2025/11/19 - Amazon Simple Storage Service - 2 updated api methods
Changes Adds support for blocking SSE-C writes to general purpose buckets.
{'ServerSideEncryptionConfiguration': {'Rules': {'BlockedEncryptionTypes': {'EncryptionType': ['NONE '
'| '
'SSE-C']}}}}
Returns the default encryption configuration for an Amazon S3 bucket. By default, all buckets have a default encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3). This operation also returns the BucketKeyEnabled and BlockedEncryptionTypes statuses.
General purpose bucket permissions - The s3:GetEncryptionConfiguration permission is required in a policy. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Operations and Managing Access Permissions to Your Amazon S3 Resources.
Directory bucket permissions - To grant access to this API operation, you must have the s3express:GetEncryptionConfiguration permission in an IAM identity-based policy instead of a bucket policy. Cross-account access to this API operation isn't supported. This operation can only be performed by the Amazon Web Services account that owns the resource. For more information about directory bucket policies and permissions, see Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone in the Amazon S3 User Guide.
HTTP Host header syntax
Directory buckets - The HTTP Host header syntax is s3express-control.region-code.amazonaws.com.
The following operations are related to GetBucketEncryption:
See also: AWS API Documentation
Request Syntax
client.get_bucket_encryption(
Bucket='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket from which the server-side encryption configuration is retrieved.
Directory buckets - When you use this operation with a directory bucket, you must use path-style requests in the format https://s3express-control.region-code.amazonaws.com/bucket-name ``. Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format ``bucket-base-name--zone-id--x-s3 (for example, DOC-EXAMPLE-BUCKET--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'ServerSideEncryptionConfiguration': {
'Rules': [
{
'ApplyServerSideEncryptionByDefault': {
'SSEAlgorithm': 'AES256'|'aws:fsx'|'aws:kms'|'aws:kms:dsse',
'KMSMasterKeyID': 'string'
},
'BucketKeyEnabled': True|False,
'BlockedEncryptionTypes': {
'EncryptionType': [
'NONE'|'SSE-C',
]
}
},
]
}
}
Response Structure
(dict) --
ServerSideEncryptionConfiguration (dict) --
Specifies the default server-side-encryption configuration.
Rules (list) --
Container for information about a particular server-side encryption configuration rule.
(dict) --
Specifies the default server-side encryption configuration.
ApplyServerSideEncryptionByDefault (dict) --
Specifies the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn't specify any server-side encryption, this default encryption will be applied.
SSEAlgorithm (string) --
Server-side encryption algorithm to use for the default encryption.
KMSMasterKeyID (string) --
Amazon Web Services Key Management Service (KMS) customer managed key ID to use for the default encryption.
You can specify the key ID, key alias, or the Amazon Resource Name (ARN) of the KMS key.
Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
Key Alias: alias/alias-name
If you are using encryption with cross-account or Amazon Web Services service operations, you must use a fully qualified KMS key ARN. For more information, see Using encryption for cross-account operations.
BucketKeyEnabled (boolean) --
Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket. Existing objects are not affected. Setting the BucketKeyEnabled element to true causes Amazon S3 to use an S3 Bucket Key.
BlockedEncryptionTypes (dict) --
A bucket-level setting for Amazon S3 general purpose buckets used to prevent the upload of new objects encrypted with the specified server-side encryption type. For example, blocking an encryption type will block PutObject, CopyObject, PostObject, multipart upload, and replication requests to the bucket for objects with the specified encryption type. However, you can continue to read and list any pre-existing objects already encrypted with the specified encryption type. For more information, see Blocking an encryption type for a general purpose bucket.
EncryptionType (list) --
The object encryption type that you want to block or unblock for an Amazon S3 general purpose bucket.
(string) --
{'ServerSideEncryptionConfiguration': {'Rules': {'BlockedEncryptionTypes': {'EncryptionType': ['NONE '
'| '
'SSE-C']}}}}
This operation configures default encryption and Amazon S3 Bucket Keys for an existing bucket. You can also block encryption types using this operation.
By default, all buckets have a default encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3).
General purpose bucket permissions - The s3:PutEncryptionConfiguration permission is required in a policy. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Operations and Managing Access Permissions to Your Amazon S3 Resources in the Amazon S3 User Guide.
Directory bucket permissions - To grant access to this API operation, you must have the s3express:PutEncryptionConfiguration permission in an IAM identity-based policy instead of a bucket policy. Cross-account access to this API operation isn't supported. This operation can only be performed by the Amazon Web Services account that owns the resource. For more information about directory bucket policies and permissions, see Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone in the Amazon S3 User Guide. To set a directory bucket default encryption with SSE-KMS, you must also have the kms:GenerateDataKey and the kms:Decrypt permissions in IAM identity-based policies and KMS key policies for the target KMS key.
HTTP Host header syntax
Directory buckets - The HTTP Host header syntax is s3express-control.region-code.amazonaws.com.
The following operations are related to PutBucketEncryption:
See also: AWS API Documentation
Request Syntax
client.put_bucket_encryption(
Bucket='string',
ContentMD5='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME',
ServerSideEncryptionConfiguration={
'Rules': [
{
'ApplyServerSideEncryptionByDefault': {
'SSEAlgorithm': 'AES256'|'aws:fsx'|'aws:kms'|'aws:kms:dsse',
'KMSMasterKeyID': 'string'
},
'BucketKeyEnabled': True|False,
'BlockedEncryptionTypes': {
'EncryptionType': [
'NONE'|'SSE-C',
]
}
},
]
},
ExpectedBucketOwner='string'
)
string
[REQUIRED]
Specifies default encryption for a bucket using server-side encryption with different key options.
Directory buckets - When you use this operation with a directory bucket, you must use path-style requests in the format https://s3express-control.region-code.amazonaws.com/bucket-name ``. Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format ``bucket-base-name--zone-id--x-s3 (for example, DOC-EXAMPLE-BUCKET--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide
string
The Base64 encoded 128-bit MD5 digest of the server-side encryption configuration.
For requests made using the Amazon Web Services Command Line Interface (CLI) or Amazon Web Services SDKs, this field is calculated automatically.
string
Indicates the algorithm used to create the checksum for the request when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request. For more information, see Checking object integrity in the Amazon S3 User Guide.
If you provide an individual checksum, Amazon S3 ignores any provided ChecksumAlgorithm parameter.
dict
[REQUIRED]
Specifies the default server-side-encryption configuration.
Rules (list) -- [REQUIRED]
Container for information about a particular server-side encryption configuration rule.
(dict) --
Specifies the default server-side encryption configuration.
ApplyServerSideEncryptionByDefault (dict) --
Specifies the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn't specify any server-side encryption, this default encryption will be applied.
SSEAlgorithm (string) -- [REQUIRED]
Server-side encryption algorithm to use for the default encryption.
KMSMasterKeyID (string) --
Amazon Web Services Key Management Service (KMS) customer managed key ID to use for the default encryption.
You can specify the key ID, key alias, or the Amazon Resource Name (ARN) of the KMS key.
Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
Key Alias: alias/alias-name
If you are using encryption with cross-account or Amazon Web Services service operations, you must use a fully qualified KMS key ARN. For more information, see Using encryption for cross-account operations.
BucketKeyEnabled (boolean) --
Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket. Existing objects are not affected. Setting the BucketKeyEnabled element to true causes Amazon S3 to use an S3 Bucket Key.
BlockedEncryptionTypes (dict) --
A bucket-level setting for Amazon S3 general purpose buckets used to prevent the upload of new objects encrypted with the specified server-side encryption type. For example, blocking an encryption type will block PutObject, CopyObject, PostObject, multipart upload, and replication requests to the bucket for objects with the specified encryption type. However, you can continue to read and list any pre-existing objects already encrypted with the specified encryption type. For more information, see Blocking an encryption type for a general purpose bucket.
EncryptionType (list) --
The object encryption type that you want to block or unblock for an Amazon S3 general purpose bucket.
(string) --
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
None