result in a <code>403 Access Denied</code> error.</p>
120+
* </note>
116121
* </li>
117122
* </ul>
118123
* </li>

‎clients/client-s3/src/commands/DeleteObjectsCommand.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,11 @@ export interface DeleteObjectsCommandOutput extends DeleteObjectsOutput, __Metad
9292
* <code>s3:DeleteObjectVersion</code>
9393
* </b> - To delete a specific version of an object from a versioning-enabled
9494
* bucket, you must specify the <code>s3:DeleteObjectVersion</code> permission.</p>
95+
* <note>
96+
* <p>If the <code>s3:DeleteObject</code> or <code>s3:DeleteObjectVersion</code> permissions are explicitly
97+
* denied in your bucket policy, attempts to delete any unversioned objects
98+
* result in a <code>403 Access Denied</code> error.</p>
99+
* </note>
95100
* </li>
96101
* </ul>
97102
* </li>

‎clients/client-s3/src/commands/GetBucketEncryptionCommand.ts‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,13 @@ export interface GetBucketEncryptionCommandOutput extends GetBucketEncryptionOut
2929

3030
/**
3131
* <p>Returns the default encryption configuration for an Amazon S3 bucket. By default, all buckets have a
32-
* default encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3). </p>
32+
* default encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3). This operation also returns the <code>BucketKeyEnabled</code> and <code>BlockedEncryptionTypes</code> statuses. </p>
3333
* <note>
3434
* <ul>
3535
* <li>
3636
* <p>
3737
* <b>General purpose buckets</b> - For information about the bucket
38-
* default encryption feature, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html">Amazon S3 Bucket Default Encryption</a> in the
38+
* default encryption feature, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html">Amazon S3 Bucket Default Encryption</a> in the
3939
* <i>Amazon S3 User Guide</i>.</p>
4040
* </li>
4141
* <li>
@@ -113,6 +113,11 @@ export interface GetBucketEncryptionCommandOutput extends GetBucketEncryptionOut
113113
* // KMSMasterKeyID: "STRING_VALUE",
114114
* // },
115115
* // BucketKeyEnabled: true || false,
116+
* // BlockedEncryptionTypes: { // BlockedEncryptionTypes
117+
* // EncryptionType: [ // EncryptionTypeList
118+
* // "NONE" || "SSE-C",
119+
* // ],
120+
* // },
116121
* // },
117122
* // ],
118123
* // },

‎clients/client-s3/src/commands/GetBucketPolicyCommand.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ export interface GetBucketPolicyCommandOutput extends GetBucketPolicyOutput, __M
138138
* const response = await client.send(command);
139139
* /* response is
140140
* {
141-
* Policy: `{"Version":"2008-10-17","Id":"LogPolicy","Statement":[{"Sid":"Enables the log delivery group to publish logs to your bucket ","Effect":"Allow","Principal":{"AWS":"111122223333"},"Action":["s3:GetBucketAcl","s3:GetObjectAcl","s3:PutObject"],"Resource":["arn:aws:s3:::policytest1/*","arn:aws:s3:::policytest1"]}]}`
141+
* Policy: `{"Version":"2008-10-17",&TCX5-2025-waiver;"Id":"LogPolicy","Statement":[{"Sid":"Enables the log delivery group to publish logs to your bucket ","Effect":"Allow","Principal":{"AWS":"111122223333"},"Action":["s3:GetBucketAcl","s3:GetObjectAcl","s3:PutObject"],"Resource":["arn:aws:s3:::policytest1/*","arn:aws:s3:::policytest1"]}]}`
142142
* }
143143
* *\/
144144
* ```

‎clients/client-s3/src/commands/GetBucketTaggingCommand.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ export interface GetBucketTaggingCommandOutput extends GetBucketTaggingOutput, _
3131
* <note>
3232
* <p>This operation is not supported for directory buckets.</p>
3333
* </note>
34-
* <p>Returns the tag set associated with the bucket.</p>
34+
* <p>Returns the tag set associated with the general purpose bucket.</p>
3535
* <p>To use this operation, you must have permission to perform the <code>s3:GetBucketTagging</code>
3636
* action. By default, the bucket owner has this permission and can grant this permission to others.</p>
3737
* <p>

‎clients/client-s3/src/commands/PutBucketEncryptionCommand.ts‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ export interface PutBucketEncryptionCommandInput extends PutBucketEncryptionRequ
2828
export interface PutBucketEncryptionCommandOutput extends __MetadataBearer {}
2929

3030
/**
31-
* <p>This operation configures default encryption and Amazon S3 Bucket Keys for an existing bucket.</p>
31+
* <p>This operation configures default encryption and Amazon S3 Bucket Keys for an existing bucket. You can also block encryption types using this operation.</p>
3232
* <note>
3333
* <p>
3434
* <b>Directory buckets </b> - For directory buckets, you must make requests for this API operation to the Regional endpoint. These endpoints support path-style requests in the format <code>https://s3express-control.<i>region-code</i>.amazonaws.com/<i>bucket-name</i>
@@ -170,6 +170,11 @@ export interface PutBucketEncryptionCommandOutput extends __MetadataBearer {}
170170
* KMSMasterKeyID: "STRING_VALUE",
171171
* },
172172
* BucketKeyEnabled: true || false,
173+
* BlockedEncryptionTypes: { // BlockedEncryptionTypes
174+
* EncryptionType: [ // EncryptionTypeList
175+
* "NONE" || "SSE-C",
176+
* ],
177+
* },
173178
* },
174179
* ],
175180
* },

‎clients/client-s3/src/commands/PutBucketTaggingCommand.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ export interface PutBucketTaggingCommandOutput extends __MetadataBearer {}
3131
* <note>
3232
* <p>This operation is not supported for directory buckets.</p>
3333
* </note>
34-
* <p>Sets the tags for a bucket.</p>
34+
* <p>Sets the tags for a general purpose bucket. </p>
3535
* <p>Use tags to organize your Amazon Web Services bill to reflect your own cost structure. To do this, sign up to get
3636
* your Amazon Web Services account bill with tag key values included. Then, to see the cost of combined resources,
3737
* organize your billing information according to resources with the same tag key values. For example, you

‎clients/client-s3/src/models/enums.ts‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,19 @@ export const StorageClassAnalysisSchemaVersion = {
405405
export type StorageClassAnalysisSchemaVersion =
406406
(typeof StorageClassAnalysisSchemaVersion)[keyof typeof StorageClassAnalysisSchemaVersion];
407407

408+
/**
409+
* @public
410+
* @enum
411+
*/
412+
export const EncryptionType = {
413+
NONE: "NONE",
414+
SSE_C: "SSE-C",
415+
} as const;
416+
/**
417+
* @public
418+
*/
419+
export type EncryptionType = (typeof EncryptionType)[keyof typeof EncryptionType];
420+
408421
/**
409422
* @public
410423
* @enum

‎clients/client-s3/src/models/models_0.ts‎

Lines changed: 54 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@ import {
1717
DataRedundancy,
1818
DeleteMarkerReplicationStatus,
1919
EncodingType,
20+
EncryptionType,
2021
Event,
2122
ExistingObjectReplicationStatus,
2223
ExpirationState,
2324
ExpirationStatus,
24-
ExpressionType,
2525
FileHeaderInfo,
2626
FilterRuleName,
2727
IntelligentTieringAccessTier,
@@ -1875,18 +1875,11 @@ export interface CreateBucketConfiguration {
18751875
Bucket?: BucketInfo | undefined;
18761876

18771877
/**
1878-
* <p>An array of tags that you can apply to the bucket that you're creating. Tags are key-value pairs of
1879-
* metadata used to categorize and organize your buckets, track costs, and control access. </p>
1878+
* <p>An array of tags that you can apply to the bucket that you're creating. Tags are key-value pairs of metadata used to categorize and organize your buckets, track costs, and control access. </p>
18801879
* <note>
1881-
* <ul>
1882-
* <li>
1883-
* <p>This parameter is only supported for S3 directory buckets. For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-tagging.html">Using tags with
1884-
* directory buckets</a>.</p>
1885-
* </li>
1886-
* <li>
1887-
* <p>You must have the <code>s3express:TagResource</code> permission to create a directory bucket with tags.</p>
1888-
* </li>
1889-
* </ul>
1880+
* <p>This parameter is only supported for S3 directory buckets. For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-tagging.html">Using tags with
1881+
* directory buckets</a>.</p>
1882+
* <p>You must have the <code>s3express:TagResource</code> permission to create a directory bucket with tags.</p>
18901883
* </note>
18911884
* @public
18921885
*/
@@ -6424,6 +6417,46 @@ export interface ServerSideEncryptionByDefault {
64246417
KMSMasterKeyID?: string | undefined;
64256418
}
64266419

6420+
/**
6421+
* <p>A bucket-level setting for Amazon S3 general purpose buckets used to prevent the upload of new objects encrypted with the specified server-side encryption type. For example, blocking an encryption type will block <code>PutObject</code>, <code>CopyObject</code>, <code>PostObject</code>, multipart upload, and replication requests to the bucket for objects with the specified encryption type. However, you can continue to read and list any pre-existing objects already encrypted with the specified encryption type. For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/userguide/block-encryption-type.html">Blocking an encryption type for a general purpose bucket</a>. </p>
6422+
* <p>This data type is used with the following actions:</p>
6423+
* <ul>
6424+
* <li>
6425+
* <p>
6426+
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html">PutBucketEncryption</a>
6427+
* </p>
6428+
* </li>
6429+
* <li>
6430+
* <p>
6431+
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html">GetBucketEncryption</a>
6432+
* </p>
6433+
* </li>
6434+
* <li>
6435+
* <p>
6436+
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html">DeleteBucketEncryption</a>
6437+
* </p>
6438+
* </li>
6439+
* </ul>
6440+
* <dl>
6441+
* <dt>Permissions</dt>
6442+
* <dd>
6443+
* <p>You must have the <code>s3:PutEncryptionConfiguration</code> permission to block or unblock an encryption type for a bucket. </p>
6444+
* <p>You must have the <code>s3:GetEncryptionConfiguration</code> permission to view a bucket's encryption type. </p>
6445+
* </dd>
6446+
* </dl>
6447+
* @public
6448+
*/
6449+
export interface BlockedEncryptionTypes {
6450+
/**
6451+
* <p>The object encryption type that you want to block or unblock for an Amazon S3 general purpose bucket.</p>
6452+
* <note>
6453+
* <p>Currently, this parameter only supports blocking or unblocking server side encryption with customer-provided keys (SSE-C). For more information about SSE-C, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html">Using server-side encryption with customer-provided keys (SSE-C)</a>.</p>
6454+
* </note>
6455+
* @public
6456+
*/
6457+
EncryptionType?: EncryptionType[] | undefined;
6458+
}
6459+
64276460
/**
64286461
* <p>Specifies the default server-side encryption configuration.</p>
64296462
* <note>
@@ -6477,6 +6510,15 @@ export interface ServerSideEncryptionRule {
64776510
* @public
64786511
*/
64796512
BucketKeyEnabled?: boolean | undefined;
6513+
6514+
/**
6515+
* <p>A bucket-level setting for Amazon S3 general purpose buckets used to prevent the upload of new objects encrypted with the specified server-side encryption type. For example, blocking an encryption type will block <code>PutObject</code>, <code>CopyObject</code>, <code>PostObject</code>, multipart upload, and replication requests to the bucket for objects with the specified encryption type. However, you can continue to read and list any pre-existing objects already encrypted with the specified encryption type. For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/userguide/block-encryption-type.html">Blocking an encryption type for a general purpose bucket</a>. </p>
6516+
* <note>
6517+
* <p>Currently, this parameter only supports blocking or unblocking Server Side Encryption with Customer Provided Keys (SSE-C). For more information about SSE-C, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html">Using server-side encryption with customer-provided keys (SSE-C)</a>.</p>
6518+
* </note>
6519+
* @public
6520+
*/
6521+
BlockedEncryptionTypes?: BlockedEncryptionTypes | undefined;
64806522
}
64816523

64826524
/**
@@ -16624,46 +16666,3 @@ export interface OutputSerialization {
1662416666
*/
1662516667
JSON?: JSONOutput | undefined;
1662616668
}
16627-
16628-
/**
16629-
* <important>
16630-
* <p>Amazon S3 Select is no longer available to new customers. Existing customers of Amazon S3 Select can
16631-
* continue to use the feature as usual. <a href="http://aws.amazon.com/blogs/storage/how-to-optimize-querying-your-data-in-amazon-s3/">Learn more</a>
16632-
* </p>
16633-
* </important>
16634-
* <p>Describes the parameters for Select job types.</p>
16635-
* <p>Learn <a href="http://aws.amazon.com/blogs/storage/how-to-optimize-querying-your-data-in-amazon-s3/">How to
16636-
* optimize querying your data in Amazon S3</a> using <a href="https://docs.aws.amazon.com/athena/latest/ug/what-is.html">Amazon Athena</a>, <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/transforming-objects.html">S3 Object Lambda</a>, or client-side
16637-
* filtering.</p>
16638-
* @public
16639-
*/
16640-
export interface SelectParameters {
16641-
/**
16642-
* <p>Describes the serialization format of the object.</p>
16643-
* @public
16644-
*/
16645-
InputSerialization: InputSerialization | undefined;
16646-
16647-
/**
16648-
* <p>The type of the provided expression (for example, SQL).</p>
16649-
* @public
16650-
*/
16651-
ExpressionType: ExpressionType | undefined;
16652-
16653-
/**
16654-
* <important>
16655-
* <p>Amazon S3 Select is no longer available to new customers. Existing customers of Amazon S3 Select can
16656-
* continue to use the feature as usual. <a href="http://aws.amazon.com/blogs/storage/how-to-optimize-querying-your-data-in-amazon-s3/">Learn more</a>
16657-
* </p>
16658-
* </important>
16659-
* <p>The expression that is used to query the object.</p>
16660-
* @public
16661-
*/
16662-
Expression: string | undefined;
16663-
16664-
/**
16665-
* <p>Describes how the results of the Select job are serialized.</p>
16666-
* @public
16667-
*/
16668-
OutputSerialization: OutputSerialization | undefined;
16669-
}

0 commit comments

Comments
 (0)