2026/09/08 - Amazon Simple Storage Service - 16 updated api methods
Changes Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level.
{'ObjectLockEventHold': 'ON | OFF',
'ObjectLockEventHoldDurationDays': 'integer',
'ObjectLockEventHoldDurationYears': 'integer'}
Creates a copy of an object that is already stored in Amazon S3.
You can copy individual objects between general purpose buckets, between directory buckets, and between general purpose buckets and directory buckets.
Both the Region that you want to copy the object from and the Region that you want to copy the object to must be enabled for your account. For more information about how to enable a Region for your account, see Enable or disable a Region for standalone accounts in the Amazon Web Services Account Management Guide.
All CopyObject requests must be authenticated and signed by using IAM credentials (access key ID and secret access key for the IAM identities). All headers with the x-amz- prefix, including x-amz-copy-source, must be signed. For more information, see REST Authentication.
Directory buckets - You must use the IAM credentials to authenticate and authorize your access to the CopyObject API operation, instead of using the temporary security credentials through the CreateSession API operation.
Amazon Web Services CLI or SDKs handles authentication and authorization on your behalf.
Permissions
You must have read access to the source object and write access to the destination bucket.
General purpose bucket permissions - You must have permissions in an IAM policy based on the source and destination bucket types in a CopyObject operation.
If the source object is in a general purpose bucket, you must have s3:GetObject permission to read the source object that is being copied.
If the destination bucket is a general purpose bucket, you must have s3:PutObject permission to write the object copy to the destination bucket.
Directory bucket permissions - You must have permissions in a bucket policy or an IAM identity-based policy based on the source and destination bucket types in a CopyObject operation.
If the source object that you want to copy is in a directory bucket, you must have the s3express:CreateSession permission in the Action element of a policy to read the object. If no session mode is specified, the session will be created with the maximum allowable privilege, attempting ReadWrite first, then ReadOnly if ReadWrite is not permitted. If you want to explicitly restrict the access to be read-only, you can set the s3express:SessionMode condition key to ReadOnly on the copy source bucket.
If the copy destination is a directory bucket, you must have the s3express:CreateSession permission in the Action element of a policy to write the object to the destination. The s3express:SessionMode condition key can't be set to ReadOnly on the copy destination bucket.
If the object is encrypted with SSE-KMS, you must also have the kms:GenerateDataKey and kms:Decrypt permissions in IAM identity-based policies and KMS key policies for the KMS key.
For example policies, see Example bucket policies for S3 Express One Zone and Amazon Web Services Identity and Access Management (IAM) identity-based policies for S3 Express One Zone in the Amazon S3 User Guide.
Response and special errors
When the request is an HTTP 1.1 request, the response is chunk encoded. When the request is not an HTTP 1.1 request, the response would not contain the Content-Length. You always need to read the entire response body to check if the copy succeeds.
If the copy is successful, you receive a response with information about the copied object.
A copy request might return an error when Amazon S3 receives the copy request or while Amazon S3 is copying the files. A 200 OK response can contain either a success or an error.
If the error occurs before the copy action starts, you receive a standard Amazon S3 error.
If the error occurs during the copy operation, the error response is embedded in the 200 OK response. For example, in a cross-region copy, you may encounter throttling and receive a 200 OK response. For more information, see Resolve the Error 200 response when copying objects to Amazon S3. The 200 OK status code means the copy was accepted, but it doesn't mean the copy is complete. Another example is when you disconnect from Amazon S3 before the copy is complete, Amazon S3 might cancel the copy and you may receive a 200 OK response. You must stay connected to Amazon S3 until the entire response is successfully received and processed. If you call this API operation directly, make sure to design your application to parse the content of the response and handle it appropriately. If you use Amazon Web Services SDKs, SDKs handle this condition. The SDKs detect the embedded error and apply error handling per your configuration settings (including automatically retrying the request as appropriate). If the condition persists, the SDKs throw an exception (or, for the SDKs that don't use exceptions, they return an error).
Charge
The copy request charge is based on the storage class and Region that you specify for the destination object. The request can also result in a data retrieval charge for the source if the source storage class bills for data retrieval. If the copy source is in a different region, the data transfer is billed to the copy source account. For pricing information, see Amazon S3 pricing.
HTTP Host header syntax
Directory buckets - The HTTP Host header syntax is Bucket-name.s3express-zone-id.region-code.amazonaws.com.
Amazon S3 on Outposts - When you use this action with S3 on Outposts through the REST API, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. The hostname isn't required when you use the Amazon Web Services CLI or SDKs.
The following operations are related to CopyObject:
See also: AWS API Documentation
Request Syntax
client.copy_object(
ACL='private'|'public-read'|'public-read-write'|'authenticated-read'|'aws-exec-read'|'bucket-owner-read'|'bucket-owner-full-control',
Bucket='string',
CacheControl='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
ContentDisposition='string',
ContentEncoding='string',
ContentLanguage='string',
ContentType='string',
CopySource='string',
CopySourceIfMatch='string',
CopySourceIfModifiedSince=datetime(2015, 1, 1),
CopySourceIfNoneMatch='string',
CopySourceIfUnmodifiedSince=datetime(2015, 1, 1),
Expires='string',
GrantFullControl='string',
GrantRead='string',
GrantReadACP='string',
GrantWriteACP='string',
IfMatch='string',
IfNoneMatch='string',
Key='string',
Metadata={
'string': 'string'
},
MetadataDirective='COPY'|'REPLACE',
TaggingDirective='COPY'|'REPLACE',
AnnotationDirective='COPY'|'EXCLUDE',
ServerSideEncryption='AES256'|'aws:fsx'|'aws:backup'|'aws:kms'|'aws:kms:dsse',
StorageClass='STANDARD'|'REDUCED_REDUNDANCY'|'STANDARD_IA'|'ONEZONE_IA'|'INTELLIGENT_TIERING'|'GLACIER'|'DEEP_ARCHIVE'|'OUTPOSTS'|'GLACIER_IR'|'SNOW'|'EXPRESS_ONEZONE'|'FSX_OPENZFS'|'FSX_ONTAP'|'AWS_BACKUP_WARM'|'AWS_BACKUP_LOW_COST_WARM',
WebsiteRedirectLocation='string',
SSECustomerAlgorithm='string',
SSECustomerKey='string',
SSECustomerKeyMD5='string',
SSEKMSKeyId='string',
SSEKMSEncryptionContext='string',
BucketKeyEnabled=True|False,
CopySourceSSECustomerAlgorithm='string',
CopySourceSSECustomerKey='string',
CopySourceSSECustomerKeyMD5='string',
RequestPayer='requester',
Tagging='string',
ObjectLockMode='GOVERNANCE'|'COMPLIANCE',
ObjectLockRetainUntilDate=datetime(2015, 1, 1),
ObjectLockLegalHoldStatus='ON'|'OFF',
ObjectLockEventHold='ON'|'OFF',
ObjectLockEventHoldDurationDays=123,
ObjectLockEventHoldDurationYears=123,
ExpectedBucketOwner='string',
ExpectedSourceBucketOwner='string'
)
string
The canned access control list (ACL) to apply to the object.
When you copy an object, the ACL metadata is not preserved and is set to private by default. Only the owner has full access control. To override the default ACL setting, specify a new ACL when you generate a copy request. For more information, see Using ACLs.
If the destination bucket that you're copying objects to uses the bucket owner enforced setting for S3 Object Ownership, ACLs are disabled and no longer affect permissions. Buckets that use this setting only accept PUT requests that don't specify an ACL or PUT requests that specify bucket owner full control ACLs, such as the bucket-owner-full-control canned ACL or an equivalent form of this ACL expressed in the XML format. For more information, see Controlling ownership of objects and disabling ACLs in the Amazon S3 User Guide.
string
[REQUIRED]
The name of the destination bucket.
Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the format Bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the format bucket-base-name--zone-id--x-s3 (for example, amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
S3 on Outposts - When you use this action with S3 on Outposts, you must use the Outpost bucket access point ARN or the access point alias for the destination bucket. You can only copy objects within the same Outpost bucket. It's not supported to copy objects across different Amazon Web Services Outposts, between buckets on the same Outposts, or between Outposts buckets and any other bucket types. For more information about S3 on Outposts, see What is S3 on Outposts? in the S3 on Outposts guide. When you use this action with S3 on Outposts through the REST API, you must direct requests to the S3 on Outposts hostname, in the format AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. The hostname isn't required when you use the Amazon Web Services CLI or SDKs.
string
Specifies the caching behavior along the request/reply chain.
string
Indicates the algorithm that you want Amazon S3 to use to create the checksum for the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
When you copy an object, if the source object has a checksum, that checksum value will be copied to the new object by default. If the CopyObject request does not include this x-amz-checksum-algorithm header, the checksum algorithm will be copied from the source object to the destination object (if it's present on the source object). You can optionally specify a different checksum algorithm to use with the x-amz-checksum-algorithm header. Unrecognized or unsupported values will respond with the HTTP status code 400 Bad Request.
string
Specifies presentational information for the object. Indicates whether an object should be displayed in a web browser or downloaded as a file. It allows specifying the desired filename for the downloaded file.
string
Specifies what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
string
The language the content is in.
string
A standard MIME type that describes the format of the object data.
string
[REQUIRED]
Specifies the source object for the copy operation. The source object can be up to 5 GB. If the source object is an object that was uploaded by using a multipart upload, the object copy will be a single part object after the source object is copied to the destination bucket.
You specify the value of the copy source in one of two formats, depending on whether you want to access the source object through an access point:
For objects not accessed through an access point, specify the name of the source bucket and the key of the source object, separated by a slash (/). For example, to copy the object reports/january.pdf from the general purpose bucket awsexamplebucket, use awsexamplebucket/reports/january.pdf. The value must be URL-encoded. To copy the object reports/january.pdf from the directory bucket awsexamplebucket--use1-az5--x-s3, use awsexamplebucket--use1-az5--x-s3/reports/january.pdf. The value must be URL-encoded.
For objects accessed through access points, specify the Amazon Resource Name (ARN) of the object as accessed through the access point, in the format arn:aws:s3:<Region>:<account-id>:accesspoint/<access-point-name>/object/<key>. For example, to copy the object reports/january.pdf through access point my-access-point owned by account 123456789012 in Region us-west-2, use the URL encoding of arn:aws:s3:us-west-2:123456789012:accesspoint/my-access-point/object/reports/january.pdf. The value must be URL encoded.
Alternatively, for objects accessed through Amazon S3 on Outposts, specify the ARN of the object as accessed in the format arn:aws:s3-outposts:<Region>:<account-id>:outpost/<outpost-id>/object/<key>. For example, to copy the object reports/january.pdf through outpost my-outpost owned by account 123456789012 in Region us-west-2, use the URL encoding of arn:aws:s3-outposts:us-west-2:123456789012:outpost/my-outpost/object/reports/january.pdf. The value must be URL-encoded.
If your source bucket versioning is enabled, the x-amz-copy-source header by default identifies the current version of an object to copy. If the current version is a delete marker, Amazon S3 behaves as if the object was deleted. To copy a different version, use the versionId query parameter. Specifically, append ?versionId=<version-id> to the value (for example, awsexamplebucket/reports/january.pdf?versionId=QUpfdndhfd8438MNFDN93jdnJFkdmqnh893). If you don't specify a version ID, Amazon S3 copies the latest version of the source object.
If you enable versioning on the destination bucket, Amazon S3 generates a unique version ID for the copied object. This version ID is different from the version ID of the source object. Amazon S3 returns the version ID of the copied object in the x-amz-version-id response header in the response.
If you do not enable versioning or suspend it on the destination bucket, the version ID that Amazon S3 generates in the x-amz-version-id response header is always null.
string
Copies the object if its entity tag (ETag) matches the specified tag.
If both the x-amz-copy-source-if-match and x-amz-copy-source-if-unmodified-since headers are present in the request and evaluate as follows, Amazon S3 returns 200 OK and copies the data:
x-amz-copy-source-if-match condition evaluates to true
x-amz-copy-source-if-unmodified-since condition evaluates to false
datetime
Copies the object if it has been modified since the specified time.
If both the x-amz-copy-source-if-none-match and x-amz-copy-source-if-modified-since headers are present in the request and evaluate as follows, Amazon S3 returns the 412 Precondition Failed response code:
x-amz-copy-source-if-none-match condition evaluates to false
x-amz-copy-source-if-modified-since condition evaluates to true
string
Copies the object if its entity tag (ETag) is different than the specified ETag.
If both the x-amz-copy-source-if-none-match and x-amz-copy-source-if-modified-since headers are present in the request and evaluate as follows, Amazon S3 returns the 412 Precondition Failed response code:
x-amz-copy-source-if-none-match condition evaluates to false
x-amz-copy-source-if-modified-since condition evaluates to true
datetime
Copies the object if it hasn't been modified since the specified time.
If both the x-amz-copy-source-if-match and x-amz-copy-source-if-unmodified-since headers are present in the request and evaluate as follows, Amazon S3 returns 200 OK and copies the data:
x-amz-copy-source-if-match condition evaluates to true
x-amz-copy-source-if-unmodified-since condition evaluates to false
string
The date and time at which the object is no longer cacheable.
string
Gives the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.
string
Allows grantee to read the object data and its metadata.
string
Allows grantee to read the object ACL.
string
Allows grantee to write the ACL for the applicable object.
string
Copies the object if the entity tag (ETag) of the destination object matches the specified tag. If the ETag values do not match, the operation returns a 412 Precondition Failed error. If a concurrent operation occurs during the upload S3 returns a 409 ConditionalRequestConflict response. On a 409 failure you should fetch the object's ETag and retry the upload.
Expects the ETag value as a string.
For more information about conditional requests, see RFC 7232.
string
Copies the object only if the object key name at the destination does not already exist in the bucket specified. Otherwise, Amazon S3 returns a 412 Precondition Failed error. If a concurrent operation occurs during the upload S3 returns a 409 ConditionalRequestConflict response. On a 409 failure you should retry the upload.
Expects the '*' (asterisk) character.
For more information about conditional requests, see RFC 7232.
string
[REQUIRED]
The key of the destination object.
dict
A map of metadata to store with the object in S3.
(string) --
(string) --
string
Specifies whether the metadata is copied from the source object or replaced with metadata that's provided in the request. When copying an object, you can preserve all metadata (the default) or specify new metadata. If this header isn’t specified, COPY is the default behavior.
General purpose bucket - For general purpose buckets, when you grant permissions, you can use the s3:x-amz-metadata-directive condition key to enforce certain metadata behavior when objects are uploaded. For more information, see Amazon S3 condition key examples in the Amazon S3 User Guide.
string
Specifies whether the object tag-set is copied from the source object or replaced with the tag-set that's provided in the request.
The default value is COPY.
string
Specifies whether you want to copy annotations from the source object or exclude them. If this header isn't specified, COPY is the default behavior.
Valid Values: COPY | EXCLUDE
You can specify this directive as either an HTTP header ( x-amz-object-annotation-directive) or as a query string parameter. Use the query string form when generating presigned URLs that need to control annotation copy behavior.
When set to COPY, you must have s3:GetObjectAnnotation permission on the source object and s3:PutObjectAnnotation permission on the destination. Each annotation copied is billed as a separate PUT request. If annotations on the source are modified during the copy, Amazon S3 returns a retryable error.
string
The server-side encryption algorithm used when storing this object in Amazon S3. Unrecognized or unsupported values won’t write a destination object and will receive a 400 Bad Request response.
Amazon S3 automatically encrypts all new objects that are copied to an S3 bucket. When copying an object, if you don't specify encryption information in your copy request, the encryption setting of the target object is set to the default encryption configuration of the destination bucket. By default, all buckets have a base level of encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3). If the destination bucket has a different default encryption configuration, Amazon S3 uses the corresponding encryption key to encrypt the target object copy.
With server-side encryption, Amazon S3 encrypts your data as it writes your data to disks in its data centers and decrypts the data when you access it. For more information about server-side encryption, see Using Server-Side Encryption in the Amazon S3 User Guide.
General purpose buckets
For general purpose buckets, there are the following supported options for server-side encryption: server-side encryption with Key Management Service (KMS) keys (SSE-KMS), dual-layer server-side encryption with Amazon Web Services KMS keys (DSSE-KMS), and server-side encryption with customer-provided encryption keys (SSE-C). Amazon S3 uses the corresponding KMS key, or a customer-provided key to encrypt the target object copy.
When you perform a CopyObject operation, if you want to use a different type of encryption setting for the target object, you can specify appropriate encryption-related headers to encrypt the target object with an Amazon S3 managed key, a KMS key, or a customer-provided key. If the encryption setting in your request is different from the default encryption configuration of the destination bucket, the encryption setting in your request takes precedence.
Directory buckets
For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) ( AES256) and server-side encryption with KMS keys (SSE-KMS) ( aws:kms). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your CreateSession requests or PUT object requests. Then, new objects are automatically encrypted with the desired encryption settings. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide. For more information about the encryption overriding behaviors in directory buckets, see Specifying server-side encryption with KMS for new object uploads.
To encrypt new object copies to a directory bucket with SSE-KMS, we recommend you specify SSE-KMS as the directory bucket's default encryption configuration with a KMS key (specifically, a customer managed key). The Amazon Web Services managed key ( aws/s3) isn't supported. Your SSE-KMS configuration can only support 1 customer managed key per directory bucket for the lifetime of the bucket. After you specify a customer managed key for SSE-KMS, you can't override the customer managed key for the bucket's SSE-KMS configuration. Then, when you perform a CopyObject operation and want to specify server-side encryption settings for new object copies with SSE-KMS in the encryption-related request headers, you must ensure the encryption key is the same customer managed key that you specified for the directory bucket's default encryption configuration.
S3 access points for Amazon FSx - When accessing data stored in Amazon FSx file systems using S3 access points, the only valid server side encryption option is aws:fsx. All Amazon FSx file systems have encryption configured by default and are encrypted at rest. Data is automatically encrypted before being written to the file system, and automatically decrypted as it is read. These processes are handled transparently by Amazon FSx.
string
If the x-amz-storage-class header is not used, the copied object will be stored in the STANDARD Storage Class by default. The STANDARD storage class provides high durability and high availability. Depending on performance needs, you can specify a different Storage Class.
You can use the CopyObject action to change the storage class of an object that is already stored in Amazon S3 by using the x-amz-storage-class header. For more information, see Storage Classes in the Amazon S3 User Guide.
Before using an object as a source object for the copy operation, you must restore a copy of it if it meets any of the following conditions:
The storage class of the source object is GLACIER or DEEP_ARCHIVE.
The storage class of the source object is INTELLIGENT_TIERING and it's S3 Intelligent-Tiering access tier is Archive Access or Deep Archive Access.
For more information, see RestoreObject and Copying Objects in the Amazon S3 User Guide.
string
If the destination bucket is configured as a website, redirects requests for this object copy to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata. This value is unique to each object and is not copied when using the x-amz-metadata-directive header. Instead, you may opt to provide this header in combination with the x-amz-metadata-directive header.
string
Specifies the algorithm to use when encrypting the object (for example, AES256).
When you perform a CopyObject operation, if you want to use a different type of encryption setting for the target object, you can specify appropriate encryption-related headers to encrypt the target object with an Amazon S3 managed key, a KMS key, or a customer-provided key. If the encryption setting in your request is different from the default encryption configuration of the destination bucket, the encryption setting in your request takes precedence.
string
Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded. Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.
string
Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
string
Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. All GET and PUT requests for an object protected by KMS will fail if they're not made via SSL or using SigV4. For information about configuring any of the officially supported Amazon Web Services SDKs and Amazon Web Services CLI, see Specifying the Signature Version in Request Authentication in the Amazon S3 User Guide.
Directory buckets - To encrypt data using SSE-KMS, it's recommended to specify the x-amz-server-side-encryption header to aws:kms. Then, the x-amz-server-side-encryption-aws-kms-key-id header implicitly uses the bucket's default KMS customer managed key ID. If you want to explicitly set the x-amz-server-side-encryption-aws-kms-key-id header, it must match the bucket's default customer managed key (using key ID or ARN, not alias). Your SSE-KMS configuration can only support 1 customer managed key per directory bucket's lifetime. The Amazon Web Services managed key ( aws/s3) isn't supported. Incorrect key specification results in an HTTP 400 Bad Request error.
string
Specifies the Amazon Web Services KMS Encryption Context as an additional encryption context to use for the destination object encryption. The value of this header is a base64-encoded UTF-8 string holding JSON with the encryption context key-value pairs.
General purpose buckets - This value must be explicitly added to specify encryption context for CopyObject requests if you want an additional encryption context for your destination object. The additional encryption context of the source object won't be copied to the destination object. For more information, see Encryption context in the Amazon S3 User Guide.
Directory buckets - You can optionally provide an explicit encryption context value. The value must match the default encryption context - the bucket Amazon Resource Name (ARN). An additional encryption context value is not supported.
boolean
Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Key Management Service (KMS) keys (SSE-KMS). If a target object uses SSE-KMS, you can enable an S3 Bucket Key for the object.
Setting this header to true causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS. Specifying this header with a COPY action doesn’t affect bucket-level settings for S3 Bucket Key.
For more information, see Amazon S3 Bucket Keys in the Amazon S3 User Guide.
string
Specifies the algorithm to use when decrypting the source object (for example, AES256).
If the source object for the copy is stored in Amazon S3 using SSE-C, you must provide the necessary encryption information in your request so that Amazon S3 can decrypt the object for copying.
string
Specifies the customer-provided encryption key for Amazon S3 to use to decrypt the source object. The encryption key provided in this header must be the same one that was used when the source object was created.
If the source object for the copy is stored in Amazon S3 using SSE-C, you must provide the necessary encryption information in your request so that Amazon S3 can decrypt the object for copying.
string
Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
If the source object for the copy is stored in Amazon S3 using SSE-C, you must provide the necessary encryption information in your request so that Amazon S3 can decrypt the object for copying.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The tag-set for the object copy in the destination bucket. This value must be used in conjunction with the x-amz-tagging-directive if you choose REPLACE for the x-amz-tagging-directive. If you choose COPY for the x-amz-tagging-directive, you don't need to set the x-amz-tagging header, because the tag-set will be copied from the source object directly. The tag-set must be encoded as URL Query parameters.
The default value is the empty value.
string
The Object Lock mode that you want to apply to the object copy.
datetime
The date and time when you want the Object Lock of the object copy to expire.
string
Specifies whether you want to apply a legal hold to the object copy.
string
The event hold status to apply to the object copy. Set to ON to enable or OFF to disable.
integer
The event hold duration in days to apply to the object copy.
integer
The event hold duration in years to apply to the object copy.
string
The account ID of the expected destination bucket owner. If the account ID that you provide does not match the actual owner of the destination bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
string
The account ID of the expected source bucket owner. If the account ID that you provide does not match the actual owner of the source bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'CopyObjectResult': {
'ETag': 'string',
'LastModified': datetime(2015, 1, 1),
'ChecksumType': 'COMPOSITE'|'FULL_OBJECT',
'ChecksumCRC32': 'string',
'ChecksumCRC32C': 'string',
'ChecksumCRC64NVME': 'string',
'ChecksumSHA1': 'string',
'ChecksumSHA256': 'string',
'ChecksumSHA512': 'string',
'ChecksumMD5': 'string',
'ChecksumXXHASH64': 'string',
'ChecksumXXHASH3': 'string',
'ChecksumXXHASH128': 'string'
},
'Expiration': 'string',
'CopySourceVersionId': 'string',
'VersionId': 'string',
'ServerSideEncryption': 'AES256'|'aws:fsx'|'aws:backup'|'aws:kms'|'aws:kms:dsse',
'SSECustomerAlgorithm': 'string',
'SSECustomerKeyMD5': 'string',
'SSEKMSKeyId': 'string',
'SSEKMSEncryptionContext': 'string',
'BucketKeyEnabled': True|False,
'RequestCharged': 'requester'
}
Response Structure
(dict) --
CopyObjectResult (dict) --
Container for all response elements.
ETag (string) --
Returns the ETag of the new object. The ETag reflects only changes to the contents of an object, not its metadata.
LastModified (datetime) --
Creation date of the object.
ChecksumType (string) --
The checksum type that is used to calculate the object’s checksum value. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC32 (string) --
The Base64 encoded, 32-bit CRC32 checksum of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC32C (string) --
The Base64 encoded, 32-bit CRC32C checksum of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC64NVME (string) --
The Base64 encoded, 64-bit CRC64NVME checksum of the object. This checksum is present if the object being copied was uploaded with the CRC64NVME checksum algorithm, or if the object was uploaded without a checksum (and Amazon S3 added the default checksum, CRC64NVME, to the uploaded object). For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA1 (string) --
The Base64 encoded, 160-bit SHA1 digest of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA256 (string) --
The Base64 encoded, 256-bit SHA256 digest of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA512 (string) --
The Base64 encoded, 512-bit SHA512 digest of the object. This checksum is only present if the object was uploaded with the SHA512 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumMD5 (string) --
The Base64 encoded, 128-bit MD5 digest of the object. This checksum is only present if the object was uploaded with the MD5 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH64 (string) --
The Base64 encoded, 64-bit XXHASH64 checksum of the object. This checksum is only present if the object was uploaded with the XXHASH64 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH3 (string) --
The Base64 encoded, 64-bit XXHASH3 checksum of the object. This checksum is only present if the object was uploaded with the XXHASH3 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH128 (string) --
The Base64 encoded, 128-bit XXHASH128 checksum of the object. This checksum is only present if the object was uploaded with the XXHASH128 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
Expiration (string) --
If the object expiration is configured, the response includes this header.
CopySourceVersionId (string) --
Version ID of the source object that was copied.
VersionId (string) --
Version ID of the newly created copy.
ServerSideEncryption (string) --
The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.
SSECustomerAlgorithm (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to confirm the encryption algorithm that's used.
SSECustomerKeyMD5 (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to provide the round-trip message integrity verification of the customer-provided encryption key.
SSEKMSKeyId (string) --
If present, indicates the ID of the KMS key that was used for object encryption.
SSEKMSEncryptionContext (string) --
If present, indicates the Amazon Web Services KMS Encryption Context to use for object encryption. The value of this header is a Base64 encoded UTF-8 string holding JSON with the encryption context key-value pairs.
BucketKeyEnabled (boolean) --
Indicates whether the copied object uses an S3 Bucket Key for server-side encryption with Key Management Service (KMS) keys (SSE-KMS).
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
{'ObjectLockEventHold': 'ON | OFF',
'ObjectLockEventHoldDurationDays': 'integer',
'ObjectLockEventHoldDurationYears': 'integer'}
This action initiates a multipart upload and returns an upload ID. This upload ID is used to associate all of the parts in the specific multipart upload. You specify this upload ID in each of your subsequent upload part requests (see UploadPart). You also include this upload ID in the final request to either complete or abort the multipart upload request. For more information about multipart uploads, see Multipart Upload Overview in the Amazon S3 User Guide.
If you have configured a lifecycle rule to abort incomplete multipart uploads, the created multipart upload must be completed within the number of days specified in the bucket lifecycle configuration. Otherwise, the incomplete multipart upload becomes eligible for an abort action and Amazon S3 aborts the multipart upload. For more information, see Aborting Incomplete Multipart Uploads Using a Bucket Lifecycle Configuration.
For request signing, multipart upload is just a series of regular requests. You initiate a multipart upload, send one or more requests to upload parts, and then complete the multipart upload process. You sign each request individually. There is nothing special about signing multipart upload requests. For more information about signing, see Authenticating Requests (Amazon Web Services Signature Version 4) in the Amazon S3 User Guide.
Permissions
General purpose bucket permissions - To perform a multipart upload with encryption using an Key Management Service (KMS) KMS key, the requester must have permission to the kms:Decrypt and kms:GenerateDataKey actions on the key. The requester must also have permissions for the kms:GenerateDataKey action for the CreateMultipartUpload API. Then, the requester needs permissions for the kms:Decrypt action on the UploadPart and UploadPartCopy APIs. These permissions are required because Amazon S3 must decrypt and read data from the encrypted file parts before it completes the multipart upload. For more information, see Multipart upload API and permissions and Protecting data using server-side encryption with Amazon Web Services KMS in the Amazon S3 User Guide.
Directory bucket permissions - To grant access to this API operation on a directory bucket, we recommend that you use the CreateSession API operation for session-based authorization. Specifically, you grant the s3express:CreateSession permission to the directory bucket in a bucket policy or an IAM identity-based policy. Then, you make the CreateSession API call on the bucket to obtain a session token. With the session token in your request header, you can make API requests to this operation. After the session token expires, you make another CreateSession API call to generate a new session token for use. Amazon Web Services CLI or SDKs create session and refresh the session token automatically to avoid service interruptions when a session expires. For more information about authorization, see CreateSession.
Encryption
General purpose buckets - Server-side encryption is for data encryption at rest. Amazon S3 encrypts your data as it writes it to disks in its data centers and decrypts it when you access it. Amazon S3 automatically encrypts all new objects that are uploaded to an S3 bucket. When doing a multipart upload, if you don't specify encryption information in your request, the encryption setting of the uploaded parts is set to the default encryption configuration of the destination bucket. By default, all buckets have a base level of encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3). If the destination bucket has a default encryption configuration that uses server-side encryption with an Key Management Service (KMS) key (SSE-KMS), or a customer-provided encryption key (SSE-C), Amazon S3 uses the corresponding KMS key, or a customer-provided key to encrypt the uploaded parts. When you perform a CreateMultipartUpload operation, if you want to use a different type of encryption setting for the uploaded parts, you can request that Amazon S3 encrypts the object with a different encryption key (such as an Amazon S3 managed key, a KMS key, or a customer-provided key). When the encryption setting in your request is different from the default encryption configuration of the destination bucket, the encryption setting in your request takes precedence. If you choose to provide your own encryption key, the request headers you provide in UploadPart and UploadPartCopy requests must match the headers you used in the CreateMultipartUpload request.
Use KMS keys (SSE-KMS) that include the Amazon Web Services managed key ( aws/s3) and KMS customer managed keys stored in Key Management Service (KMS) – If you want Amazon Web Services to manage the keys used to encrypt data, specify the following headers in the request.
x-amz-server-side-encryption
x-amz-server-side-encryption-aws-kms-key-id
x-amz-server-side-encryption-context
For more information about server-side encryption with KMS keys (SSE-KMS), see Protecting Data Using Server-Side Encryption with KMS keys in the Amazon S3 User Guide.
Use customer-provided encryption keys (SSE-C) – If you want to manage your own encryption keys, provide all the following headers in the request.
x-amz-server-side-encryption-customer-algorithm
x-amz-server-side-encryption-customer-key
x-amz-server-side-encryption-customer-key-MD5
For more information about server-side encryption with customer-provided encryption keys (SSE-C), see Protecting data using server-side encryption with customer-provided encryption keys (SSE-C) in the Amazon S3 User Guide.
Directory buckets - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) ( AES256) and server-side encryption with KMS keys (SSE-KMS) ( aws:kms). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your CreateSession requests or PUT object requests. Then, new objects are automatically encrypted with the desired encryption settings. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide. For more information about the encryption overriding behaviors in directory buckets, see Specifying server-side encryption with KMS for new object uploads. In the Zonal endpoint API calls (except CopyObject and UploadPartCopy) using the REST API, the encryption request headers must match the encryption settings that are specified in the CreateSession request. You can't override the values of the encryption settings ( x-amz-server-side-encryption, x-amz-server-side-encryption-aws-kms-key-id, x-amz-server-side-encryption-context, and x-amz-server-side-encryption-bucket-key-enabled) that are specified in the CreateSession request. You don't need to explicitly specify these encryption settings values in Zonal endpoint API calls, and Amazon S3 will use the encryption settings values from the CreateSession request to protect new objects in the directory bucket.
Directory buckets - The HTTP Host header syntax is Bucket-name.s3express-zone-id.region-code.amazonaws.com.
The following operations are related to CreateMultipartUpload:
See also: AWS API Documentation
Request Syntax
client.create_multipart_upload(
ACL='private'|'public-read'|'public-read-write'|'authenticated-read'|'aws-exec-read'|'bucket-owner-read'|'bucket-owner-full-control',
Bucket='string',
CacheControl='string',
ContentDisposition='string',
ContentEncoding='string',
ContentLanguage='string',
ContentType='string',
Expires='string',
GrantFullControl='string',
GrantRead='string',
GrantReadACP='string',
GrantWriteACP='string',
Key='string',
Metadata={
'string': 'string'
},
ServerSideEncryption='AES256'|'aws:fsx'|'aws:backup'|'aws:kms'|'aws:kms:dsse',
StorageClass='STANDARD'|'REDUCED_REDUNDANCY'|'STANDARD_IA'|'ONEZONE_IA'|'INTELLIGENT_TIERING'|'GLACIER'|'DEEP_ARCHIVE'|'OUTPOSTS'|'GLACIER_IR'|'SNOW'|'EXPRESS_ONEZONE'|'FSX_OPENZFS'|'FSX_ONTAP'|'AWS_BACKUP_WARM'|'AWS_BACKUP_LOW_COST_WARM',
WebsiteRedirectLocation='string',
SSECustomerAlgorithm='string',
SSECustomerKey='string',
SSECustomerKeyMD5='string',
SSEKMSKeyId='string',
SSEKMSEncryptionContext='string',
BucketKeyEnabled=True|False,
RequestPayer='requester',
Tagging='string',
ObjectLockMode='GOVERNANCE'|'COMPLIANCE',
ObjectLockRetainUntilDate=datetime(2015, 1, 1),
ObjectLockLegalHoldStatus='ON'|'OFF',
ObjectLockEventHold='ON'|'OFF',
ObjectLockEventHoldDurationDays=123,
ObjectLockEventHoldDurationYears=123,
ExpectedBucketOwner='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
ChecksumType='COMPOSITE'|'FULL_OBJECT'
)
string
The canned ACL to apply to the object. Amazon S3 supports a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and permissions. For more information, see Canned ACL in the Amazon S3 User Guide.
By default, all objects are private. Only the owner has full access control. When uploading an object, you can grant access permissions to individual Amazon Web Services accounts or to predefined groups defined by Amazon S3. These permissions are then added to the access control list (ACL) on the new object. For more information, see Using ACLs. One way to grant the permissions using the request headers is to specify a canned ACL with the x-amz-acl request header.
string
[REQUIRED]
The name of the bucket where the multipart upload is initiated and where the object is uploaded.
Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the format Bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the format bucket-base-name--zone-id--x-s3 (for example, amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
S3 on Outposts - When you use this action with S3 on Outposts, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When you use this action with S3 on Outposts, the destination bucket must be the Outposts access point ARN or the access point alias. For more information about S3 on Outposts, see What is S3 on Outposts? in the Amazon S3 User Guide.
string
Specifies caching behavior along the request/reply chain.
string
Specifies presentational information for the object.
string
Specifies what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
string
The language that the content is in.
string
A standard MIME type describing the format of the object data.
string
The date and time at which the object is no longer cacheable.
string
Specify access permissions explicitly to give the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.
By default, all objects are private. Only the owner has full access control. When uploading an object, you can use this header to explicitly grant access permissions to specific Amazon Web Services accounts or groups. This header maps to specific permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview in the Amazon S3 User Guide.
You specify each grantee as a type=value pair, where the type is one of the following:
id – if the value specified is the canonical user ID of an Amazon Web Services account
uri – if you are granting permissions to a predefined group
emailAddress – if the value specified is the email address of an Amazon Web Services account
For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:
x-amz-grant-read: id="11112222333", id="444455556666"
string
Specify access permissions explicitly to allow grantee to read the object data and its metadata.
By default, all objects are private. Only the owner has full access control. When uploading an object, you can use this header to explicitly grant access permissions to specific Amazon Web Services accounts or groups. This header maps to specific permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview in the Amazon S3 User Guide.
You specify each grantee as a type=value pair, where the type is one of the following:
id – if the value specified is the canonical user ID of an Amazon Web Services account
uri – if you are granting permissions to a predefined group
emailAddress – if the value specified is the email address of an Amazon Web Services account
For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:
x-amz-grant-read: id="11112222333", id="444455556666"
string
Specify access permissions explicitly to allows grantee to read the object ACL.
By default, all objects are private. Only the owner has full access control. When uploading an object, you can use this header to explicitly grant access permissions to specific Amazon Web Services accounts or groups. This header maps to specific permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview in the Amazon S3 User Guide.
You specify each grantee as a type=value pair, where the type is one of the following:
id – if the value specified is the canonical user ID of an Amazon Web Services account
uri – if you are granting permissions to a predefined group
emailAddress – if the value specified is the email address of an Amazon Web Services account
For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:
x-amz-grant-read: id="11112222333", id="444455556666"
string
Specify access permissions explicitly to allows grantee to allow grantee to write the ACL for the applicable object.
By default, all objects are private. Only the owner has full access control. When uploading an object, you can use this header to explicitly grant access permissions to specific Amazon Web Services accounts or groups. This header maps to specific permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview in the Amazon S3 User Guide.
You specify each grantee as a type=value pair, where the type is one of the following:
id – if the value specified is the canonical user ID of an Amazon Web Services account
uri – if you are granting permissions to a predefined group
emailAddress – if the value specified is the email address of an Amazon Web Services account
For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:
x-amz-grant-read: id="11112222333", id="444455556666"
string
[REQUIRED]
Object key for which the multipart upload is to be initiated.
dict
A map of metadata to store with the object in S3.
(string) --
(string) --
string
The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.
Directory buckets - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) ( AES256) and server-side encryption with KMS keys (SSE-KMS) ( aws:kms). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your CreateSession requests or PUT object requests. Then, new objects are automatically encrypted with the desired encryption settings. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide. For more information about the encryption overriding behaviors in directory buckets, see Specifying server-side encryption with KMS for new object uploads. In the Zonal endpoint API calls (except CopyObject and UploadPartCopy) using the REST API, the encryption request headers must match the encryption settings that are specified in the CreateSession request. You can't override the values of the encryption settings ( x-amz-server-side-encryption, x-amz-server-side-encryption-aws-kms-key-id, x-amz-server-side-encryption-context, and x-amz-server-side-encryption-bucket-key-enabled) that are specified in the CreateSession request. You don't need to explicitly specify these encryption settings values in Zonal endpoint API calls, and Amazon S3 will use the encryption settings values from the CreateSession request to protect new objects in the directory bucket.
S3 access points for Amazon FSx - When accessing data stored in Amazon FSx file systems using S3 access points, the only valid server side encryption option is aws:fsx. All Amazon FSx file systems have encryption configured by default and are encrypted at rest. Data is automatically encrypted before being written to the file system, and automatically decrypted as it is read. These processes are handled transparently by Amazon FSx.
string
By default, Amazon S3 uses the STANDARD Storage Class to store newly created objects. The STANDARD storage class provides high durability and high availability. Depending on performance needs, you can specify a different Storage Class. For more information, see Storage Classes in the Amazon S3 User Guide.
string
If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata.
string
Specifies the algorithm to use when encrypting the object (for example, AES256).
string
Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded; Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.
string
Specifies the 128-bit MD5 digest of the customer-provided encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
string
Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. If the KMS key doesn't exist in the same account that's issuing the command, you must use the full Key ARN not the Key ID.
General purpose buckets - If you specify x-amz-server-side-encryption with aws:kms or aws:kms:dsse, this header specifies the ID (Key ID, Key ARN, or Key Alias) of the KMS key to use. If you specify x-amz-server-side-encryption:aws:kms or x-amz-server-side-encryption:aws:kms:dsse, but do not provide x-amz-server-side-encryption-aws-kms-key-id, Amazon S3 uses the Amazon Web Services managed key ( aws/s3) to protect the data.
Directory buckets - To encrypt data using SSE-KMS, it's recommended to specify the x-amz-server-side-encryption header to aws:kms. Then, the x-amz-server-side-encryption-aws-kms-key-id header implicitly uses the bucket's default KMS customer managed key ID. If you want to explicitly set the x-amz-server-side-encryption-aws-kms-key-id header, it must match the bucket's default customer managed key (using key ID or ARN, not alias). Your SSE-KMS configuration can only support 1 customer managed key per directory bucket's lifetime. The Amazon Web Services managed key ( aws/s3) isn't supported. Incorrect key specification results in an HTTP 400 Bad Request error.
string
Specifies the Amazon Web Services KMS Encryption Context to use for object encryption. The value of this header is a Base64 encoded string of a UTF-8 encoded JSON, which contains the encryption context as key-value pairs.
Directory buckets - You can optionally provide an explicit encryption context value. The value must match the default encryption context - the bucket Amazon Resource Name (ARN). An additional encryption context value is not supported.
boolean
Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Key Management Service (KMS) keys (SSE-KMS).
General purpose buckets - Setting this header to true causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS. Also, specifying this header with a PUT action doesn't affect bucket-level settings for S3 Bucket Key.
Directory buckets - S3 Bucket Keys are always enabled for GET and PUT operations in a directory bucket and can’t be disabled. S3 Bucket Keys aren't supported, when you copy SSE-KMS encrypted objects from general purpose buckets to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through CopyObject, UploadPartCopy, the Copy operation in Batch Operations, or the import jobs. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The tag-set for the object. The tag-set must be encoded as URL Query parameters.
string
Specifies the Object Lock mode that you want to apply to the uploaded object.
datetime
Specifies the date and time when you want the Object Lock to expire.
string
Specifies whether you want to apply a legal hold to the uploaded object.
string
Specifies the event hold status to apply to the uploaded object. Set to ON to enable or OFF to disable.
integer
Specifies the event hold duration in days to apply to the uploaded object.
integer
Specifies the event hold duration in years to apply to the uploaded object.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
string
Indicates the algorithm that you want Amazon S3 to use to create the checksum for the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
Indicates the checksum type that you want Amazon S3 to use to calculate the object’s checksum value. For more information, see Checking object integrity in the Amazon S3 User Guide.
dict
Response Syntax
{
'AbortDate': datetime(2015, 1, 1),
'AbortRuleId': 'string',
'Bucket': 'string',
'Key': 'string',
'UploadId': 'string',
'ServerSideEncryption': 'AES256'|'aws:fsx'|'aws:backup'|'aws:kms'|'aws:kms:dsse',
'SSECustomerAlgorithm': 'string',
'SSECustomerKeyMD5': 'string',
'SSEKMSKeyId': 'string',
'SSEKMSEncryptionContext': 'string',
'BucketKeyEnabled': True|False,
'RequestCharged': 'requester',
'ChecksumAlgorithm': 'CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
'ChecksumType': 'COMPOSITE'|'FULL_OBJECT'
}
Response Structure
(dict) --
AbortDate (datetime) --
If the bucket has a lifecycle rule configured with an action to abort incomplete multipart uploads and the prefix in the lifecycle rule matches the object name in the request, the response includes this header. The header indicates when the initiated multipart upload becomes eligible for an abort operation. For more information, see Aborting Incomplete Multipart Uploads Using a Bucket Lifecycle Configuration in the Amazon S3 User Guide.
The response also includes the x-amz-abort-rule-id header that provides the ID of the lifecycle configuration rule that defines the abort action.
AbortRuleId (string) --
This header is returned along with the x-amz-abort-date header. It identifies the applicable lifecycle configuration rule that defines the action to abort incomplete multipart uploads.
Bucket (string) --
The name of the bucket to which the multipart upload was initiated. Does not return the access point ARN or access point alias if used.
Key (string) --
Object key for which the multipart upload was initiated.
UploadId (string) --
ID for the initiated multipart upload.
ServerSideEncryption (string) --
The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.
SSECustomerAlgorithm (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to confirm the encryption algorithm that's used.
SSECustomerKeyMD5 (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to provide the round-trip message integrity verification of the customer-provided encryption key.
SSEKMSKeyId (string) --
If present, indicates the ID of the KMS key that was used for object encryption.
SSEKMSEncryptionContext (string) --
If present, indicates the Amazon Web Services KMS Encryption Context to use for object encryption. The value of this header is a Base64 encoded string of a UTF-8 encoded JSON, which contains the encryption context as key-value pairs.
BucketKeyEnabled (boolean) --
Indicates whether the multipart upload uses an S3 Bucket Key for server-side encryption with Key Management Service (KMS) keys (SSE-KMS).
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
ChecksumAlgorithm (string) --
The algorithm that was used to create a checksum of the object.
ChecksumType (string) --
Indicates the checksum type that you want Amazon S3 to use to calculate the object’s checksum value. For more information, see Checking object integrity in the Amazon S3 User Guide.
{'InventoryConfiguration': {'OptionalFields': {'ObjectLockEventHoldDuration',
'ObjectLockEventHoldStatus'}}}
Returns an S3 Inventory configuration (identified by the inventory configuration ID) from the bucket.
To use this operation, you must have permissions to perform the s3:GetInventoryConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources.
General purpose bucket permissions - The s3:GetInventoryConfiguration permission is required in a policy. For more information about general purpose buckets permissions, see Using Bucket Policies and User Policies in the Amazon S3 User Guide.
Directory bucket permissions - To grant access to this API operation, you must have the s3express:GetInventoryConfiguration permission in an IAM identity-based policy instead of a bucket policy. For more information about directory bucket policies and permissions, see Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone in the Amazon S3 User Guide.
HTTP Host header syntax
Directory buckets - The HTTP Host header syntax is s3express-control.region-code.amazonaws.com.
For information about the Amazon S3 inventory feature, see Amazon S3 Inventory.
The following operations are related to GetBucketInventoryConfiguration:
See also: AWS API Documentation
Request Syntax
client.get_bucket_inventory_configuration(
Bucket='string',
Id='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket containing the inventory configuration to retrieve.
Directory buckets - When you use this operation with a directory bucket, you must use path-style requests in the format https://s3express-control.region-code.amazonaws.com/bucket-name ``. Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format ``bucket-base-name--zone-id--x-s3 (for example, DOC-EXAMPLE-BUCKET--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide
string
[REQUIRED]
The ID used to identify the inventory configuration.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'InventoryConfiguration': {
'Destination': {
'S3BucketDestination': {
'AccountId': 'string',
'Bucket': 'string',
'Format': 'CSV'|'ORC'|'Parquet',
'Prefix': 'string',
'Encryption': {
'SSES3': {},
'SSEKMS': {
'KeyId': 'string'
}
}
}
},
'IsEnabled': True|False,
'Filter': {
'Prefix': 'string'
},
'Id': 'string',
'IncludedObjectVersions': 'All'|'Current',
'OptionalFields': [
'Size'|'LastModifiedDate'|'StorageClass'|'ETag'|'IsMultipartUploaded'|'ReplicationStatus'|'EncryptionStatus'|'ObjectLockRetainUntilDate'|'ObjectLockMode'|'ObjectLockLegalHoldStatus'|'ObjectLockEventHoldStatus'|'ObjectLockEventHoldDuration'|'IntelligentTieringAccessTier'|'BucketKeyStatus'|'ChecksumAlgorithm'|'ObjectAccessControlList'|'ObjectOwner'|'LifecycleExpirationDate',
],
'Schedule': {
'Frequency': 'Daily'|'Weekly'
}
}
}
Response Structure
(dict) --
InventoryConfiguration (dict) --
Specifies the inventory configuration.
Destination (dict) --
Contains information about where to publish the inventory results.
S3BucketDestination (dict) --
Contains the bucket name, file format, bucket owner (optional), and prefix (optional) where inventory results are published.
AccountId (string) --
The account ID that owns the destination S3 bucket. If no account ID is provided, the owner is not validated before exporting data.
Bucket (string) --
The Amazon Resource Name (ARN) of the bucket where inventory results will be published.
Format (string) --
Specifies the output format of the inventory results.
Prefix (string) --
The prefix that is prepended to all inventory results.
Encryption (dict) --
Contains the type of server-side encryption used to encrypt the inventory results.
SSES3 (dict) --
Specifies the use of SSE-S3 to encrypt delivered inventory reports.
SSEKMS (dict) --
Specifies the use of SSE-KMS to encrypt delivered inventory reports.
KeyId (string) --
Specifies the ID of the Key Management Service (KMS) symmetric encryption customer managed key to use for encrypting inventory reports.
IsEnabled (boolean) --
Specifies whether the inventory is enabled or disabled. If set to True, an inventory list is generated. If set to False, no inventory list is generated.
Filter (dict) --
Specifies an inventory filter. The inventory only includes objects that meet the filter's criteria.
Prefix (string) --
The prefix that an object must have to be included in the inventory results.
Id (string) --
The ID used to identify the inventory configuration.
IncludedObjectVersions (string) --
Object versions to include in the inventory list. If set to All, the list includes all the object versions, which adds the version-related fields VersionId, IsLatest, and DeleteMarker to the list. If set to Current, the list does not contain these version-related fields.
OptionalFields (list) --
Contains the optional fields that are included in the inventory results.
(string) --
Schedule (dict) --
Specifies the schedule for generating inventory results.
Frequency (string) --
Specifies how frequently inventory results are produced.
{'CloudFunctionConfiguration': {'Event': {'s3:ObjectRetention:Put'},
'Events': {'s3:ObjectRetention:Put'}},
'QueueConfiguration': {'Event': {'s3:ObjectRetention:Put'},
'Events': {'s3:ObjectRetention:Put'}},
'TopicConfiguration': {'Event': {'s3:ObjectRetention:Put'},
'Events': {'s3:ObjectRetention:Put'}}}
No longer used, see GetBucketNotificationConfiguration.
See also: AWS API Documentation
Request Syntax
client.get_bucket_notification(
Bucket='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket for which to get the notification configuration.
When you use this API operation with an access point, provide the alias of the access point in place of the bucket name.
When you use this API operation with an Object Lambda access point, provide the alias of the Object Lambda access point in place of the bucket name. If the Object Lambda access point alias in a request is not valid, the error code InvalidAccessPointAliasError is returned. For more information about InvalidAccessPointAliasError, see List of Error Codes.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'TopicConfiguration': {
'Id': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
'Topic': 'string'
},
'QueueConfiguration': {
'Id': 'string',
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Queue': 'string'
},
'CloudFunctionConfiguration': {
'Id': 'string',
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'CloudFunction': 'string',
'InvocationRole': 'string'
}
}
Response Structure
(dict) --
TopicConfiguration (dict) --
This data type is deprecated. A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Events (list) --
A collection of events related to objects
(string) --
The bucket event for which to send notifications.
Event (string) --
Bucket event for which to send notifications.
Topic (string) --
Amazon SNS topic to which Amazon S3 will publish a message to report the specified events for the bucket.
QueueConfiguration (dict) --
This data type is deprecated. This data type specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Event (string) --
The bucket event for which to send notifications.
Events (list) --
A collection of bucket events for which to send notifications.
(string) --
The bucket event for which to send notifications.
Queue (string) --
The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type.
CloudFunctionConfiguration (dict) --
Container for specifying the Lambda notification configuration.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Event (string) --
The bucket event for which to send notifications.
Events (list) --
Bucket events for which to send notifications.
(string) --
The bucket event for which to send notifications.
CloudFunction (string) --
Lambda cloud function ARN that Amazon S3 can invoke when it detects events of the specified type.
InvocationRole (string) --
The role supporting the invocation of the Lambda function
{'LambdaFunctionConfigurations': {'Events': {'s3:ObjectRetention:Put'}},
'QueueConfigurations': {'Events': {'s3:ObjectRetention:Put'}},
'TopicConfigurations': {'Events': {'s3:ObjectRetention:Put'}}}
Returns the notification configuration of a bucket.
If notifications are not enabled on the bucket, the action returns an empty NotificationConfiguration element.
By default, you must be the bucket owner to read the notification configuration of a bucket. However, the bucket owner can use a bucket policy to grant permission to other users to read this configuration with the s3:GetBucketNotification permission.
When you use this API operation with an access point, provide the alias of the access point in place of the bucket name.
When you use this API operation with an Object Lambda access point, provide the alias of the Object Lambda access point in place of the bucket name. If the Object Lambda access point alias in a request is not valid, the error code InvalidAccessPointAliasError is returned. For more information about InvalidAccessPointAliasError, see List of Error Codes.
For more information about setting and reading the notification configuration on a bucket, see Setting Up Notification of Bucket Events. For more information about bucket policies, see Using Bucket Policies.
The following action is related to GetBucketNotification:
See also: AWS API Documentation
Request Syntax
client.get_bucket_notification_configuration(
Bucket='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket for which to get the notification configuration.
When you use this API operation with an access point, provide the alias of the access point in place of the bucket name.
When you use this API operation with an Object Lambda access point, provide the alias of the Object Lambda access point in place of the bucket name. If the Object Lambda access point alias in a request is not valid, the error code InvalidAccessPointAliasError is returned. For more information about InvalidAccessPointAliasError, see List of Error Codes.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'TopicConfigurations': [
{
'Id': 'string',
'TopicArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'QueueConfigurations': [
{
'Id': 'string',
'QueueArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'LambdaFunctionConfigurations': [
{
'Id': 'string',
'LambdaFunctionArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'EventBridgeConfiguration': {}
}
Response Structure
(dict) --
A container for specifying the notification configuration of the bucket. If this element is empty, notifications are turned off for the bucket.
TopicConfigurations (list) --
The topic to which notifications are sent and the events for which notifications are generated.
(dict) --
A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
TopicArn (string) --
The Amazon Resource Name (ARN) of the Amazon SNS topic to which Amazon S3 publishes a message when it detects events of the specified type.
Events (list) --
The Amazon S3 bucket event about which to send notifications. For more information, see Supported Event Types in the Amazon S3 User Guide.
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
QueueConfigurations (list) --
The Amazon Simple Queue Service queues to publish messages to and the events for which to publish messages.
(dict) --
Specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
QueueArn (string) --
The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type.
Events (list) --
A collection of bucket events for which to send notifications
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
LambdaFunctionConfigurations (list) --
Describes the Lambda functions to invoke and the events for which to invoke them.
(dict) --
A container for specifying the configuration for Lambda notifications.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
LambdaFunctionArn (string) --
The Amazon Resource Name (ARN) of the Lambda function that Amazon S3 invokes when the specified event type occurs.
Events (list) --
The Amazon S3 bucket event for which to invoke the Lambda function. For more information, see Supported Event Types in the Amazon S3 User Guide.
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
EventBridgeConfiguration (dict) --
Enables delivery of events to Amazon EventBridge.
{'ObjectLockEventHold': 'ON | OFF',
'ObjectLockEventHoldDurationDays': 'integer',
'ObjectLockEventHoldDurationYears': 'integer'}
Retrieves an object from Amazon S3.
In the GetObject request, specify the full key name for the object.
General purpose buckets - Both the virtual-hosted-style requests and the path-style requests are supported. For a virtual hosted-style request example, if you have the object photos/2006/February/sample.jpg, specify the object key name as /photos/2006/February/sample.jpg. For a path-style request example, if you have the object photos/2006/February/sample.jpg in the bucket named examplebucket, specify the object key name as /examplebucket/photos/2006/February/sample.jpg. For more information about request types, see HTTP Host Header Bucket Specification in the Amazon S3 User Guide.
Directory buckets - Only virtual-hosted-style requests are supported. For a virtual hosted-style request example, if you have the object photos/2006/February/sample.jpg in the bucket named amzn-s3-demo-bucket--usw2-az1--x-s3, specify the object key name as /photos/2006/February/sample.jpg. Also, when you make requests to this API operation, your requests are sent to the Zonal endpoint. These endpoints support virtual-hosted-style requests in the format ``https://bucket-name.s3express-zone-id.region-code.amazonaws.com/key-name ``. Path-style requests are not supported. For more information about endpoints in Availability Zones, see Regional and Zonal endpoints for directory buckets in Availability Zones in the Amazon S3 User Guide. For more information about endpoints in Local Zones, see Concepts for directory buckets in Local Zones in the Amazon S3 User Guide.
Permissions
General purpose bucket permissions - You must have the required permissions in a policy. To use GetObject, you must have the READ access to the object (or version). If you grant READ access to the anonymous user, the GetObject operation returns the object without using an authorization header. For more information, see Specifying permissions in a policy in the Amazon S3 User Guide. If you include a versionId in your request header, you must have the s3:GetObjectVersion permission to access a specific version of an object. The s3:GetObject permission is not required in this scenario. If you request the current version of an object without a specific versionId in the request header, only the s3:GetObject permission is required. The s3:GetObjectVersion permission is not required in this scenario. If the object that you request doesn’t exist, the error that Amazon S3 returns depends on whether you also have the s3:ListBucket permission.
If you have the s3:ListBucket permission on the bucket, Amazon S3 returns an HTTP status code 404 Not Found error.
If you don’t have the s3:ListBucket permission, Amazon S3 returns an HTTP status code 403 Access Denied error.
Directory bucket permissions - To grant access to this API operation on a directory bucket, we recommend that you use the CreateSession API operation for session-based authorization. Specifically, you grant the s3express:CreateSession permission to the directory bucket in a bucket policy or an IAM identity-based policy. Then, you make the CreateSession API call on the bucket to obtain a session token. With the session token in your request header, you can make API requests to this operation. After the session token expires, you make another CreateSession API call to generate a new session token for use. Amazon Web Services CLI or SDKs create session and refresh the session token automatically to avoid service interruptions when a session expires. For more information about authorization, see CreateSession. If the object is encrypted using SSE-KMS, you must also have the kms:GenerateDataKey and kms:Decrypt permissions in IAM identity-based policies and KMS key policies for the KMS key.
Storage classes
If the object you are retrieving is stored in the S3 Glacier Flexible Retrieval storage class, the S3 Glacier Deep Archive storage class, the S3 Intelligent-Tiering Archive Access tier, or the S3 Intelligent-Tiering Deep Archive Access tier, before you can retrieve the object you must first restore a copy using RestoreObject. Otherwise, this operation returns an InvalidObjectState error. For information about restoring archived objects, see Restoring Archived Objects in the Amazon S3 User Guide.
Directory buckets - Directory buckets only support EXPRESS_ONEZONE (the S3 Express One Zone storage class) in Availability Zones and ONEZONE_IA (the S3 One Zone-Infrequent Access storage class) in Dedicated Local Zones. Unsupported storage class values won't write a destination object and will respond with the HTTP status code 400 Bad Request.
Encryption
Encryption request headers, like x-amz-server-side-encryption, should not be sent for the GetObject requests, if your object uses server-side encryption with Amazon S3 managed encryption keys (SSE-S3), server-side encryption with Key Management Service (KMS) keys (SSE-KMS), or dual-layer server-side encryption with Amazon Web Services KMS keys (DSSE-KMS). If you include the header in your GetObject requests for the object that uses these types of keys, you’ll get an HTTP 400 Bad Request error.
Directory buckets - For directory buckets, there are only two supported options for server-side encryption: SSE-S3 and SSE-KMS. SSE-C isn't supported. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide.
Overriding response header values through the request
There are times when you want to override certain response header values of a GetObject response. For example, you might override the Content-Disposition response header value through your GetObject request.
You can override values for a set of response headers. These modified response header values are included only in a successful response, that is, when the HTTP status code 200 OK is returned. The headers you can override using the following query parameters in the request are a subset of the headers that Amazon S3 accepts when you create an object.
The response headers that you can override for the GetObject response are Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Type, and Expires.
To override values for a set of response headers in the GetObject response, you can use the following query parameters in the request.
response-cache-control
response-content-disposition
response-content-encoding
response-content-language
response-content-type
response-expires
Directory buckets - The HTTP Host header syntax is Bucket-name.s3express-zone-id.region-code.amazonaws.com.
The following operations are related to GetObject:
See also: AWS API Documentation
Request Syntax
client.get_object(
Bucket='string',
IfMatch='string',
IfModifiedSince=datetime(2015, 1, 1),
IfNoneMatch='string',
IfUnmodifiedSince=datetime(2015, 1, 1),
Key='string',
Range='string',
ResponseCacheControl='string',
ResponseContentDisposition='string',
ResponseContentEncoding='string',
ResponseContentLanguage='string',
ResponseContentType='string',
ResponseExpires=datetime(2015, 1, 1),
VersionId='string',
SSECustomerAlgorithm='string',
SSECustomerKey='string',
SSECustomerKeyMD5='string',
RequestPayer='requester',
PartNumber=123,
ExpectedBucketOwner='string',
ChecksumMode='ENABLED'
)
string
[REQUIRED]
The bucket name containing the object.
Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the format Bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the format bucket-base-name--zone-id--x-s3 (for example, amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
Object Lambda access points - When you use this action with an Object Lambda access point, you must direct requests to the Object Lambda access point hostname. The Object Lambda access point hostname takes the form AccessPointName-AccountId.s3-object-lambda.*Region*.amazonaws.com.
S3 on Outposts - When you use this action with S3 on Outposts, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When you use this action with S3 on Outposts, the destination bucket must be the Outposts access point ARN or the access point alias. For more information about S3 on Outposts, see What is S3 on Outposts? in the Amazon S3 User Guide.
string
Return the object only if its entity tag (ETag) is the same as the one specified in this header; otherwise, return a 412 Precondition Failed error.
If both of the If-Match and If-Unmodified-Since headers are present in the request as follows: If-Match condition evaluates to true, and; If-Unmodified-Since condition evaluates to false; then, S3 returns 200 OK and the data requested.
For more information about conditional requests, see RFC 7232.
datetime
Return the object only if it has been modified since the specified time; otherwise, return a 304 Not Modified error.
If both of the If-None-Match and If-Modified-Since headers are present in the request as follows: `` If-None-Match`` condition evaluates to false, and; If-Modified-Since condition evaluates to true; then, S3 returns 304 Not Modified status code.
For more information about conditional requests, see RFC 7232.
string
Return the object only if its entity tag (ETag) is different from the one specified in this header; otherwise, return a 304 Not Modified error.
If both of the If-None-Match and If-Modified-Since headers are present in the request as follows: `` If-None-Match`` condition evaluates to false, and; If-Modified-Since condition evaluates to true; then, S3 returns 304 Not Modified HTTP status code.
For more information about conditional requests, see RFC 7232.
datetime
Return the object only if it has not been modified since the specified time; otherwise, return a 412 Precondition Failed error.
If both of the If-Match and If-Unmodified-Since headers are present in the request as follows: If-Match condition evaluates to true, and; If-Unmodified-Since condition evaluates to false; then, S3 returns 200 OK and the data requested.
For more information about conditional requests, see RFC 7232.
string
[REQUIRED]
Key of the object to get.
string
Downloads the specified byte range of an object. For more information about the HTTP Range header, see https://www.rfc-editor.org/rfc/rfc9110.html#name-range.
string
Sets the Cache-Control header of the response.
string
Sets the Content-Disposition header of the response.
string
Sets the Content-Encoding header of the response.
string
Sets the Content-Language header of the response.
string
Sets the Content-Type header of the response.
datetime
Sets the Expires header of the response.
string
Version ID used to reference a specific version of the object.
By default, the GetObject operation returns the current version of an object. To return a different version, use the versionId subresource.
For more information about versioning, see PutBucketVersioning.
string
Specifies the algorithm to use when decrypting the object (for example, AES256).
If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you GET the object, you must use the following headers:
x-amz-server-side-encryption-customer-algorithm
x-amz-server-side-encryption-customer-key
x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 User Guide.
string
Specifies the customer-provided encryption key that you originally provided for Amazon S3 to encrypt the data before storing it. This value is used to decrypt the object when recovering it and must match the one used when storing the data. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.
If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you GET the object, you must use the following headers:
x-amz-server-side-encryption-customer-algorithm
x-amz-server-side-encryption-customer-key
x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 User Guide.
string
Specifies the 128-bit MD5 digest of the customer-provided encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you GET the object, you must use the following headers:
x-amz-server-side-encryption-customer-algorithm
x-amz-server-side-encryption-customer-key
x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 User Guide.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
integer
Part number of the object being read. This is a positive integer between 1 and 10,000. Effectively performs a 'ranged' GET request for the part specified. Useful for downloading just a part of an object.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
string
To retrieve the checksum, this mode must be enabled.
dict
Response Syntax
{
'Body': StreamingBody(),
'DeleteMarker': True|False,
'AcceptRanges': 'string',
'Expiration': 'string',
'Restore': 'string',
'LastModified': datetime(2015, 1, 1),
'ContentLength': 123,
'ETag': 'string',
'ChecksumCRC32': 'string',
'ChecksumCRC32C': 'string',
'ChecksumCRC64NVME': 'string',
'ChecksumSHA1': 'string',
'ChecksumSHA256': 'string',
'ChecksumSHA512': 'string',
'ChecksumMD5': 'string',
'ChecksumXXHASH64': 'string',
'ChecksumXXHASH3': 'string',
'ChecksumXXHASH128': 'string',
'ChecksumType': 'COMPOSITE'|'FULL_OBJECT',
'MissingMeta': 123,
'VersionId': 'string',
'CacheControl': 'string',
'ContentDisposition': 'string',
'ContentEncoding': 'string',
'ContentLanguage': 'string',
'ContentRange': 'string',
'ContentType': 'string',
'Expires': 'string',
'WebsiteRedirectLocation': 'string',
'ServerSideEncryption': 'AES256'|'aws:fsx'|'aws:backup'|'aws:kms'|'aws:kms:dsse',
'Metadata': {
'string': 'string'
},
'SSECustomerAlgorithm': 'string',
'SSECustomerKeyMD5': 'string',
'SSEKMSKeyId': 'string',
'BucketKeyEnabled': True|False,
'StorageClass': 'STANDARD'|'REDUCED_REDUNDANCY'|'STANDARD_IA'|'ONEZONE_IA'|'INTELLIGENT_TIERING'|'GLACIER'|'DEEP_ARCHIVE'|'OUTPOSTS'|'GLACIER_IR'|'SNOW'|'EXPRESS_ONEZONE'|'FSX_OPENZFS'|'FSX_ONTAP'|'AWS_BACKUP_WARM'|'AWS_BACKUP_LOW_COST_WARM',
'RequestCharged': 'requester',
'ReplicationStatus': 'COMPLETE'|'PENDING'|'FAILED'|'REPLICA'|'COMPLETED',
'PartsCount': 123,
'TagCount': 123,
'ObjectLockMode': 'GOVERNANCE'|'COMPLIANCE',
'ObjectLockRetainUntilDate': datetime(2015, 1, 1),
'ObjectLockLegalHoldStatus': 'ON'|'OFF',
'ObjectLockEventHold': 'ON'|'OFF',
'ObjectLockEventHoldDurationDays': 123,
'ObjectLockEventHoldDurationYears': 123
}
Response Structure
(dict) --
Body (:class:`.StreamingBody`) --
Object data.
DeleteMarker (boolean) --
Indicates whether the object retrieved was (true) or was not (false) a Delete Marker. If false, this response header does not appear in the response.
AcceptRanges (string) --
Indicates that a range of bytes was specified in the request.
Expiration (string) --
If the object expiration is configured (see PutBucketLifecycleConfiguration), the response includes this header. It includes the expiry-date and rule-id key-value pairs providing object expiration information. The value of the rule-id is URL-encoded.
Restore (string) --
Provides information about object restoration action and expiration time of the restored object copy.
LastModified (datetime) --
Date and time when the object was last modified.
General purpose buckets - When you specify a versionId of the object in your request, if the specified version in the request is a delete marker, the response returns a 405 Method Not Allowed error and the Last-Modified: timestamp response header.
ContentLength (integer) --
Size of the body in bytes.
ETag (string) --
An entity tag (ETag) is an opaque identifier assigned by a web server to a specific version of a resource found at a URL.
ChecksumCRC32 (string) --
The Base64 encoded, 32-bit CRC32 checksum of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC32C (string) --
The Base64 encoded, 32-bit CRC32C checksum of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC64NVME (string) --
The Base64 encoded, 64-bit CRC64NVME checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA1 (string) --
The Base64 encoded, 160-bit SHA1 digest of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA256 (string) --
The Base64 encoded, 256-bit SHA256 digest of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA512 (string) --
The Base64 encoded, 512-bit SHA512 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumMD5 (string) --
The Base64 encoded, 128-bit MD5 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH64 (string) --
The Base64 encoded, 64-bit XXHASH64 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH3 (string) --
The Base64 encoded, 64-bit XXHASH3 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH128 (string) --
The Base64 encoded, 128-bit XXHASH128 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumType (string) --
The checksum type, which determines how part-level checksums are combined to create an object-level checksum for multipart objects. You can use this header response to verify that the checksum type that is received is the same checksum type that was specified in the CreateMultipartUpload request. For more information, see Checking object integrity in the Amazon S3 User Guide.
MissingMeta (integer) --
This is set to the number of metadata entries not returned in the headers that are prefixed with x-amz-meta-. This can happen if you create metadata using an API like SOAP that supports more flexible metadata than the REST API. For example, using SOAP, you can create metadata whose values are not legal HTTP headers.
VersionId (string) --
Version ID of the object.
CacheControl (string) --
Specifies caching behavior along the request/reply chain.
ContentDisposition (string) --
Specifies presentational information for the object.
ContentEncoding (string) --
Indicates what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
ContentLanguage (string) --
The language the content is in.
ContentRange (string) --
The portion of the object returned in the response.
ContentType (string) --
A standard MIME type describing the format of the object data.
Expires (string) --
The date and time at which the object is no longer cacheable.
WebsiteRedirectLocation (string) --
If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata.
ServerSideEncryption (string) --
The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.
Metadata (dict) --
A map of metadata to store with the object in S3.
(string) --
(string) --
SSECustomerAlgorithm (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to confirm the encryption algorithm that's used.
SSECustomerKeyMD5 (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to provide the round-trip message integrity verification of the customer-provided encryption key.
SSEKMSKeyId (string) --
If present, indicates the ID of the KMS key that was used for object encryption.
BucketKeyEnabled (boolean) --
Indicates whether the object uses an S3 Bucket Key for server-side encryption with Key Management Service (KMS) keys (SSE-KMS).
StorageClass (string) --
Provides storage class information of the object. Amazon S3 returns this header for all objects except for S3 Standard storage class objects.
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
ReplicationStatus (string) --
Amazon S3 can return this if your request involves a bucket that is either a source or destination in a replication rule.
PartsCount (integer) --
The count of parts this object has. This value is only returned if you specify partNumber in your request and the object was uploaded as a multipart upload.
TagCount (integer) --
The number of tags, if any, on the object, when you have the relevant permission to read object tags.
You can use GetObjectTagging to retrieve the tag set associated with an object.
ObjectLockMode (string) --
The Object Lock mode that's currently in place for this object.
ObjectLockRetainUntilDate (datetime) --
The date and time when this object's Object Lock will expire.
ObjectLockLegalHoldStatus (string) --
Indicates whether this object has an active legal hold. This field is only returned if you have permission to view an object's legal hold status.
ObjectLockEventHold (string) --
The event hold status for this object. This header is only returned if the requester has the s3:GetObjectRetention permission.
ObjectLockEventHoldDurationDays (integer) --
The event hold duration in days for this object. Only returned when the event hold is enabled.
ObjectLockEventHoldDurationYears (integer) --
The event hold duration in years for this object. Only returned when the event hold is enabled.
{'ObjectLockConfiguration': {'Rule': {'DefaultRetention': {'DefaultEventHold': {'Days': 'integer',
'Years': 'integer'}}}}}
Gets the Object Lock configuration for a bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see Locking Objects.
The following action is related to GetObjectLockConfiguration:
See also: AWS API Documentation
Request Syntax
client.get_object_lock_configuration(
Bucket='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The bucket whose Object Lock configuration you want to retrieve.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'ObjectLockConfiguration': {
'ObjectLockEnabled': 'Enabled',
'Rule': {
'DefaultRetention': {
'Mode': 'GOVERNANCE'|'COMPLIANCE',
'Days': 123,
'Years': 123,
'DefaultEventHold': {
'Days': 123,
'Years': 123
}
}
}
}
}
Response Structure
(dict) --
ObjectLockConfiguration (dict) --
The specified bucket's Object Lock configuration.
ObjectLockEnabled (string) --
Indicates whether this bucket has an Object Lock configuration enabled. Enable ObjectLockEnabled when you apply ObjectLockConfiguration to a bucket.
Rule (dict) --
Specifies the Object Lock rule for the specified object. Enable the this rule when you apply ObjectLockConfiguration to a bucket. Bucket settings require both a mode and a period. The period can be either Days or Years but you must select one. You cannot specify Days and Years at the same time.
DefaultRetention (dict) --
The default Object Lock retention mode and period that you want to apply to new objects placed in the specified bucket. Bucket settings require both a mode and a period. The period can be either Days or Years but you must select one. You cannot specify Days and Years at the same time.
Mode (string) --
The default Object Lock retention mode you want to apply to new objects placed in the specified bucket. Must be used with either Days or Years.
Days (integer) --
The number of days that you want to specify for the default retention period. Must be used with Mode.
Years (integer) --
The number of years that you want to specify for the default retention period. Must be used with Mode.
DefaultEventHold (dict) --
The default event hold duration to be applied to new objects placed in the specified bucket. When configured, new objects will automatically have an event hold enabled with this duration.
Days (integer) --
The number of days for the event hold duration. The minimum value is 1 and the maximum value is 36,500.
Years (integer) --
The number of years for the event hold duration. The minimum value is 1 and the maximum value is 100.
{'Retention': {'EventHold': 'ON | OFF',
'EventHoldDuration': {'Days': 'integer', 'Years': 'integer'}}}
Retrieves an object's retention settings. For more information, see Locking Objects.
This functionality is not supported for Amazon S3 on Outposts.
The following action is related to GetObjectRetention:
See also: AWS API Documentation
Request Syntax
client.get_object_retention(
Bucket='string',
Key='string',
VersionId='string',
RequestPayer='requester',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The bucket name containing the object whose retention settings you want to retrieve.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
string
[REQUIRED]
The key name for the object whose retention settings you want to retrieve.
string
The version ID for the object whose retention settings you want to retrieve.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'Retention': {
'Mode': 'GOVERNANCE'|'COMPLIANCE',
'RetainUntilDate': datetime(2015, 1, 1),
'EventHold': 'ON'|'OFF',
'EventHoldDuration': {
'Days': 123,
'Years': 123
}
}
}
Response Structure
(dict) --
Retention (dict) --
The container element for an object's retention settings.
Mode (string) --
Indicates the Retention mode for the specified object.
RetainUntilDate (datetime) --
The date on which this Object Lock Retention will expire.
EventHold (string) --
The event hold status for the object. Set to ON to enable an event hold or OFF to disable it.
EventHoldDuration (dict) --
The event hold duration for the object. Specifies how long the object remains protected after the event hold is released.
Days (integer) --
The number of days for the event hold duration. The minimum value is 1 and the maximum value is 36,500.
Years (integer) --
The number of years for the event hold duration. The minimum value is 1 and the maximum value is 100.
{'ObjectLockEventHold': 'ON | OFF',
'ObjectLockEventHoldDurationDays': 'integer',
'ObjectLockEventHoldDurationYears': 'integer'}
The HEAD operation retrieves metadata from an object without returning the object itself. This operation is useful if you're interested only in an object's metadata.
Request headers are limited to 8 KB in size. For more information, see Common Request Headers.
Permissions
General purpose bucket permissions - To use HEAD, you must have the s3:GetObject permission. You need the relevant read object (or version) permission for this operation. For more information, see Actions, resources, and condition keys for Amazon S3 in the Amazon S3 User Guide. For more information about the permissions to S3 API operations by S3 resource types, see Required permissions for Amazon S3 API operations in the Amazon S3 User Guide. If the object you request doesn't exist, the error that Amazon S3 returns depends on whether you also have the s3:ListBucket permission.
If you have the s3:ListBucket permission on the bucket, Amazon S3 returns an HTTP status code 404 Not Found error.
If you don’t have the s3:ListBucket permission, Amazon S3 returns an HTTP status code 403 Forbidden error.
Directory bucket permissions - To grant access to this API operation on a directory bucket, we recommend that you use the CreateSession API operation for session-based authorization. Specifically, you grant the s3express:CreateSession permission to the directory bucket in a bucket policy or an IAM identity-based policy. Then, you make the CreateSession API call on the bucket to obtain a session token. With the session token in your request header, you can make API requests to this operation. After the session token expires, you make another CreateSession API call to generate a new session token for use. Amazon Web Services CLI or SDKs create session and refresh the session token automatically to avoid service interruptions when a session expires. For more information about authorization, see CreateSession. If you enable x-amz-checksum-mode in the request and the object is encrypted with Amazon Web Services Key Management Service (Amazon Web Services KMS), you must also have the kms:GenerateDataKey and kms:Decrypt permissions in IAM identity-based policies and KMS key policies for the KMS key to retrieve the checksum of the object.
Encryption
If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you retrieve the metadata from the object, you must use the following headers to provide the encryption key for the server to be able to retrieve the object's metadata. The headers are:
x-amz-server-side-encryption-customer-algorithm
x-amz-server-side-encryption-customer-key
x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 User Guide.
If the current version of the object is a delete marker, Amazon S3 behaves as if the object was deleted and includes x-amz-delete-marker: true in the response.
If the specified version is a delete marker, the response returns a 405 Method Not Allowed error and the Last-Modified: timestamp response header.
Directory buckets - The HTTP Host header syntax is Bucket-name.s3express-zone-id.region-code.amazonaws.com.
The following actions are related to HeadObject:
See also: AWS API Documentation
Request Syntax
client.head_object(
Bucket='string',
IfMatch='string',
IfModifiedSince=datetime(2015, 1, 1),
IfNoneMatch='string',
IfUnmodifiedSince=datetime(2015, 1, 1),
Key='string',
Range='string',
ResponseCacheControl='string',
ResponseContentDisposition='string',
ResponseContentEncoding='string',
ResponseContentLanguage='string',
ResponseContentType='string',
ResponseExpires=datetime(2015, 1, 1),
VersionId='string',
SSECustomerAlgorithm='string',
SSECustomerKey='string',
SSECustomerKeyMD5='string',
RequestPayer='requester',
PartNumber=123,
ExpectedBucketOwner='string',
ChecksumMode='ENABLED'
)
string
[REQUIRED]
The name of the bucket that contains the object.
Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the format Bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the format bucket-base-name--zone-id--x-s3 (for example, amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
S3 on Outposts - When you use this action with S3 on Outposts, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When you use this action with S3 on Outposts, the destination bucket must be the Outposts access point ARN or the access point alias. For more information about S3 on Outposts, see What is S3 on Outposts? in the Amazon S3 User Guide.
string
Return the object only if its entity tag (ETag) is the same as the one specified; otherwise, return a 412 (precondition failed) error.
If both of the If-Match and If-Unmodified-Since headers are present in the request as follows:
If-Match condition evaluates to true, and;
If-Unmodified-Since condition evaluates to false;
Then Amazon S3 returns 200 OK and the data requested.
For more information about conditional requests, see RFC 7232.
datetime
Return the object only if it has been modified since the specified time; otherwise, return a 304 (not modified) error.
If both of the If-None-Match and If-Modified-Since headers are present in the request as follows:
If-None-Match condition evaluates to false, and;
If-Modified-Since condition evaluates to true;
Then Amazon S3 returns the 304 Not Modified response code.
For more information about conditional requests, see RFC 7232.
string
Return the object only if its entity tag (ETag) is different from the one specified; otherwise, return a 304 (not modified) error.
If both of the If-None-Match and If-Modified-Since headers are present in the request as follows:
If-None-Match condition evaluates to false, and;
If-Modified-Since condition evaluates to true;
Then Amazon S3 returns the 304 Not Modified response code.
For more information about conditional requests, see RFC 7232.
datetime
Return the object only if it has not been modified since the specified time; otherwise, return a 412 (precondition failed) error.
If both of the If-Match and If-Unmodified-Since headers are present in the request as follows:
If-Match condition evaluates to true, and;
If-Unmodified-Since condition evaluates to false;
Then Amazon S3 returns 200 OK and the data requested.
For more information about conditional requests, see RFC 7232.
string
[REQUIRED]
The object key.
string
HeadObject returns only the metadata for an object. If the Range is satisfiable, only the ContentLength is affected in the response. If the Range is not satisfiable, S3 returns a 416 - Requested Range Not Satisfiable error.
string
Sets the Cache-Control header of the response.
string
Sets the Content-Disposition header of the response.
string
Sets the Content-Encoding header of the response.
string
Sets the Content-Language header of the response.
string
Sets the Content-Type header of the response.
datetime
Sets the Expires header of the response.
string
Version ID used to reference a specific version of the object.
string
Specifies the algorithm to use when encrypting the object (for example, AES256).
string
Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded; Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.
string
Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
integer
Part number of the object being read. This is a positive integer between 1 and 10,000. Effectively performs a 'ranged' HEAD request for the part specified. Useful querying about the size of the part and the number of parts in this object.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
string
To retrieve the checksum, this parameter must be enabled.
General purpose buckets - If you enable checksum mode and the object is uploaded with a checksum and encrypted with an Key Management Service (KMS) key, you must have permission to use the kms:Decrypt action to retrieve the checksum.
Directory buckets - If you enable ChecksumMode and the object is encrypted with Amazon Web Services Key Management Service (Amazon Web Services KMS), you must also have the kms:GenerateDataKey and kms:Decrypt permissions in IAM identity-based policies and KMS key policies for the KMS key to retrieve the checksum of the object.
dict
Response Syntax
{
'DeleteMarker': True|False,
'AcceptRanges': 'string',
'Expiration': 'string',
'Restore': 'string',
'ArchiveStatus': 'ARCHIVE_ACCESS'|'DEEP_ARCHIVE_ACCESS',
'LastModified': datetime(2015, 1, 1),
'ContentLength': 123,
'ChecksumCRC32': 'string',
'ChecksumCRC32C': 'string',
'ChecksumCRC64NVME': 'string',
'ChecksumSHA1': 'string',
'ChecksumSHA256': 'string',
'ChecksumSHA512': 'string',
'ChecksumMD5': 'string',
'ChecksumXXHASH64': 'string',
'ChecksumXXHASH3': 'string',
'ChecksumXXHASH128': 'string',
'ChecksumType': 'COMPOSITE'|'FULL_OBJECT',
'ETag': 'string',
'MissingMeta': 123,
'VersionId': 'string',
'CacheControl': 'string',
'ContentDisposition': 'string',
'ContentEncoding': 'string',
'ContentLanguage': 'string',
'ContentType': 'string',
'ContentRange': 'string',
'Expires': 'string',
'WebsiteRedirectLocation': 'string',
'ServerSideEncryption': 'AES256'|'aws:fsx'|'aws:backup'|'aws:kms'|'aws:kms:dsse',
'Metadata': {
'string': 'string'
},
'SSECustomerAlgorithm': 'string',
'SSECustomerKeyMD5': 'string',
'SSEKMSKeyId': 'string',
'BucketKeyEnabled': True|False,
'StorageClass': 'STANDARD'|'REDUCED_REDUNDANCY'|'STANDARD_IA'|'ONEZONE_IA'|'INTELLIGENT_TIERING'|'GLACIER'|'DEEP_ARCHIVE'|'OUTPOSTS'|'GLACIER_IR'|'SNOW'|'EXPRESS_ONEZONE'|'FSX_OPENZFS'|'FSX_ONTAP'|'AWS_BACKUP_WARM'|'AWS_BACKUP_LOW_COST_WARM',
'RequestCharged': 'requester',
'ReplicationStatus': 'COMPLETE'|'PENDING'|'FAILED'|'REPLICA'|'COMPLETED',
'PartsCount': 123,
'TagCount': 123,
'ObjectLockMode': 'GOVERNANCE'|'COMPLIANCE',
'ObjectLockRetainUntilDate': datetime(2015, 1, 1),
'ObjectLockLegalHoldStatus': 'ON'|'OFF',
'ObjectLockEventHold': 'ON'|'OFF',
'ObjectLockEventHoldDurationDays': 123,
'ObjectLockEventHoldDurationYears': 123
}
Response Structure
(dict) --
DeleteMarker (boolean) --
Specifies whether the object retrieved was (true) or was not (false) a Delete Marker. If false, this response header does not appear in the response.
AcceptRanges (string) --
Indicates that a range of bytes was specified.
Expiration (string) --
If the object expiration is configured (see PutBucketLifecycleConfiguration), the response includes this header. It includes the expiry-date and rule-id key-value pairs providing object expiration information. The value of the rule-id is URL-encoded.
Restore (string) --
If the object is an archived object (an object whose storage class is GLACIER), the response includes this header if either the archive restoration is in progress (see RestoreObject or an archive copy is already restored.
If an archive copy is already restored, the header value indicates when Amazon S3 is scheduled to delete the object copy. For example:
x-amz-restore: ongoing-request="false", expiry-date="Fri, 21 Dec 2012 00:00:00 GMT"
If the object restoration is in progress, the header returns the value ongoing-request="true".
For more information about archiving objects, see Transitioning Objects: General Considerations.
ArchiveStatus (string) --
The archive state of the head object.
LastModified (datetime) --
Date and time when the object was last modified.
ContentLength (integer) --
Size of the body in bytes.
ChecksumCRC32 (string) --
The Base64 encoded, 32-bit CRC32 checksum of the object. This checksum is only present if the checksum was uploaded with the object. When you use an API operation on an object that was uploaded using multipart uploads, this value may not be a direct checksum value of the full object. Instead, it's a calculation based on the checksum values of each individual part. For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC32C (string) --
The Base64 encoded, 32-bit CRC32C checksum of the object. This checksum is only present if the checksum was uploaded with the object. When you use an API operation on an object that was uploaded using multipart uploads, this value may not be a direct checksum value of the full object. Instead, it's a calculation based on the checksum values of each individual part. For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC64NVME (string) --
The Base64 encoded, 64-bit CRC64NVME checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA1 (string) --
The Base64 encoded, 160-bit SHA1 digest of the object. This checksum is only present if the checksum was uploaded with the object. When you use the API operation on an object that was uploaded using multipart uploads, this value may not be a direct checksum value of the full object. Instead, it's a calculation based on the checksum values of each individual part. For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA256 (string) --
The Base64 encoded, 256-bit SHA256 digest of the object. This checksum is only present if the checksum was uploaded with the object. When you use an API operation on an object that was uploaded using multipart uploads, this value may not be a direct checksum value of the full object. Instead, it's a calculation based on the checksum values of each individual part. For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA512 (string) --
The Base64 encoded, 512-bit SHA512 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumMD5 (string) --
The Base64 encoded, 128-bit MD5 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH64 (string) --
The Base64 encoded, 64-bit XXHASH64 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH3 (string) --
The Base64 encoded, 64-bit XXHASH3 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH128 (string) --
The Base64 encoded, 128-bit XXHASH128 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumType (string) --
The checksum type, which determines how part-level checksums are combined to create an object-level checksum for multipart objects. You can use this header response to verify that the checksum type that is received is the same checksum type that was specified in CreateMultipartUpload request. For more information, see Checking object integrity in the Amazon S3 User Guide.
ETag (string) --
An entity tag (ETag) is an opaque identifier assigned by a web server to a specific version of a resource found at a URL.
MissingMeta (integer) --
This is set to the number of metadata entries not returned in x-amz-meta headers. This can happen if you create metadata using an API like SOAP that supports more flexible metadata than the REST API. For example, using SOAP, you can create metadata whose values are not legal HTTP headers.
VersionId (string) --
Version ID of the object.
CacheControl (string) --
Specifies caching behavior along the request/reply chain.
ContentDisposition (string) --
Specifies presentational information for the object.
ContentEncoding (string) --
Indicates what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
ContentLanguage (string) --
The language the content is in.
ContentType (string) --
A standard MIME type describing the format of the object data.
ContentRange (string) --
The portion of the object returned in the response for a GET request.
Expires (string) --
The date and time at which the object is no longer cacheable.
WebsiteRedirectLocation (string) --
If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata.
ServerSideEncryption (string) --
The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.
Metadata (dict) --
A map of metadata to store with the object in S3.
(string) --
(string) --
SSECustomerAlgorithm (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to confirm the encryption algorithm that's used.
SSECustomerKeyMD5 (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to provide the round-trip message integrity verification of the customer-provided encryption key.
SSEKMSKeyId (string) --
If present, indicates the ID of the KMS key that was used for object encryption.
BucketKeyEnabled (boolean) --
Indicates whether the object uses an S3 Bucket Key for server-side encryption with Key Management Service (KMS) keys (SSE-KMS).
StorageClass (string) --
Provides storage class information of the object. Amazon S3 returns this header for all objects except for S3 Standard storage class objects.
For more information, see Storage Classes.
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
ReplicationStatus (string) --
Amazon S3 can return this header if your request involves a bucket that is either a source or a destination in a replication rule.
In replication, you have a source bucket on which you configure replication and destination bucket or buckets where Amazon S3 stores object replicas. When you request an object ( GetObject) or object metadata ( HeadObject) from these buckets, Amazon S3 will return the x-amz-replication-status header in the response as follows:
If requesting an object from the source bucket, Amazon S3 will return the x-amz-replication-status header if the object in your request is eligible for replication. For example, suppose that in your replication configuration, you specify object prefix TaxDocs requesting Amazon S3 to replicate objects with key prefix TaxDocs. Any objects you upload with this key name prefix, for example TaxDocs/document1.pdf, are eligible for replication. For any object request with this key name prefix, Amazon S3 will return the x-amz-replication-status header with value PENDING, COMPLETED or FAILED indicating object replication status.
If requesting an object from a destination bucket, Amazon S3 will return the x-amz-replication-status header with value REPLICA if the object in your request is a replica that Amazon S3 created and there is no replica modification replication in progress.
When replicating objects to multiple destination buckets, the x-amz-replication-status header acts differently. The header of the source object will only return a value of COMPLETED when replication is successful to all destinations. The header will remain at value PENDING until replication has completed for all destinations. If one or more destinations fails replication the header will return FAILED.
For more information, see Replication.
PartsCount (integer) --
The count of parts this object has. This value is only returned if you specify partNumber in your request and the object was uploaded as a multipart upload.
TagCount (integer) --
The number of tags, if any, on the object, when you have the relevant permission to read object tags.
You can use GetObjectTagging to retrieve the tag set associated with an object.
ObjectLockMode (string) --
The Object Lock mode, if any, that's in effect for this object. This header is only returned if the requester has the s3:GetObjectRetention permission. For more information about S3 Object Lock, see Object Lock.
ObjectLockRetainUntilDate (datetime) --
The date and time when the Object Lock retention period expires. This header is only returned if the requester has the s3:GetObjectRetention permission.
ObjectLockLegalHoldStatus (string) --
Specifies whether a legal hold is in effect for this object. This header is only returned if the requester has the s3:GetObjectLegalHold permission. This header is not returned if the specified version of this object has never had a legal hold applied. For more information about S3 Object Lock, see Object Lock.
ObjectLockEventHold (string) --
The event hold status for this object. This header is only returned if the requester has the s3:GetObjectRetention permission.
ObjectLockEventHoldDurationDays (integer) --
The event hold duration in days for this object. Only returned when the event hold is enabled.
ObjectLockEventHoldDurationYears (integer) --
The event hold duration in years for this object. Only returned when the event hold is enabled.
{'InventoryConfigurationList': {'OptionalFields': {'ObjectLockEventHoldDuration',
'ObjectLockEventHoldStatus'}}}
Returns a list of S3 Inventory configurations for the bucket. You can have up to 1,000 inventory configurations per bucket.
This action supports list pagination and does not return more than 100 configurations at a time. Always check the IsTruncated element in the response. If there are no more configurations to list, IsTruncated is set to false. If there are more configurations to list, IsTruncated is set to true, and there is a value in NextContinuationToken. You use the NextContinuationToken value to continue the pagination of the list by passing the value in continuation-token in the request to GET the next page.
To use this operation, you must have permissions to perform the s3:GetInventoryConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources.
General purpose bucket permissions - The s3:GetInventoryConfiguration permission is required in a policy. For more information about general purpose buckets permissions, see Using Bucket Policies and User Policies in the Amazon S3 User Guide.
Directory bucket permissions - To grant access to this API operation, you must have the s3express:GetInventoryConfiguration permission in an IAM identity-based policy instead of a bucket policy. For more information about directory bucket policies and permissions, see Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone in the Amazon S3 User Guide.
HTTP Host header syntax
Directory buckets - The HTTP Host header syntax is s3express-control.region-code.amazonaws.com.
For information about the Amazon S3 inventory feature, see Amazon S3 Inventory
The following operations are related to ListBucketInventoryConfigurations:
See also: AWS API Documentation
Request Syntax
client.list_bucket_inventory_configurations(
Bucket='string',
ContinuationToken='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket containing the inventory configurations to retrieve.
Directory buckets - When you use this operation with a directory bucket, you must use path-style requests in the format https://s3express-control.region-code.amazonaws.com/bucket-name ``. Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format ``bucket-base-name--zone-id--x-s3 (for example, DOC-EXAMPLE-BUCKET--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide
string
The marker used to continue an inventory configuration listing that has been truncated. Use the NextContinuationToken from a previously truncated list response to continue the listing. The continuation token is an opaque value that Amazon S3 understands.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'ContinuationToken': 'string',
'InventoryConfigurationList': [
{
'Destination': {
'S3BucketDestination': {
'AccountId': 'string',
'Bucket': 'string',
'Format': 'CSV'|'ORC'|'Parquet',
'Prefix': 'string',
'Encryption': {
'SSES3': {},
'SSEKMS': {
'KeyId': 'string'
}
}
}
},
'IsEnabled': True|False,
'Filter': {
'Prefix': 'string'
},
'Id': 'string',
'IncludedObjectVersions': 'All'|'Current',
'OptionalFields': [
'Size'|'LastModifiedDate'|'StorageClass'|'ETag'|'IsMultipartUploaded'|'ReplicationStatus'|'EncryptionStatus'|'ObjectLockRetainUntilDate'|'ObjectLockMode'|'ObjectLockLegalHoldStatus'|'ObjectLockEventHoldStatus'|'ObjectLockEventHoldDuration'|'IntelligentTieringAccessTier'|'BucketKeyStatus'|'ChecksumAlgorithm'|'ObjectAccessControlList'|'ObjectOwner'|'LifecycleExpirationDate',
],
'Schedule': {
'Frequency': 'Daily'|'Weekly'
}
},
],
'IsTruncated': True|False,
'NextContinuationToken': 'string'
}
Response Structure
(dict) --
ContinuationToken (string) --
If sent in the request, the marker that is used as a starting point for this inventory configuration list response.
InventoryConfigurationList (list) --
The list of inventory configurations for a bucket.
(dict) --
Specifies the S3 Inventory configuration for an Amazon S3 bucket. For more information, see GET Bucket inventory in the Amazon S3 API Reference.
Destination (dict) --
Contains information about where to publish the inventory results.
S3BucketDestination (dict) --
Contains the bucket name, file format, bucket owner (optional), and prefix (optional) where inventory results are published.
AccountId (string) --
The account ID that owns the destination S3 bucket. If no account ID is provided, the owner is not validated before exporting data.
Bucket (string) --
The Amazon Resource Name (ARN) of the bucket where inventory results will be published.
Format (string) --
Specifies the output format of the inventory results.
Prefix (string) --
The prefix that is prepended to all inventory results.
Encryption (dict) --
Contains the type of server-side encryption used to encrypt the inventory results.
SSES3 (dict) --
Specifies the use of SSE-S3 to encrypt delivered inventory reports.
SSEKMS (dict) --
Specifies the use of SSE-KMS to encrypt delivered inventory reports.
KeyId (string) --
Specifies the ID of the Key Management Service (KMS) symmetric encryption customer managed key to use for encrypting inventory reports.
IsEnabled (boolean) --
Specifies whether the inventory is enabled or disabled. If set to True, an inventory list is generated. If set to False, no inventory list is generated.
Filter (dict) --
Specifies an inventory filter. The inventory only includes objects that meet the filter's criteria.
Prefix (string) --
The prefix that an object must have to be included in the inventory results.
Id (string) --
The ID used to identify the inventory configuration.
IncludedObjectVersions (string) --
Object versions to include in the inventory list. If set to All, the list includes all the object versions, which adds the version-related fields VersionId, IsLatest, and DeleteMarker to the list. If set to Current, the list does not contain these version-related fields.
OptionalFields (list) --
Contains the optional fields that are included in the inventory results.
(string) --
Schedule (dict) --
Specifies the schedule for generating inventory results.
Frequency (string) --
Specifies how frequently inventory results are produced.
IsTruncated (boolean) --
Tells whether the returned list of inventory configurations is complete. A value of true indicates that the list is not complete and the NextContinuationToken is provided for a subsequent request.
NextContinuationToken (string) --
The marker used to continue this inventory configuration listing. Use the NextContinuationToken from this response to continue the listing in a subsequent request. The continuation token is an opaque value that Amazon S3 understands.
{'InventoryConfiguration': {'OptionalFields': {'ObjectLockEventHoldDuration',
'ObjectLockEventHoldStatus'}}}
This implementation of the PUT action adds an S3 Inventory configuration (identified by the inventory ID) to the bucket. You can have up to 1,000 inventory configurations per bucket.
Amazon S3 inventory generates inventories of the objects in the bucket on a daily or weekly basis, and the results are published to a flat file. The bucket that is inventoried is called the source bucket, and the bucket where the inventory flat file is stored is called the destination bucket. The destination bucket must be in the same Amazon Web Services Region as the source bucket.
When you configure an inventory for a source bucket, you specify the destination bucket where you want the inventory to be stored, and whether to generate the inventory daily or weekly. You can also configure what object metadata to include and whether to inventory all object versions or only current versions. For more information, see Amazon S3 Inventory in the Amazon S3 User Guide.
To use this operation, you must have permission to perform the s3:PutInventoryConfiguration action. The bucket owner has this permission by default and can grant this permission to others.
The s3:PutInventoryConfiguration permission allows a user to create an S3 Inventory report that includes all object metadata fields available and to specify the destination bucket to store the inventory. A user with read access to objects in the destination bucket can also access all object metadata fields that are available in the inventory report.
General purpose bucket permissions - The s3:PutInventoryConfiguration permission is required in a policy. For more information about general purpose buckets permissions, see Using Bucket Policies and User Policies in the Amazon S3 User Guide.
Directory bucket permissions - To grant access to this API operation, you must have the s3express:PutInventoryConfiguration permission in an IAM identity-based policy instead of a bucket policy. For more information about directory bucket policies and permissions, see Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone in the Amazon S3 User Guide.
To restrict access to an inventory report, see Restricting access to an Amazon S3 Inventory report in the Amazon S3 User Guide. For more information about the metadata fields available in S3 Inventory, see Amazon S3 Inventory lists in the Amazon S3 User Guide. For more information about permissions, see Permissions related to bucket subresource operations and Identity and access management in Amazon S3 in the Amazon S3 User Guide.
HTTP Host header syntax
Directory buckets - The HTTP Host header syntax is s3express-control.region-code.amazonaws.com.
PutBucketInventoryConfiguration has the following special errors:
HTTP 400 Bad Request Error
Code: InvalidArgument
Cause: Invalid Argument
HTTP 400 Bad Request Error
Code: TooManyConfigurations
Cause: You are attempting to create a new configuration but have already reached the 1,000-configuration limit.
HTTP 403 Forbidden Error
Cause: You are not the owner of the specified bucket, or you do not have the s3:PutInventoryConfiguration bucket permission to set the configuration on the bucket.
The following operations are related to PutBucketInventoryConfiguration:
See also: AWS API Documentation
Request Syntax
client.put_bucket_inventory_configuration(
Bucket='string',
Id='string',
InventoryConfiguration={
'Destination': {
'S3BucketDestination': {
'AccountId': 'string',
'Bucket': 'string',
'Format': 'CSV'|'ORC'|'Parquet',
'Prefix': 'string',
'Encryption': {
'SSES3': {}
,
'SSEKMS': {
'KeyId': 'string'
}
}
}
},
'IsEnabled': True|False,
'Filter': {
'Prefix': 'string'
},
'Id': 'string',
'IncludedObjectVersions': 'All'|'Current',
'OptionalFields': [
'Size'|'LastModifiedDate'|'StorageClass'|'ETag'|'IsMultipartUploaded'|'ReplicationStatus'|'EncryptionStatus'|'ObjectLockRetainUntilDate'|'ObjectLockMode'|'ObjectLockLegalHoldStatus'|'ObjectLockEventHoldStatus'|'ObjectLockEventHoldDuration'|'IntelligentTieringAccessTier'|'BucketKeyStatus'|'ChecksumAlgorithm'|'ObjectAccessControlList'|'ObjectOwner'|'LifecycleExpirationDate',
],
'Schedule': {
'Frequency': 'Daily'|'Weekly'
}
},
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket where the inventory configuration will be stored.
Directory buckets - When you use this operation with a directory bucket, you must use path-style requests in the format https://s3express-control.region-code.amazonaws.com/bucket-name ``. Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must also follow the format ``bucket-base-name--zone-id--x-s3 (for example, DOC-EXAMPLE-BUCKET--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide
string
[REQUIRED]
The ID used to identify the inventory configuration.
dict
[REQUIRED]
Specifies the inventory configuration.
Destination (dict) -- [REQUIRED]
Contains information about where to publish the inventory results.
S3BucketDestination (dict) -- [REQUIRED]
Contains the bucket name, file format, bucket owner (optional), and prefix (optional) where inventory results are published.
AccountId (string) --
The account ID that owns the destination S3 bucket. If no account ID is provided, the owner is not validated before exporting data.
Bucket (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the bucket where inventory results will be published.
Format (string) -- [REQUIRED]
Specifies the output format of the inventory results.
Prefix (string) --
The prefix that is prepended to all inventory results.
Encryption (dict) --
Contains the type of server-side encryption used to encrypt the inventory results.
SSES3 (dict) --
Specifies the use of SSE-S3 to encrypt delivered inventory reports.
SSEKMS (dict) --
Specifies the use of SSE-KMS to encrypt delivered inventory reports.
KeyId (string) -- [REQUIRED]
Specifies the ID of the Key Management Service (KMS) symmetric encryption customer managed key to use for encrypting inventory reports.
IsEnabled (boolean) -- [REQUIRED]
Specifies whether the inventory is enabled or disabled. If set to True, an inventory list is generated. If set to False, no inventory list is generated.
Filter (dict) --
Specifies an inventory filter. The inventory only includes objects that meet the filter's criteria.
Prefix (string) -- [REQUIRED]
The prefix that an object must have to be included in the inventory results.
Id (string) -- [REQUIRED]
The ID used to identify the inventory configuration.
IncludedObjectVersions (string) -- [REQUIRED]
Object versions to include in the inventory list. If set to All, the list includes all the object versions, which adds the version-related fields VersionId, IsLatest, and DeleteMarker to the list. If set to Current, the list does not contain these version-related fields.
OptionalFields (list) --
Contains the optional fields that are included in the inventory results.
(string) --
Schedule (dict) -- [REQUIRED]
Specifies the schedule for generating inventory results.
Frequency (string) -- [REQUIRED]
Specifies how frequently inventory results are produced.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
None
{'NotificationConfiguration': {'CloudFunctionConfiguration': {'Event': {'s3:ObjectRetention:Put'},
'Events': {'s3:ObjectRetention:Put'}},
'QueueConfiguration': {'Event': {'s3:ObjectRetention:Put'},
'Events': {'s3:ObjectRetention:Put'}},
'TopicConfiguration': {'Event': {'s3:ObjectRetention:Put'},
'Events': {'s3:ObjectRetention:Put'}}}}
No longer used, see the PutBucketNotificationConfiguration operation.
See also: AWS API Documentation
Request Syntax
client.put_bucket_notification(
Bucket='string',
ContentMD5='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
NotificationConfiguration={
'TopicConfiguration': {
'Id': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
'Topic': 'string'
},
'QueueConfiguration': {
'Id': 'string',
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Queue': 'string'
},
'CloudFunctionConfiguration': {
'Id': 'string',
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'CloudFunction': 'string',
'InvocationRole': 'string'
}
},
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket.
string
The MD5 hash of the PutPublicAccessBlock request body.
For requests made using the Amazon Web Services Command Line Interface (CLI) or Amazon Web Services SDKs, this field is calculated automatically.
string
Indicates the algorithm used to create the checksum for the request when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request. For more information, see Checking object integrity in the Amazon S3 User Guide.
If you provide an individual checksum, Amazon S3 ignores any provided ChecksumAlgorithm parameter.
dict
[REQUIRED]
The container for the configuration.
TopicConfiguration (dict) --
This data type is deprecated. A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Events (list) --
A collection of events related to objects
(string) --
The bucket event for which to send notifications.
Event (string) --
Bucket event for which to send notifications.
Topic (string) --
Amazon SNS topic to which Amazon S3 will publish a message to report the specified events for the bucket.
QueueConfiguration (dict) --
This data type is deprecated. This data type specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Event (string) --
The bucket event for which to send notifications.
Events (list) --
A collection of bucket events for which to send notifications.
(string) --
The bucket event for which to send notifications.
Queue (string) --
The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type.
CloudFunctionConfiguration (dict) --
Container for specifying the Lambda notification configuration.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Event (string) --
The bucket event for which to send notifications.
Events (list) --
Bucket events for which to send notifications.
(string) --
The bucket event for which to send notifications.
CloudFunction (string) --
Lambda cloud function ARN that Amazon S3 can invoke when it detects events of the specified type.
InvocationRole (string) --
The role supporting the invocation of the Lambda function
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
None
{'NotificationConfiguration': {'LambdaFunctionConfigurations': {'Events': {'s3:ObjectRetention:Put'}},
'QueueConfigurations': {'Events': {'s3:ObjectRetention:Put'}},
'TopicConfigurations': {'Events': {'s3:ObjectRetention:Put'}}}}
Enables notifications of specified events for a bucket. For more information about event notifications, see Configuring Event Notifications.
Using this API, you can replace an existing notification configuration. The configuration is an XML file that defines the event types that you want Amazon S3 to publish and the destination where you want Amazon S3 to publish an event notification when it detects an event of the specified type.
By default, your bucket has no event notifications configured. That is, the notification configuration will be an empty NotificationConfiguration.
<NotificationConfiguration>
</NotificationConfiguration>
This action replaces the existing notification configuration with the configuration you include in the request body.
After Amazon S3 receives this request, it first verifies that any Amazon Simple Notification Service (Amazon SNS) or Amazon Simple Queue Service (Amazon SQS) destination exists, and that the bucket owner has permission to publish to it by sending a test notification. In the case of Lambda destinations, Amazon S3 verifies that the Lambda function permissions grant Amazon S3 permission to invoke the function from the Amazon S3 bucket. For more information, see Configuring Notifications for Amazon S3 Events.
You can disable notifications by adding the empty NotificationConfiguration element.
For more information about the number of event notification configurations that you can create per bucket, see Amazon S3 service quotas in Amazon Web Services General Reference.
By default, only the bucket owner can configure notifications on a bucket. However, bucket owners can use a bucket policy to grant permission to other users to set this configuration with the required s3:PutBucketNotification permission.
If the configuration in the request body includes only one TopicConfiguration specifying only the s3:ReducedRedundancyLostObject event type, the response will also include the x-amz-sns-test-message-id header containing the message ID of the test notification sent to the topic.
The following action is related to PutBucketNotificationConfiguration:
See also: AWS API Documentation
Request Syntax
client.put_bucket_notification_configuration(
Bucket='string',
NotificationConfiguration={
'TopicConfigurations': [
{
'Id': 'string',
'TopicArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'QueueConfigurations': [
{
'Id': 'string',
'QueueArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'LambdaFunctionConfigurations': [
{
'Id': 'string',
'LambdaFunctionArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete'|'s3:ObjectRetention:Put',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'EventBridgeConfiguration': {}
},
ExpectedBucketOwner='string',
SkipDestinationValidation=True|False
)
string
[REQUIRED]
The name of the bucket.
dict
[REQUIRED]
A container for specifying the notification configuration of the bucket. If this element is empty, notifications are turned off for the bucket.
TopicConfigurations (list) --
The topic to which notifications are sent and the events for which notifications are generated.
(dict) --
A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
TopicArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon SNS topic to which Amazon S3 publishes a message when it detects events of the specified type.
Events (list) -- [REQUIRED]
The Amazon S3 bucket event about which to send notifications. For more information, see Supported Event Types in the Amazon S3 User Guide.
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
QueueConfigurations (list) --
The Amazon Simple Queue Service queues to publish messages to and the events for which to publish messages.
(dict) --
Specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
QueueArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type.
Events (list) -- [REQUIRED]
A collection of bucket events for which to send notifications
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
LambdaFunctionConfigurations (list) --
Describes the Lambda functions to invoke and the events for which to invoke them.
(dict) --
A container for specifying the configuration for Lambda notifications.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
LambdaFunctionArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Lambda function that Amazon S3 invokes when the specified event type occurs.
Events (list) -- [REQUIRED]
The Amazon S3 bucket event for which to invoke the Lambda function. For more information, see Supported Event Types in the Amazon S3 User Guide.
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
EventBridgeConfiguration (dict) --
Enables delivery of events to Amazon EventBridge.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
boolean
Skips validation of Amazon SQS, Amazon SNS, and Lambda destinations. True or false value.
None
{'ObjectLockEventHold': 'ON | OFF',
'ObjectLockEventHoldDurationDays': 'integer',
'ObjectLockEventHoldDurationYears': 'integer'}
Adds an object to a bucket.
Amazon S3 is a distributed system. If it receives multiple write requests for the same object simultaneously, it overwrites all but the last object written. However, Amazon S3 provides features that can modify this behavior:
S3 Object Lock - To prevent objects from being deleted or overwritten, you can use Amazon S3 Object Lock in the Amazon S3 User Guide.
If-None-Match - Uploads the object only if the object key name does not already exist in the specified bucket. Otherwise, Amazon S3 returns a 412 Precondition Failed error. If a conflicting operation occurs during the upload, S3 returns a 409 ConditionalRequestConflict response. On a 409 failure, retry the upload. Expects the * character (asterisk). For more information, see Add preconditions to S3 operations with conditional requests in the Amazon S3 User Guide or RFC 7232.
S3 Versioning - When you enable versioning for a bucket, if Amazon S3 receives multiple write requests for the same object simultaneously, it stores all versions of the objects. For each write request that is made to the same object, Amazon S3 automatically generates a unique version ID of that object being stored in Amazon S3. You can retrieve, replace, or delete any version of the object. For more information about versioning, see Adding Objects to Versioning-Enabled Buckets in the Amazon S3 User Guide. For information about returning the versioning state of a bucket, see GetBucketVersioning.
General purpose bucket permissions - The following permissions are required in your policies when your PutObject request includes specific headers.
s3:PutObject - To successfully complete the PutObject request, you must always have the s3:PutObject permission on a bucket to add an object to it.
s3:PutObjectAcl - To successfully change the objects ACL of your PutObject request, you must have the s3:PutObjectAcl.
s3:PutObjectTagging - To successfully set the tag-set with your PutObject request, you must have the s3:PutObjectTagging.
Directory bucket permissions - To grant access to this API operation on a directory bucket, we recommend that you use the CreateSession API operation for session-based authorization. Specifically, you grant the s3express:CreateSession permission to the directory bucket in a bucket policy or an IAM identity-based policy. Then, you make the CreateSession API call on the bucket to obtain a session token. With the session token in your request header, you can make API requests to this operation. After the session token expires, you make another CreateSession API call to generate a new session token for use. Amazon Web Services CLI or SDKs create session and refresh the session token automatically to avoid service interruptions when a session expires. For more information about authorization, see CreateSession. If the object is encrypted with SSE-KMS, you must also have the kms:GenerateDataKey and kms:Decrypt permissions in IAM identity-based policies and KMS key policies for the KMS key.
Data integrity with Content-MD5
General purpose bucket - To ensure that data is not corrupted traversing the network, use the Content-MD5 header. When you use this header, Amazon S3 checks the object against the provided MD5 value and, if they do not match, Amazon S3 returns an error. Alternatively, when the object's ETag is its MD5 digest, you can calculate the MD5 while putting the object to Amazon S3 and compare the returned ETag to the calculated MD5 value.
Directory bucket - This functionality is not supported for directory buckets.
HTTP Host header syntax
Directory buckets - The HTTP Host header syntax is Bucket-name.s3express-zone-id.region-code.amazonaws.com.
Errors
You might receive an InvalidRequest error for several reasons. Depending on the reason for the error, you might receive one of the following messages:
Cannot specify both a write offset value and user-defined object metadata for existing objects.
Checksum Type mismatch occurred, expected checksum Type: sha1, actual checksum Type: crc32c.
Request body cannot be empty when 'write offset' is specified.
For more information about related Amazon S3 APIs, see the following:
See also: AWS API Documentation
Request Syntax
client.put_object(
ACL='private'|'public-read'|'public-read-write'|'authenticated-read'|'aws-exec-read'|'bucket-owner-read'|'bucket-owner-full-control',
Body=b'bytes'|file,
Bucket='string',
CacheControl='string',
ContentDisposition='string',
ContentEncoding='string',
ContentLanguage='string',
ContentLength=123,
ContentMD5='string',
ContentType='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
ChecksumCRC32='string',
ChecksumCRC32C='string',
ChecksumCRC64NVME='string',
ChecksumSHA1='string',
ChecksumSHA256='string',
ChecksumSHA512='string',
ChecksumMD5='string',
ChecksumXXHASH64='string',
ChecksumXXHASH3='string',
ChecksumXXHASH128='string',
Expires='string',
IfMatch='string',
IfNoneMatch='string',
GrantFullControl='string',
GrantRead='string',
GrantReadACP='string',
GrantWriteACP='string',
Key='string',
WriteOffsetBytes=123,
Metadata={
'string': 'string'
},
ServerSideEncryption='AES256'|'aws:fsx'|'aws:backup'|'aws:kms'|'aws:kms:dsse',
StorageClass='STANDARD'|'REDUCED_REDUNDANCY'|'STANDARD_IA'|'ONEZONE_IA'|'INTELLIGENT_TIERING'|'GLACIER'|'DEEP_ARCHIVE'|'OUTPOSTS'|'GLACIER_IR'|'SNOW'|'EXPRESS_ONEZONE'|'FSX_OPENZFS'|'FSX_ONTAP'|'AWS_BACKUP_WARM'|'AWS_BACKUP_LOW_COST_WARM',
WebsiteRedirectLocation='string',
SSECustomerAlgorithm='string',
SSECustomerKey='string',
SSECustomerKeyMD5='string',
SSEKMSKeyId='string',
SSEKMSEncryptionContext='string',
BucketKeyEnabled=True|False,
RequestPayer='requester',
Tagging='string',
ObjectLockMode='GOVERNANCE'|'COMPLIANCE',
ObjectLockRetainUntilDate=datetime(2015, 1, 1),
ObjectLockLegalHoldStatus='ON'|'OFF',
ObjectLockEventHold='ON'|'OFF',
ObjectLockEventHoldDurationDays=123,
ObjectLockEventHoldDurationYears=123,
ExpectedBucketOwner='string'
)
string
The canned ACL to apply to the object. For more information, see Canned ACL in the Amazon S3 User Guide.
When adding a new object, you can use headers to grant ACL-based permissions to individual Amazon Web Services accounts or to predefined groups defined by Amazon S3. These permissions are then added to the ACL on the object. By default, all objects are private. Only the owner has full access control. For more information, see Access Control List (ACL) Overview and Managing ACLs Using the REST API in the Amazon S3 User Guide.
If the bucket that you're uploading objects to uses the bucket owner enforced setting for S3 Object Ownership, ACLs are disabled and no longer affect permissions. Buckets that use this setting only accept PUT requests that don't specify an ACL or PUT requests that specify bucket owner full control ACLs, such as the bucket-owner-full-control canned ACL or an equivalent form of this ACL expressed in the XML format. PUT requests that contain other ACLs (for example, custom grants to certain Amazon Web Services accounts) fail and return a 400 error with the error code AccessControlListNotSupported. For more information, see Controlling ownership of objects and disabling ACLs in the Amazon S3 User Guide.
bytes or seekable file-like object
Object data.
string
[REQUIRED]
The bucket name to which the PUT action was initiated.
Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the format Bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the format bucket-base-name--zone-id--x-s3 (for example, amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
S3 on Outposts - When you use this action with S3 on Outposts, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When you use this action with S3 on Outposts, the destination bucket must be the Outposts access point ARN or the access point alias. For more information about S3 on Outposts, see What is S3 on Outposts? in the Amazon S3 User Guide.
string
Can be used to specify caching behavior along the request/reply chain. For more information, see http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.
string
Specifies presentational information for the object. For more information, see https://www.rfc-editor.org/rfc/rfc6266#section-4.
string
Specifies what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. For more information, see https://www.rfc-editor.org/rfc/rfc9110.html#field.content-encoding.
string
The language the content is in.
integer
Size of the body in bytes. This parameter is useful when the size of the body cannot be determined automatically. For more information, see https://www.rfc-editor.org/rfc/rfc9110.html#name-content-length.
string
The Base64 encoded 128-bit MD5 digest of the message (without the headers) according to RFC 1864. This header can be used as a message integrity check to verify that the data is the same data that was originally sent. Although it is optional, we recommend using the Content-MD5 mechanism as an end-to-end integrity check. For more information about REST request authentication, see REST Authentication.
string
A standard MIME type describing the format of the contents. For more information, see https://www.rfc-editor.org/rfc/rfc9110.html#name-content-type.
string
Indicates the algorithm used to create the checksum for the object when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum-algorithm or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request.
For the x-amz-checksum-algorithm header, replace algorithm with the supported algorithm from the following list:
CRC32
CRC32C
CRC64NVME
MD5
SHA1
SHA256
SHA512
XXHASH3
XXHASH64
XXHASH128
For more information, see Checking object integrity in the Amazon S3 User Guide.
If the individual checksum value you provide through x-amz-checksum-algorithm doesn't match the checksum algorithm you set through x-amz-sdk-checksum-algorithm, Amazon S3 fails the request with a BadDigest error.
For directory buckets, when you use Amazon Web Services SDKs, CRC32 is the default checksum algorithm that's used for performance.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 32-bit CRC32 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 32-bit CRC32C checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 64-bit CRC64NVME checksum of the object. The CRC64NVME checksum is always a full object checksum. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 160-bit SHA1 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 256-bit SHA256 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 512-bit SHA512 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 128-bit MD5 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 64-bit XXHASH64 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 64-bit XXHASH3 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 128-bit XXHASH128 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
string
The date and time at which the object is no longer cacheable. For more information, see https://www.rfc-editor.org/rfc/rfc7234#section-5.3.
string
Uploads the object only if the ETag (entity tag) value provided during the WRITE operation matches the ETag of the object in S3. If the ETag values do not match, the operation returns a 412 Precondition Failed error.
If a conflicting operation occurs during the upload S3 returns a 409 ConditionalRequestConflict response. On a 409 failure you should fetch the object's ETag and retry the upload.
Expects the ETag value as a string.
For more information about conditional requests, see RFC 7232, or Conditional requests in the Amazon S3 User Guide.
string
Uploads the object only if the object key name does not already exist in the bucket specified. Otherwise, Amazon S3 returns a 412 Precondition Failed error.
If a conflicting operation occurs during the upload S3 returns a 409 ConditionalRequestConflict response. On a 409 failure you should retry the upload.
Expects the '*' (asterisk) character.
For more information about conditional requests, see RFC 7232, or Conditional requests in the Amazon S3 User Guide.
string
Gives the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.
string
Allows grantee to read the object data and its metadata.
string
Allows grantee to read the object ACL.
string
Allows grantee to write the ACL for the applicable object.
string
[REQUIRED]
Object key for which the PUT action was initiated.
integer
Specifies the offset for appending data to existing objects in bytes. The offset must be equal to the size of the existing object being appended to. If no object exists, setting this header to 0 will create a new object.
dict
A map of metadata to store with the object in S3.
(string) --
(string) --
string
The server-side encryption algorithm that was used when you store this object in Amazon S3 or Amazon FSx.
General purpose buckets - You have four mutually exclusive options to protect data using server-side encryption in Amazon S3, depending on how you choose to manage the encryption keys. Specifically, the encryption key options are Amazon S3 managed keys (SSE-S3), Amazon Web Services KMS keys (SSE-KMS or DSSE-KMS), and customer-provided keys (SSE-C). Amazon S3 encrypts data with server-side encryption by using Amazon S3 managed keys (SSE-S3) by default. You can optionally tell Amazon S3 to encrypt data at rest by using server-side encryption with other key options. For more information, see Using Server-Side Encryption in the Amazon S3 User Guide.
Directory buckets - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) ( AES256) and server-side encryption with KMS keys (SSE-KMS) ( aws:kms). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your CreateSession requests or PUT object requests. Then, new objects are automatically encrypted with the desired encryption settings. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide. For more information about the encryption overriding behaviors in directory buckets, see Specifying server-side encryption with KMS for new object uploads. In the Zonal endpoint API calls (except CopyObject and UploadPartCopy) using the REST API, the encryption request headers must match the encryption settings that are specified in the CreateSession request. You can't override the values of the encryption settings ( x-amz-server-side-encryption, x-amz-server-side-encryption-aws-kms-key-id, x-amz-server-side-encryption-context, and x-amz-server-side-encryption-bucket-key-enabled) that are specified in the CreateSession request. You don't need to explicitly specify these encryption settings values in Zonal endpoint API calls, and Amazon S3 will use the encryption settings values from the CreateSession request to protect new objects in the directory bucket.
S3 access points for Amazon FSx - When accessing data stored in Amazon FSx file systems using S3 access points, the only valid server side encryption option is aws:fsx. All Amazon FSx file systems have encryption configured by default and are encrypted at rest. Data is automatically encrypted before being written to the file system, and automatically decrypted as it is read. These processes are handled transparently by Amazon FSx.
string
By default, Amazon S3 uses the STANDARD Storage Class to store newly created objects. The STANDARD storage class provides high durability and high availability. Depending on performance needs, you can specify a different Storage Class. For more information, see Storage Classes in the Amazon S3 User Guide.
string
If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata. For information about object metadata, see Object Key and Metadata in the Amazon S3 User Guide.
In the following example, the request header sets the redirect to an object (anotherPage.html) in the same bucket:
x-amz-website-redirect-location: /anotherPage.html
In the following example, the request header sets the object redirect to another website:
x-amz-website-redirect-location: http://www.example.com/
For more information about website hosting in Amazon S3, see Hosting Websites on Amazon S3 and How to Configure Website Page Redirects in the Amazon S3 User Guide.
string
Specifies the algorithm to use when encrypting the object (for example, AES256).
string
Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded; Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.
string
Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
string
Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. If the KMS key doesn't exist in the same account that's issuing the command, you must use the full Key ARN not the Key ID.
General purpose buckets - If you specify x-amz-server-side-encryption with aws:kms or aws:kms:dsse, this header specifies the ID (Key ID, Key ARN, or Key Alias) of the KMS key to use. If you specify x-amz-server-side-encryption:aws:kms or x-amz-server-side-encryption:aws:kms:dsse, but do not provide x-amz-server-side-encryption-aws-kms-key-id, Amazon S3 uses the Amazon Web Services managed key ( aws/s3) to protect the data.
Directory buckets - To encrypt data using SSE-KMS, it's recommended to specify the x-amz-server-side-encryption header to aws:kms. Then, the x-amz-server-side-encryption-aws-kms-key-id header implicitly uses the bucket's default KMS customer managed key ID. If you want to explicitly set the x-amz-server-side-encryption-aws-kms-key-id header, it must match the bucket's default customer managed key (using key ID or ARN, not alias). Your SSE-KMS configuration can only support 1 customer managed key per directory bucket's lifetime. The Amazon Web Services managed key ( aws/s3) isn't supported. Incorrect key specification results in an HTTP 400 Bad Request error.
string
Specifies the Amazon Web Services KMS Encryption Context as an additional encryption context to use for object encryption. The value of this header is a Base64 encoded string of a UTF-8 encoded JSON, which contains the encryption context as key-value pairs. This value is stored as object metadata and automatically gets passed on to Amazon Web Services KMS for future GetObject operations on this object.
General purpose buckets - This value must be explicitly added during CopyObject operations if you want an additional encryption context for your object. For more information, see Encryption context in the Amazon S3 User Guide.
Directory buckets - You can optionally provide an explicit encryption context value. The value must match the default encryption context - the bucket Amazon Resource Name (ARN). An additional encryption context value is not supported.
boolean
Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Key Management Service (KMS) keys (SSE-KMS).
General purpose buckets - Setting this header to true causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS. Also, specifying this header with a PUT action doesn't affect bucket-level settings for S3 Bucket Key.
Directory buckets - S3 Bucket Keys are always enabled for GET and PUT operations in a directory bucket and can’t be disabled. S3 Bucket Keys aren't supported, when you copy SSE-KMS encrypted objects from general purpose buckets to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through CopyObject, UploadPartCopy, the Copy operation in Batch Operations, or the import jobs. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The tag-set for the object. The tag-set must be encoded as URL Query parameters. (For example, "Key1=Value1")
string
The Object Lock mode that you want to apply to this object.
datetime
The date and time when you want this object's Object Lock to expire. Must be formatted as a timestamp parameter.
string
Specifies whether a legal hold will be applied to this object. For more information about S3 Object Lock, see Object Lock in the Amazon S3 User Guide.
string
Specifies the event hold status to apply to this object. Set to ON to enable or OFF to disable.
integer
Specifies the event hold duration in days to apply to this object.
integer
Specifies the event hold duration in years to apply to this object.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'Expiration': 'string',
'ETag': 'string',
'ChecksumCRC32': 'string',
'ChecksumCRC32C': 'string',
'ChecksumCRC64NVME': 'string',
'ChecksumSHA1': 'string',
'ChecksumSHA256': 'string',
'ChecksumSHA512': 'string',
'ChecksumMD5': 'string',
'ChecksumXXHASH64': 'string',
'ChecksumXXHASH3': 'string',
'ChecksumXXHASH128': 'string',
'ChecksumType': 'COMPOSITE'|'FULL_OBJECT',
'ServerSideEncryption': 'AES256'|'aws:fsx'|'aws:backup'|'aws:kms'|'aws:kms:dsse',
'VersionId': 'string',
'SSECustomerAlgorithm': 'string',
'SSECustomerKeyMD5': 'string',
'SSEKMSKeyId': 'string',
'SSEKMSEncryptionContext': 'string',
'BucketKeyEnabled': True|False,
'Size': 123,
'RequestCharged': 'requester'
}
Response Structure
(dict) --
Expiration (string) --
If the expiration is configured for the object (see PutBucketLifecycleConfiguration) in the Amazon S3 User Guide, the response includes this header. It includes the expiry-date and rule-id key-value pairs that provide information about object expiration. The value of the rule-id is URL-encoded.
ETag (string) --
Entity tag for the uploaded object.
General purpose buckets - To ensure that data is not corrupted traversing the network, for objects where the ETag is the MD5 digest of the object, you can calculate the MD5 while putting an object to Amazon S3 and compare the returned ETag to the calculated MD5 value.
Directory buckets - The ETag for the object in a directory bucket isn't the MD5 digest of the object.
ChecksumCRC32 (string) --
The Base64 encoded, 32-bit CRC32 checksum of the object. This checksum is only present if the checksum was uploaded with the object. When you use an API operation on an object that was uploaded using multipart uploads, this value may not be a direct checksum value of the full object. Instead, it's a calculation based on the checksum values of each individual part. For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC32C (string) --
The Base64 encoded, 32-bit CRC32C checksum of the object. This checksum is only present if the checksum was uploaded with the object. When you use an API operation on an object that was uploaded using multipart uploads, this value may not be a direct checksum value of the full object. Instead, it's a calculation based on the checksum values of each individual part. For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC64NVME (string) --
The Base64 encoded, 64-bit CRC64NVME checksum of the object. This header is present if the object was uploaded with the CRC64NVME checksum algorithm, or if it was uploaded without a checksum (and Amazon S3 added the default checksum, CRC64NVME, to the uploaded object). For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA1 (string) --
The Base64 encoded, 160-bit SHA1 digest of the object. This checksum is only present if the checksum was uploaded with the object. When you use the API operation on an object that was uploaded using multipart uploads, this value may not be a direct checksum value of the full object. Instead, it's a calculation based on the checksum values of each individual part. For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA256 (string) --
The Base64 encoded, 256-bit SHA256 digest of the object. This checksum is only present if the checksum was uploaded with the object. When you use an API operation on an object that was uploaded using multipart uploads, this value may not be a direct checksum value of the full object. Instead, it's a calculation based on the checksum values of each individual part. For more information about how checksums are calculated with multipart uploads, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA512 (string) --
The Base64 encoded, 512-bit SHA512 digest of the object. This header is present if the object was uploaded with the SHA512 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumMD5 (string) --
The Base64 encoded, 128-bit MD5 digest of the object. This header is present if the object was uploaded with the MD5 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH64 (string) --
The Base64 encoded, 64-bit XXHASH64 checksum of the object. This header is present if the object was uploaded with the XXHASH64 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH3 (string) --
The Base64 encoded, 64-bit XXHASH3 checksum of the object. This header is present if the object was uploaded with the XXHASH3 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH128 (string) --
The Base64 encoded, 128-bit XXHASH128 checksum of the object. This header is present if the object was uploaded with the XXHASH128 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumType (string) --
This header specifies the checksum type of the object, which determines how part-level checksums are combined to create an object-level checksum for multipart objects. For PutObject uploads, the checksum type is always FULL_OBJECT. You can use this header as a data integrity check to verify that the checksum type that is received is the same checksum that was specified. For more information, see Checking object integrity in the Amazon S3 User Guide.
ServerSideEncryption (string) --
The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.
VersionId (string) --
Version ID of the object.
If you enable versioning for a bucket, Amazon S3 automatically generates a unique version ID for the object being stored. Amazon S3 returns this ID in the response. When you enable versioning for a bucket, if Amazon S3 receives multiple write requests for the same object simultaneously, it stores all of the objects. For more information about versioning, see Adding Objects to Versioning-Enabled Buckets in the Amazon S3 User Guide. For information about returning the versioning state of a bucket, see GetBucketVersioning.
SSECustomerAlgorithm (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to confirm the encryption algorithm that's used.
SSECustomerKeyMD5 (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to provide the round-trip message integrity verification of the customer-provided encryption key.
SSEKMSKeyId (string) --
If present, indicates the ID of the KMS key that was used for object encryption.
SSEKMSEncryptionContext (string) --
If present, indicates the Amazon Web Services KMS Encryption Context to use for object encryption. The value of this header is a Base64 encoded string of a UTF-8 encoded JSON, which contains the encryption context as key-value pairs. This value is stored as object metadata and automatically gets passed on to Amazon Web Services KMS for future GetObject operations on this object.
BucketKeyEnabled (boolean) --
Indicates whether the uploaded object uses an S3 Bucket Key for server-side encryption with Key Management Service (KMS) keys (SSE-KMS).
Size (integer) --
The size of the object in bytes. This value is only be present if you append to an object.
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
{'ObjectLockConfiguration': {'Rule': {'DefaultRetention': {'DefaultEventHold': {'Days': 'integer',
'Years': 'integer'}}}}}
Places an Object Lock configuration on the specified bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see Locking Objects.
See also: AWS API Documentation
Request Syntax
client.put_object_lock_configuration(
Bucket='string',
ObjectLockConfiguration={
'ObjectLockEnabled': 'Enabled',
'Rule': {
'DefaultRetention': {
'Mode': 'GOVERNANCE'|'COMPLIANCE',
'Days': 123,
'Years': 123,
'DefaultEventHold': {
'Days': 123,
'Years': 123
}
}
}
},
RequestPayer='requester',
Token='string',
ContentMD5='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The bucket whose Object Lock configuration you want to create or replace.
dict
The Object Lock configuration that you want to apply to the specified bucket.
ObjectLockEnabled (string) --
Indicates whether this bucket has an Object Lock configuration enabled. Enable ObjectLockEnabled when you apply ObjectLockConfiguration to a bucket.
Rule (dict) --
Specifies the Object Lock rule for the specified object. Enable the this rule when you apply ObjectLockConfiguration to a bucket. Bucket settings require both a mode and a period. The period can be either Days or Years but you must select one. You cannot specify Days and Years at the same time.
DefaultRetention (dict) --
The default Object Lock retention mode and period that you want to apply to new objects placed in the specified bucket. Bucket settings require both a mode and a period. The period can be either Days or Years but you must select one. You cannot specify Days and Years at the same time.
Mode (string) --
The default Object Lock retention mode you want to apply to new objects placed in the specified bucket. Must be used with either Days or Years.
Days (integer) --
The number of days that you want to specify for the default retention period. Must be used with Mode.
Years (integer) --
The number of years that you want to specify for the default retention period. Must be used with Mode.
DefaultEventHold (dict) --
The default event hold duration to be applied to new objects placed in the specified bucket. When configured, new objects will automatically have an event hold enabled with this duration.
Days (integer) --
The number of days for the event hold duration. The minimum value is 1 and the maximum value is 36,500.
Years (integer) --
The number of years for the event hold duration. The minimum value is 1 and the maximum value is 100.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
A token to allow Object Lock to be enabled for an existing bucket.
string
The MD5 hash for the request body.
For requests made using the Amazon Web Services Command Line Interface (CLI) or Amazon Web Services SDKs, this field is calculated automatically.
string
Indicates the algorithm used to create the checksum for the object when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request. For more information, see Checking object integrity in the Amazon S3 User Guide.
If you provide an individual checksum, Amazon S3 ignores any provided ChecksumAlgorithm parameter.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'RequestCharged': 'requester'
}
Response Structure
(dict) --
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
{'Retention': {'EventHold': 'ON | OFF',
'EventHoldDuration': {'Days': 'integer', 'Years': 'integer'}}}
Places an Object Retention configuration on an object. For more information, see Locking Objects. Users or accounts require the s3:PutObjectRetention permission in order to place an Object Retention configuration on objects. Bypassing a Governance Retention configuration requires the s3:BypassGovernanceRetention permission.
This functionality is not supported for Amazon S3 on Outposts.
See also: AWS API Documentation
Request Syntax
client.put_object_retention(
Bucket='string',
Key='string',
Retention={
'Mode': 'GOVERNANCE'|'COMPLIANCE',
'RetainUntilDate': datetime(2015, 1, 1),
'EventHold': 'ON'|'OFF',
'EventHoldDuration': {
'Days': 123,
'Years': 123
}
},
RequestPayer='requester',
VersionId='string',
BypassGovernanceRetention=True|False,
ContentMD5='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The bucket name that contains the object you want to apply this Object Retention configuration to.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
string
[REQUIRED]
The key name for the object that you want to apply this Object Retention configuration to.
dict
The container element for the Object Retention configuration.
Mode (string) --
Indicates the Retention mode for the specified object.
RetainUntilDate (datetime) --
The date on which this Object Lock Retention will expire.
EventHold (string) --
The event hold status for the object. Set to ON to enable an event hold or OFF to disable it.
EventHoldDuration (dict) --
The event hold duration for the object. Specifies how long the object remains protected after the event hold is released.
Days (integer) --
The number of days for the event hold duration. The minimum value is 1 and the maximum value is 36,500.
Years (integer) --
The number of years for the event hold duration. The minimum value is 1 and the maximum value is 100.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The version ID for the object that you want to apply this Object Retention configuration to.
boolean
Indicates whether this action should bypass Governance-mode restrictions.
string
The MD5 hash for the request body.
For requests made using the Amazon Web Services Command Line Interface (CLI) or Amazon Web Services SDKs, this field is calculated automatically.
string
Indicates the algorithm used to create the checksum for the object when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request. For more information, see Checking object integrity in the Amazon S3 User Guide.
If you provide an individual checksum, Amazon S3 ignores any provided ChecksumAlgorithm parameter.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'RequestCharged': 'requester'
}
Response Structure
(dict) --
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.