Amazon Simple Storage Service - docs.aws.amazon.com

1 Amazon Simple Storage ServiceDeveloper GuideAPI Version 2006-03-01 Amazon Simple Storage Service Developer GuideAmazon Simple Storage Service : Developer GuideCopyright 2020 Amazon Web Services, Inc. and/or its affiliates. All rights 's trademarks and trade dress may not be used in connection with any product or Service that is notAmazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages ordiscredits Amazon . All other trademarks not owned by Amazon are the property of their respective owners, who mayor may not be affiliated with, connected to, or sponsored by Simple Storage Service Developer GuideTable of ContentsWhat is Amazon S3? .. 1 How do .. 1 Introduction .. 2 Overview of Amazon S3 and this guide .. 2 Advantages of using Amazon S3 .. 2 Amazon S3 concepts .. 3 Buckets .. 3 Objects .. 3 Keys .. 3 Regions.

2 4 Amazon S3 data consistency model .. 4 Amazon S3 features .. 7 Storage 7 Bucket policies .. 8 AWS identity and access management .. 8 Access control lists .. 9 Versioning .. 9 Amazon S3 application programming interfaces (API) .. 9 The REST interface .. 9 The SOAP interface .. 10 Paying for Amazon S3 .. 10 Related services .. 10 Making requests .. 11 About access keys .. 11 AWS account access keys .. 11 IAM user access keys .. 11 Temporary security credentials .. 12 Request endpoints .. 12 Making requests over IPv6 .. 13 Getting started with IPv6 .. 13 Using IPv6 addresses in IAM policies .. 14 Testing IP address compatibility .. 15 Using dual-stack 15 Making requests using the AWS SDKs .. 20 Using AWS account or IAM user credentials .. 20 Using IAM user temporary credentials .. 27 Using federated user temporary credentials .. 36 Making requests using the REST API.

3 45 Constructing S3 hostnames for REST API requests .. 46 Virtual hosted style and path style requests .. 46 Dual-stack endpoints (REST API).. 47 Virtual hosting of buckets .. 47 Request redirection and the REST API .. 53 Buckets .. 55 Creating a bucket .. 55 Amazon S3 console .. 56 REST 56 AWS SDK .. 56 About 57 Managing public access to buckets .. 57 Accessing a bucket .. 57 Virtual hosted style access .. 58 Path-style access .. 58 API Version 2006-03-01iiiAmazon Simple Storage Service Developer GuideAccessing an S3 bucket over IPv6 .. 58 Accessing a bucket through an S3 access point .. 58 Accessing a Bucket using S3:// .. 59 Bucket configuration options .. 59 Restrictions and limitations .. 60 Rules for 61 Examples of creating a bucket .. 62 Using the Amazon S3 Console .. 63 Using the AWS SDK for Java .. 63 Using the AWS SDK for .NET .. 64 Using the AWS SDK for Ruby Version 3.

4 65 Using Other AWS SDKs .. 65 Deleting or emptying a bucket .. 65 Delete a bucket .. 66 Empty a bucket .. 68 Setting default bucket encryption .. 69 How to set up Amazon S3 default bucket encryption .. 70 Using an S3 Bucket Key with default encryption .. 70 Using encryption for cross-account operations .. 71 Using default encryption with replication .. 71 Monitoring default encryption with CloudTrail and CloudWatch .. 71 More info .. 72 Transfer Acceleration .. 72 Why use Transfer Acceleration? .. 72 Getting Started .. 73 Requirements for using Amazon S3 Transfer Acceleration .. 74 Transfer Acceleration Examples .. 75 Requester Pays buckets .. 79 Configure with the console .. 80 Configure with the REST API .. 80 Charge Details .. 82 Access Control .. 82 Billing and usage reporting .. 83 Billing reports .. 83 Usage report .. 85 Understanding billing and usage reports.

5 86 Using cost allocation tags .. 94 Access points .. 97 Creating access points .. 97 Rules for naming Amazon S3 access points .. 98 Creating access points restricted to a virtual private cloud .. 98 Managing public access to access points .. 100 Configuring IAM policies for using access points .. 100 Using access points .. 105 Access point compatibility with S3 operations and AWS services .. 105 Monitoring and 106 Restrictions and limitations .. 108 Objects .. 109 Object key and metadata .. 110 Object keys .. 110 Object metadata .. 112 Storage 114 Storage classes for frequently accessed objects .. 115 Storage class for automatically optimizing data with changing or unknown access patterns .. 115 Storage classes for infrequently accessed objects .. 115 Storage classes for archiving objects .. 116 API Version 2006-03-01ivAmazon Simple Storage Service Developer GuideStorage class for Amazon S3 on Outposts.

6 117 Comparing the Amazon S3 Storage classes .. 117 Setting the Storage class of an object .. 118 Subresources .. 118S3 Versioning .. 119 Object tagging .. 121 API operations related to object tagging .. 123 Object tagging and additional information .. 124 Managing object tags .. 127 Lifecycle management .. 130 When should I use lifecycle configuration? .. 130 How do I configure a lifecycle? .. 131 Additional considerations .. 131 Lifecycle configuration elements .. 137 Examples of lifecycle configuration .. 144 Setting lifecycle configuration .. 153 Cross-origin resource sharing (CORS) .. 162 Cross-origin resource sharing: Use-case scenarios .. 162 How do I configure CORS on my bucket? .. 163 How does Amazon S3 evaluate the CORS configuration on a bucket? .. 166 Enabling CORS .. 166 Troubleshooting CORS .. 172 Operations on objects .. 172 Getting objects .. 173 Uploading objects.

7 182 Copying objects .. 227 Listing object keys .. 238 Deleting objects .. 244 Selecting content from objects .. 263 Restoring archived objects .. 267 Querying Archived Objects .. 272 Storage Class 276 How to set up Storage class analysis .. 276 Storage class 277 How can I export Storage class analysis data? .. 278 Storage class analysis export file layout .. 279 Amazon S3 analytics REST APIs .. 279 Amazon S3 on Outposts .. 280 Getting started with Amazon S3 on Outposts .. 280 Order an Outpost .. 281 Setting up S3 on Outposts .. 281 Restrictions and limitations .. 282 Data consistency model .. 282 Supported API operations .. 282 Unsupported Amazon S3 features .. 283 Network restrictions .. 284 Using IAM with S3 on 284 ARNs for S3 on 285 Working with S3 on Outposts .. 285 Accessing S3 on Outposts .. 288S3 on Outposts examples using the AWS CLI .. 288S3 on Outposts examples using the SDK for Java.

8 293 Security .. 313 Data protection .. 313 Internetwork privacy .. 314 API Version 2006-03-01vAmazon Simple Storage Service Developer GuideData encryption .. 314 Identity and access management .. 358 Introduction to managing access to Amazon S3 resources .. 358 Amazon S3 resource access options .. 358 Overview .. 358 How Amazon S3 Authorizes a Request .. 365 Guidelines for using the available access policy options .. 371 Example walkthroughs: Managing access .. 375 Using Bucket Policies and User Policies .. 401 Managing Access with ACLs .. 509 Controlling object ownership .. 521 Blocking public access .. 523 Using Service -Linked Roles .. 531 Logging and 534 Compliance Validation .. 535 Inventory .. 535 Resilience .. 545 Backup encryption .. 546 Versioning .. 546 Locking objects .. 568 Infrastructure security .. 576 Configuration and vulnerability analysis .. 577 Bucket owner condition.

9 577 When to use bucket owner condition .. 577 Verifying a bucket owner .. 578 Restrictions and limitations .. 580 Security Best Practices .. 581 Amazon S3 Preventative Security Best Practices .. 581 Amazon S3 Monitoring and Auditing Best Practices .. 583S3 Batch 586 Terminology .. 586 Batch Ops 586 How a job works .. 587 Specifying a manifest .. 587 Creating a job .. 588 Creating a job request .. 588 Creating a job response .. 589 Granting permissions for Batch 595 Put object copy .. 595 Initiate restore object .. 596 Invoke Lambda function .. 597 Put object ACL .. 604 Put object tagging .. 605 Manage Object Lock retention dates .. 605 Manage Object Lock legal hold .. 606 Managing 607 Listing 607 Viewing job 607 Controlling access and labeling jobs using tags .. 607 Assigning job priority .. 608 Job 609 Tracking job failure .. 611 Notifications and 611 Completion reports.

10 611 API Version 2006-03-01viAmazon Simple Storage Service Developer GuideBatch Operations examples using the AWS CLI .. 612 Batch Operations examples using Java .. 625 Job tags 639 Completion report examples .. 644 Example: Copying objects across AWS accounts .. 646 Creating EventBridge rules for viewing Batch Operations job events .. 651S3 Storage 655 Understanding S3 Storage 655S3 Storage Lens 656 Working with Organizations .. 660 Enabling trusted access .. 660 Disabling trusted access .. 661 Registering a delegated administrator .. 661De-registering a delegated administrator .. 661 Setting permissions .. 662 Setting account permissions .. 662 Setting AWS Organizations permissions .. 663 Viewing Storage 664 Viewing metrics on the dashboards .. 664 Viewing metrics in a data export .. 665 Metrics glossary .. 669 Examples and walk-through .. 673S3 Storage Lens examples using the AWS CLI.