2026/11/05 - AWS DataSync - 6 updated api methods
Changes Adds support for federated identity on Azure Blob Storage and object storage locations, enabling DataSync to authenticate to Azure and Google Cloud Storage using Workload Identity Federation (WIF) over OpenID Connect (OIDC) instead of stored long-lived credentials.
{'AuthenticationType': {'OIDC'},
'FederatedIdentity': {'AwsIamRole': 'string',
'AzureOidc': {'ClientId': 'string',
'TenantId': 'string'}}}
Creates a transfer location for a Microsoft Azure Blob Storage container. DataSync can use this location as a transfer source or destination. You can make transfers with or without a DataSync agent that connects to your container.
Before you begin, make sure you know how DataSync accesses Azure Blob Storage and works with access tiers and blob types.
See also: AWS API Documentation
Request Syntax
client.create_location_azure_blob(
ContainerUrl='string',
AuthenticationType='SAS'|'NONE'|'OIDC',
SasConfiguration={
'Token': 'string'
},
FederatedIdentity={
'AwsIamRole': 'string',
'AzureOidc': {
'TenantId': 'string',
'ClientId': 'string'
}
},
BlobType='BLOCK',
AccessTier='HOT'|'COOL'|'ARCHIVE',
Subdirectory='string',
AgentArns=[
'string',
],
Tags=[
{
'Key': 'string',
'Value': 'string'
},
],
CmkSecretConfig={
'SecretArn': 'string',
'KmsKeyArn': 'string'
},
CustomSecretConfig={
'SecretArn': 'string',
'SecretAccessRoleArn': 'string'
}
)
string
[REQUIRED]
Specifies the URL of the Azure Blob Storage container involved in your transfer.
string
[REQUIRED]
Specifies the authentication method DataSync uses to access your Azure Blob Storage. DataSync can access blob storage using a shared access signature (SAS) or an OpenID Connect (OIDC) token.
dict
Specifies the SAS configuration that allows DataSync to access your Azure Blob Storage.
Token (string) -- [REQUIRED]
Specifies a SAS token that provides permissions to access your Azure Blob Storage.
The token is part of the SAS URI string that comes after the storage resource URI and a question mark. A token looks something like this:
sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%2FXTI9E%2F%2Fmq171%2BZU178wcwqU%3D
dict
Specifies the federated identity configuration that allows DataSync to access your Azure Blob Storage using an OpenID Connect (OIDC) token instead of a shared access signature (SAS). Provide either FederatedIdentity or SasConfiguration, but not both.
AwsIamRole (string) --
Specifies the ARN for an Amazon Web Services role that allows DataSync to invoke STS GetWebIdentityToken API on behalf of the customer account and to obtain Amazon Web Services STS JWT (web token).
AzureOidc (dict) --
External identity parameters for Azure Blob Storage.
TenantId (string) -- [REQUIRED]
Azure tenant ID string.
ClientId (string) -- [REQUIRED]
Azure client ID string.
string
Specifies the type of blob that you want your objects or files to be when transferring them into Azure Blob Storage. Currently, DataSync only supports moving data into Azure Blob Storage as block blobs. For more information on blob types, see the Azure Blob Storage documentation.
string
Specifies the access tier that you want your objects or files transferred into. This only applies when using the location as a transfer destination. For more information, see Access tiers.
string
Specifies path segments if you want to limit your transfer to a virtual directory in your container (for example, /my/images).
list
(Optional) Specifies the Amazon Resource Name (ARN) of the DataSync agent that can connect with your Azure Blob Storage container. If you are setting up an agentless cross-cloud transfer, you do not need to specify a value for this parameter.
You can specify more than one agent. For more information, see Using multiple agents for your transfer.
(string) --
list
Specifies labels that help you categorize, filter, and search for your Amazon Web Services resources. We recommend creating at least a name tag for your transfer location.
(dict) --
A key-value pair representing a single tag that's been applied to an Amazon Web Services resource.
Key (string) -- [REQUIRED]
The key for an Amazon Web Services resource tag.
Value (string) --
The value for an Amazon Web Services resource tag.
dict
Specifies configuration information for a DataSync-managed secret, which includes the authentication token that DataSync uses to access a specific AzureBlob storage location, with a customer-managed KMS key.
When you include this parameter as part of a CreateLocationAzureBlob request, you provide only the KMS key ARN. DataSync uses this KMS key together with the authentication token you specify for SasConfiguration to create a DataSync-managed secret to store the location access credentials.
Make sure that DataSync has permission to access the KMS key that you specify. For more information, see Using a service-managed secret encrypted with a custom KMS key.
SecretArn (string) --
Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for KmsKeyArn.
KmsKeyArn (string) --
Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for SecretArn. DataSync provides this key to Secrets Manager.
dict
Specifies configuration information for a customer-managed Secrets Manager secret where the authentication token for an AzureBlob storage location is stored in plain text, in Secrets Manager. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. For more information, see Using a secret that you manage.
SecretArn (string) --
Specifies the ARN for an Secrets Manager secret.
SecretAccessRoleArn (string) --
Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for SecretArn.
dict
Response Syntax
{
'LocationArn': 'string'
}
Response Structure
(dict) --
LocationArn (string) --
The ARN of the Azure Blob Storage transfer location that you created.
{'FederatedIdentity': {'AwsIamRole': 'string',
'ExternalIdentity': {'GoogleOidc': {'IdentityPoolName': 'string',
'IdentityProviderName': 'string',
'ProjectName': 'string',
'ProjectNumber': 'string'}}}}
Creates a transfer location for an object storage system. DataSync can use this location as a source or destination for transferring data. You can make transfers with or without a DataSync agent.
Before you begin, make sure that you understand the prerequisites for DataSync to work with object storage systems.
See also: AWS API Documentation
Request Syntax
client.create_location_object_storage(
ServerHostname='string',
ServerPort=123,
ServerProtocol='HTTPS'|'HTTP',
Subdirectory='string',
BucketName='string',
AccessKey='string',
SecretKey='string',
FederatedIdentity={
'AwsIamRole': 'string',
'ExternalIdentity': {
'GoogleOidc': {
'ProjectName': 'string',
'ProjectNumber': 'string',
'IdentityPoolName': 'string',
'IdentityProviderName': 'string'
}
}
},
AgentArns=[
'string',
],
Tags=[
{
'Key': 'string',
'Value': 'string'
},
],
ServerCertificate=b'bytes',
CmkSecretConfig={
'SecretArn': 'string',
'KmsKeyArn': 'string'
},
CustomSecretConfig={
'SecretArn': 'string',
'SecretAccessRoleArn': 'string'
}
)
string
[REQUIRED]
Specifies the domain name or IP address (IPv4 or IPv6) of the object storage server that your DataSync agent connects to.
integer
Specifies the port that your object storage server accepts inbound network traffic on (for example, port 443).
string
Specifies the protocol that your object storage server uses to communicate. If not specified, the default value is HTTPS.
string
Specifies the object prefix for your object storage server. If this is a source location, DataSync only copies objects with this prefix. If this is a destination location, DataSync writes all objects with this prefix.
string
[REQUIRED]
Specifies the name of the object storage bucket involved in the transfer.
string
Specifies the access key (for example, a user name) if credentials are required to authenticate with the object storage server.
string
Specifies the secret key (for example, a password) if credentials are required to authenticate with the object storage server.
dict
Specifies the federated identity configuration that allows DataSync to access your object storage using an OpenID Connect (OIDC) token instead of a long-term access key and secret key. Provide either FederatedIdentity or the AccessKey/ SecretKey credentials, but not both.
AwsIamRole (string) --
Specifies the ARN for an Amazon Web Services role that allows DataSync to invoke STS GetWebIdentityToken API on behalf of the customer account and to obtain Amazon Web Services STS JWT (web token).
ExternalIdentity (dict) --
Specifies cloud-provider-specific external identity parameters used when exchanging the Amazon Web Services web token for an OpenID Connect token at the object storage provider.
GoogleOidc (dict) --
External identity parameters for Google Cloud Storage.
ProjectName (string) -- [REQUIRED]
Human-readable project name (e.g. "my-project").
ProjectNumber (string) -- [REQUIRED]
Numeric project ID as a string (e.g. "123456789").
IdentityPoolName (string) -- [REQUIRED]
Human-readable pool name (e.g. "my-pool").
IdentityProviderName (string) -- [REQUIRED]
Human-readable provider name (e.g. "my-oidc-provider").
list
(Optional) Specifies the Amazon Resource Names (ARNs) of the DataSync agents that can connect with your object storage system. If you are setting up an agentless cross-cloud transfer, you do not need to specify a value for this parameter.
(string) --
list
Specifies the key-value pair that represents a tag that you want to add to the resource. Tags can help you manage, filter, and search for your resources. We recommend creating a name tag for your location.
(dict) --
A key-value pair representing a single tag that's been applied to an Amazon Web Services resource.
Key (string) -- [REQUIRED]
The key for an Amazon Web Services resource tag.
Value (string) --
The value for an Amazon Web Services resource tag.
bytes
Specifies a certificate chain for DataSync to authenticate with your object storage system if the system uses a private or self-signed certificate authority (CA). You must specify a single .pem file with a full certificate chain (for example, file:///home/user/.ssh/object_storage_certificates.pem).
The certificate chain might include:
The object storage system's certificate
All intermediate certificates (if there are any)
The root certificate of the signing CA
You can concatenate your certificates into a .pem file (which can be up to 32768 bytes before base64 encoding). The following example cat command creates an object_storage_certificates.pem file that includes three certificates:
cat object_server_certificate.pem intermediate_certificate.pem ca_root_certificate.pem > object_storage_certificates.pem
To use this parameter, configure ServerProtocol to HTTPS.
dict
Specifies configuration information for a DataSync-managed secret, which includes the SecretKey that DataSync uses to access a specific object storage location, with a customer-managed KMS key.
When you include this parameter as part of a CreateLocationObjectStorage request, you provide only the KMS key ARN. DataSync uses this KMS key together with the value you specify for the SecretKey parameter to create a DataSync-managed secret to store the location access credentials.
Make sure that DataSync has permission to access the KMS key that you specify. For more information, see Using a service-managed secret encrypted with a custom KMS key.
SecretArn (string) --
Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for KmsKeyArn.
KmsKeyArn (string) --
Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for SecretArn. DataSync provides this key to Secrets Manager.
dict
Specifies configuration information for a customer-managed Secrets Manager secret where the secret key for a specific object storage location is stored in plain text, in Secrets Manager. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. For more information, see Using a secret that you manage.
SecretArn (string) --
Specifies the ARN for an Secrets Manager secret.
SecretAccessRoleArn (string) --
Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for SecretArn.
dict
Response Syntax
{
'LocationArn': 'string'
}
Response Structure
(dict) --
CreateLocationObjectStorageResponse
LocationArn (string) --
Specifies the ARN of the object storage system location that you create.
{'AuthenticationType': {'OIDC'},
'FederatedIdentity': {'AwsIamRole': 'string',
'AzureOidc': {'ClientId': 'string',
'TenantId': 'string'}}}
Provides details about how an DataSync transfer location for Microsoft Azure Blob Storage is configured.
See also: AWS API Documentation
Request Syntax
client.describe_location_azure_blob(
LocationArn='string'
)
string
[REQUIRED]
Specifies the Amazon Resource Name (ARN) of your Azure Blob Storage transfer location.
dict
Response Syntax
{
'LocationArn': 'string',
'LocationUri': 'string',
'AuthenticationType': 'SAS'|'NONE'|'OIDC',
'FederatedIdentity': {
'AwsIamRole': 'string',
'AzureOidc': {
'TenantId': 'string',
'ClientId': 'string'
}
},
'BlobType': 'BLOCK',
'AccessTier': 'HOT'|'COOL'|'ARCHIVE',
'AgentArns': [
'string',
],
'CreationTime': datetime(2015, 1, 1),
'ManagedSecretConfig': {
'SecretArn': 'string'
},
'CmkSecretConfig': {
'SecretArn': 'string',
'KmsKeyArn': 'string'
},
'CustomSecretConfig': {
'SecretArn': 'string',
'SecretAccessRoleArn': 'string'
}
}
Response Structure
(dict) --
LocationArn (string) --
The ARN of your Azure Blob Storage transfer location.
LocationUri (string) --
The URL of the Azure Blob Storage container involved in your transfer.
AuthenticationType (string) --
The authentication method DataSync uses to access your Azure Blob Storage. DataSync can access blob storage using a shared access signature (SAS) or an OpenID Connect (OIDC) token.
FederatedIdentity (dict) --
The federated identity configuration that DataSync uses to access your Azure Blob Storage using an OpenID Connect (OIDC) token.
AwsIamRole (string) --
Specifies the ARN for an Amazon Web Services role that allows DataSync to invoke STS GetWebIdentityToken API on behalf of the customer account and to obtain Amazon Web Services STS JWT (web token).
AzureOidc (dict) --
External identity parameters for Azure Blob Storage.
TenantId (string) --
Azure tenant ID string.
ClientId (string) --
Azure client ID string.
BlobType (string) --
The type of blob that you want your objects or files to be when transferring them into Azure Blob Storage. Currently, DataSync only supports moving data into Azure Blob Storage as block blobs. For more information on blob types, see the Azure Blob Storage documentation.
AccessTier (string) --
The access tier that you want your objects or files transferred into. This only applies when using the location as a transfer destination. For more information, see Access tiers.
AgentArns (list) --
The ARNs of the DataSync agents that can connect with your Azure Blob Storage container.
(string) --
CreationTime (datetime) --
The time that your Azure Blob Storage transfer location was created.
ManagedSecretConfig (dict) --
Describes configuration information for a DataSync-managed secret, such as an authentication token that DataSync uses to access a specific storage location. DataSync uses the default Amazon Web Services-managed KMS key to encrypt this secret in Secrets Manager.
SecretArn (string) --
Specifies the ARN for an Secrets Manager secret.
CmkSecretConfig (dict) --
Describes configuration information for a DataSync-managed secret, such as an authentication token that DataSync uses to access a specific storage location, with a customer-managed KMS key.
SecretArn (string) --
Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for KmsKeyArn.
KmsKeyArn (string) --
Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for SecretArn. DataSync provides this key to Secrets Manager.
CustomSecretConfig (dict) --
Describes configuration information for a customer-managed secret, such as an authentication token that DataSync uses to access a specific storage location, with a customer-managed Identity and Access Management (IAM) role that provides access to the secret.
SecretArn (string) --
Specifies the ARN for an Secrets Manager secret.
SecretAccessRoleArn (string) --
Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for SecretArn.
{'FederatedIdentity': {'AwsIamRole': 'string',
'ExternalIdentity': {'GoogleOidc': {'IdentityPoolName': 'string',
'IdentityProviderName': 'string',
'ProjectName': 'string',
'ProjectNumber': 'string'}}}}
Provides details about how an DataSync transfer location for an object storage system is configured.
See also: AWS API Documentation
Request Syntax
client.describe_location_object_storage(
LocationArn='string'
)
string
[REQUIRED]
Specifies the Amazon Resource Name (ARN) of the object storage system location.
dict
Response Syntax
{
'LocationArn': 'string',
'LocationUri': 'string',
'AccessKey': 'string',
'FederatedIdentity': {
'AwsIamRole': 'string',
'ExternalIdentity': {
'GoogleOidc': {
'ProjectName': 'string',
'ProjectNumber': 'string',
'IdentityPoolName': 'string',
'IdentityProviderName': 'string'
}
}
},
'ServerPort': 123,
'ServerProtocol': 'HTTPS'|'HTTP',
'AgentArns': [
'string',
],
'CreationTime': datetime(2015, 1, 1),
'ServerCertificate': b'bytes',
'ManagedSecretConfig': {
'SecretArn': 'string'
},
'CmkSecretConfig': {
'SecretArn': 'string',
'KmsKeyArn': 'string'
},
'CustomSecretConfig': {
'SecretArn': 'string',
'SecretAccessRoleArn': 'string'
}
}
Response Structure
(dict) --
DescribeLocationObjectStorageResponse
LocationArn (string) --
The ARN of the object storage system location.
LocationUri (string) --
The URI of the object storage system location.
AccessKey (string) --
The access key (for example, a user name) required to authenticate with the object storage system.
FederatedIdentity (dict) --
The federated identity configuration that DataSync uses to access your object storage using an OpenID Connect (OIDC) token.
AwsIamRole (string) --
Specifies the ARN for an Amazon Web Services role that allows DataSync to invoke STS GetWebIdentityToken API on behalf of the customer account and to obtain Amazon Web Services STS JWT (web token).
ExternalIdentity (dict) --
Specifies cloud-provider-specific external identity parameters used when exchanging the Amazon Web Services web token for an OpenID Connect token at the object storage provider.
GoogleOidc (dict) --
External identity parameters for Google Cloud Storage.
ProjectName (string) --
Human-readable project name (e.g. "my-project").
ProjectNumber (string) --
Numeric project ID as a string (e.g. "123456789").
IdentityPoolName (string) --
Human-readable pool name (e.g. "my-pool").
IdentityProviderName (string) --
Human-readable provider name (e.g. "my-oidc-provider").
ServerPort (integer) --
The port that your object storage server accepts inbound network traffic on (for example, port 443).
ServerProtocol (string) --
The protocol that your object storage system uses to communicate.
AgentArns (list) --
The ARNs of the DataSync agents that can connect with your object storage system.
(string) --
CreationTime (datetime) --
The time that the location was created.
ServerCertificate (bytes) --
The certificate chain for DataSync to authenticate with your object storage system if the system uses a private or self-signed certificate authority (CA).
ManagedSecretConfig (dict) --
Describes configuration information for a DataSync-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location. DataSync uses the default Amazon Web Services-managed KMS key to encrypt this secret in Secrets Manager.
SecretArn (string) --
Specifies the ARN for an Secrets Manager secret.
CmkSecretConfig (dict) --
Describes configuration information for a DataSync-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed KMS key.
SecretArn (string) --
Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for KmsKeyArn.
KmsKeyArn (string) --
Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for SecretArn. DataSync provides this key to Secrets Manager.
CustomSecretConfig (dict) --
Describes configuration information for a customer-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed Identity and Access Management (IAM) role that provides access to the secret.
SecretArn (string) --
Specifies the ARN for an Secrets Manager secret.
SecretAccessRoleArn (string) --
Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for SecretArn.
{'AuthenticationType': {'OIDC'},
'FederatedIdentity': {'AwsIamRole': 'string',
'AzureOidc': {'ClientId': 'string',
'TenantId': 'string'}}}
Modifies the following configurations of the Microsoft Azure Blob Storage transfer location that you're using with DataSync.
For more information, see Configuring DataSync transfers with Azure Blob Storage.
See also: AWS API Documentation
Request Syntax
client.update_location_azure_blob(
LocationArn='string',
Subdirectory='string',
AuthenticationType='SAS'|'NONE'|'OIDC',
SasConfiguration={
'Token': 'string'
},
FederatedIdentity={
'AwsIamRole': 'string',
'AzureOidc': {
'TenantId': 'string',
'ClientId': 'string'
}
},
BlobType='BLOCK',
AccessTier='HOT'|'COOL'|'ARCHIVE',
AgentArns=[
'string',
],
CmkSecretConfig={
'SecretArn': 'string',
'KmsKeyArn': 'string'
},
CustomSecretConfig={
'SecretArn': 'string',
'SecretAccessRoleArn': 'string'
}
)
string
[REQUIRED]
Specifies the ARN of the Azure Blob Storage transfer location that you're updating.
string
Specifies path segments if you want to limit your transfer to a virtual directory in your container (for example, /my/images).
string
Specifies the authentication method DataSync uses to access your Azure Blob Storage. DataSync can access blob storage using a shared access signature (SAS) or an OpenID Connect (OIDC) token.
dict
Specifies the SAS configuration that allows DataSync to access your Azure Blob Storage.
Token (string) -- [REQUIRED]
Specifies a SAS token that provides permissions to access your Azure Blob Storage.
The token is part of the SAS URI string that comes after the storage resource URI and a question mark. A token looks something like this:
sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%2FXTI9E%2F%2Fmq171%2BZU178wcwqU%3D
dict
Specifies the federated identity configuration that allows DataSync to access your Azure Blob Storage using an OpenID Connect (OIDC) token instead of a shared access signature (SAS). Provide either FederatedIdentity or SasConfiguration, but not both.
AwsIamRole (string) --
Specifies the ARN for an Amazon Web Services role that allows DataSync to invoke STS GetWebIdentityToken API on behalf of the customer account and to obtain Amazon Web Services STS JWT (web token).
AzureOidc (dict) --
External identity parameters for Azure Blob Storage.
TenantId (string) -- [REQUIRED]
Azure tenant ID string.
ClientId (string) -- [REQUIRED]
Azure client ID string.
string
Specifies the type of blob that you want your objects or files to be when transferring them into Azure Blob Storage. Currently, DataSync only supports moving data into Azure Blob Storage as block blobs. For more information on blob types, see the Azure Blob Storage documentation.
string
Specifies the access tier that you want your objects or files transferred into. This only applies when using the location as a transfer destination. For more information, see Access tiers.
list
(Optional) Specifies the Amazon Resource Name (ARN) of the DataSync agent that can connect with your Azure Blob Storage container. If you are setting up an agentless cross-cloud transfer, you do not need to specify a value for this parameter.
You can specify more than one agent. For more information, see Using multiple agents for your transfer.
(string) --
dict
Specifies configuration information for a DataSync-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed KMS key.
SecretArn (string) --
Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for KmsKeyArn.
KmsKeyArn (string) --
Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for SecretArn. DataSync provides this key to Secrets Manager.
dict
Specifies configuration information for a customer-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed Identity and Access Management (IAM) role that provides access to the secret.
SecretArn (string) --
Specifies the ARN for an Secrets Manager secret.
SecretAccessRoleArn (string) --
Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for SecretArn.
dict
Response Syntax
{}
Response Structure
(dict) --
{'FederatedIdentity': {'AwsIamRole': 'string',
'ExternalIdentity': {'GoogleOidc': {'IdentityPoolName': 'string',
'IdentityProviderName': 'string',
'ProjectName': 'string',
'ProjectNumber': 'string'}}}}
Modifies the following configuration parameters of the object storage transfer location that you're using with DataSync.
For more information, see Configuring DataSync transfers with an object storage system.
See also: AWS API Documentation
Request Syntax
client.update_location_object_storage(
LocationArn='string',
ServerPort=123,
ServerProtocol='HTTPS'|'HTTP',
Subdirectory='string',
ServerHostname='string',
AccessKey='string',
SecretKey='string',
FederatedIdentity={
'AwsIamRole': 'string',
'ExternalIdentity': {
'GoogleOidc': {
'ProjectName': 'string',
'ProjectNumber': 'string',
'IdentityPoolName': 'string',
'IdentityProviderName': 'string'
}
}
},
AgentArns=[
'string',
],
ServerCertificate=b'bytes',
CmkSecretConfig={
'SecretArn': 'string',
'KmsKeyArn': 'string'
},
CustomSecretConfig={
'SecretArn': 'string',
'SecretAccessRoleArn': 'string'
}
)
string
[REQUIRED]
Specifies the ARN of the object storage system location that you're updating.
integer
Specifies the port that your object storage server accepts inbound network traffic on (for example, port 443).
string
Specifies the protocol that your object storage server uses to communicate.
string
Specifies the object prefix for your object storage server. If this is a source location, DataSync only copies objects with this prefix. If this is a destination location, DataSync writes all objects with this prefix.
string
Specifies the domain name or IP address (IPv4 or IPv6) of the object storage server that your DataSync agent connects to.
string
Specifies the access key (for example, a user name) if credentials are required to authenticate with the object storage server.
string
Specifies the secret key (for example, a password) if credentials are required to authenticate with the object storage server.
dict
Specifies the federated identity configuration that allows DataSync to access your object storage using an OpenID Connect (OIDC) token instead of a long-term access key and secret key. Provide either FederatedIdentity or the AccessKey/ SecretKey credentials, but not both.
AwsIamRole (string) --
Specifies the ARN for an Amazon Web Services role that allows DataSync to invoke STS GetWebIdentityToken API on behalf of the customer account and to obtain Amazon Web Services STS JWT (web token).
ExternalIdentity (dict) --
Specifies cloud-provider-specific external identity parameters used when exchanging the Amazon Web Services web token for an OpenID Connect token at the object storage provider.
GoogleOidc (dict) --
External identity parameters for Google Cloud Storage.
ProjectName (string) -- [REQUIRED]
Human-readable project name (e.g. "my-project").
ProjectNumber (string) -- [REQUIRED]
Numeric project ID as a string (e.g. "123456789").
IdentityPoolName (string) -- [REQUIRED]
Human-readable pool name (e.g. "my-pool").
IdentityProviderName (string) -- [REQUIRED]
Human-readable provider name (e.g. "my-oidc-provider").
list
(Optional) Specifies the Amazon Resource Names (ARNs) of the DataSync agents that can connect with your object storage system. If you are setting up an agentless cross-cloud transfer, you do not need to specify a value for this parameter.
(string) --
bytes
Specifies a certificate chain for DataSync to authenticate with your object storage system if the system uses a private or self-signed certificate authority (CA). You must specify a single .pem file with a full certificate chain (for example, file:///home/user/.ssh/object_storage_certificates.pem).
The certificate chain might include:
The object storage system's certificate
All intermediate certificates (if there are any)
The root certificate of the signing CA
You can concatenate your certificates into a .pem file (which can be up to 32768 bytes before base64 encoding). The following example cat command creates an object_storage_certificates.pem file that includes three certificates:
cat object_server_certificate.pem intermediate_certificate.pem ca_root_certificate.pem > object_storage_certificates.pem
To use this parameter, configure ServerProtocol to HTTPS.
Updating this parameter doesn't interfere with tasks that you have in progress.
dict
Specifies configuration information for a DataSync-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed KMS key.
SecretArn (string) --
Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for KmsKeyArn.
KmsKeyArn (string) --
Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for SecretArn. DataSync provides this key to Secrets Manager.
dict
Specifies configuration information for a customer-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed Identity and Access Management (IAM) role that provides access to the secret.
SecretArn (string) --
Specifies the ARN for an Secrets Manager secret.
SecretAccessRoleArn (string) --
Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for SecretArn.
dict
Response Syntax
{}
Response Structure
(dict) --