2026/06/16 - Amazon Simple Storage Service - 5 new 7 updated api methods
Changes Added support for annotations. You can now attach up to 1000 annotations (up to 1 MB each) directly to objects and create, retrieve, list, and delete them using new annotation APIs. Also added support for configuring an annotation table in S3 Metadata.
Deletes a specific annotation from an Amazon S3 object. Use the x-amz-object-if-match header to perform a conditional delete that only succeeds if the object's ETag matches the provided value, preventing race conditions during concurrent updates.
Deleting an annotation is permanent. Annotations are not independently versioned, so there is no delete marker or way to recover a deleted annotation.
To use this operation, you must have the s3:DeleteObjectAnnotation permission. If the object is protected by Object Lock in governance mode, you must also include the x-amz-bypass-governance-retention header.
The following operations are related to DeleteObjectAnnotation:
See also: AWS API Documentation
Request Syntax
client.delete_object_annotation(
Bucket='string',
Key='string',
AnnotationName='string',
VersionId='string',
RequestPayer='requester',
ExpectedBucketOwner='string',
ObjectIfMatch='string'
)
string
[REQUIRED]
The name of the bucket that contains the object.
string
[REQUIRED]
The object key.
string
[REQUIRED]
The name of the annotation to delete. Annotation names are UTF-8 encoded and cannot start with aws or s3 (case-insensitive).
Length Constraints: Minimum length of 1. Maximum length of 512 bytes.
string
The version ID of the object.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The account ID of the expected bucket owner.
string
If specified, the operation only succeeds if the object's ETag matches the provided value.
dict
Response Syntax
{
'ObjectVersionId': 'string',
'RequestCharged': 'requester'
}
Response Structure
(dict) --
ObjectVersionId (string) --
The version ID of the object that the annotation was deleted from.
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
Attaches an annotation to an Amazon S3 object. An annotation is a named payload of 1 byte to 1 MiB that you can associate with a specific object or object version. Each object can have up to 1,000 annotations.
For annotation naming rules and restrictions, see Annotation naming guidelines in the Amazon S3 User Guide.
Annotations inherit the encryption of their parent object. For objects without server-side encryption, annotations are encrypted with SSE-S3 (the default for new objects). Objects encrypted with SSE-C cannot have annotations.
To use this operation, you must have the s3:PutObjectAnnotation permission. If the bucket has Requester Pays enabled, you must include the x-amz-request-payer header.
The following operations are related to PutObjectAnnotation:
See also: AWS API Documentation
Request Syntax
client.put_object_annotation(
Bucket='string',
Key='string',
VersionId='string',
AnnotationName='string',
AnnotationPayload=b'bytes'|file,
ObjectIfMatch='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
ChecksumCRC32='string',
ChecksumCRC32C='string',
ChecksumCRC64NVME='string',
ChecksumSHA1='string',
ChecksumSHA256='string',
ChecksumSHA512='string',
ChecksumMD5='string',
ChecksumXXHASH64='string',
ChecksumXXHASH3='string',
ChecksumXXHASH128='string',
ContentMD5='string',
RequestPayer='requester',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket that contains the object.
string
[REQUIRED]
The object key.
string
The version ID of the object to attach the annotation to.
string
[REQUIRED]
The name of the annotation.
Length Constraints: Minimum length of 1. Maximum length of 512 bytes.
bytes or seekable file-like object
[REQUIRED]
The annotation payload. Must be between 1 byte and 1 MiB in size, and must be valid UTF-8 encoded text. If the payload contains invalid UTF-8 bytes, the request fails with HTTP 415 (Unsupported Media Type). To store binary data, encode the payload using Base64 before uploading.
string
If specified, the operation only succeeds if the object's ETag matches the provided value.
string
The checksum algorithm to use. Supported values: CRC32, CRC32C, CRC64NVME, SHA1, SHA256, SHA512, MD5, XXHASH64, XXHASH3, XXHASH128.
string
Base64-encoded CRC32 checksum of the annotation payload.
string
Base64-encoded CRC32C checksum of the annotation payload.
string
Base64-encoded CRC64NVME checksum of the annotation payload.
string
Base64-encoded SHA1 checksum of the annotation payload.
string
Base64-encoded SHA256 checksum of the annotation payload.
string
Base64-encoded SHA512 checksum of the annotation payload.
string
Base64-encoded MD5 checksum of the annotation payload.
string
Base64-encoded XXHASH64 checksum of the annotation payload.
string
Base64-encoded XXHASH3 checksum of the annotation payload.
string
Base64-encoded XXHASH128 checksum of the annotation payload.
string
Base64-encoded MD5 digest of the message.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The account ID of the expected bucket owner. If the bucket is owned by a different account, the request fails with an HTTP 403 (Access Denied) error.
dict
Response Syntax
{
'Key': 'string',
'AnnotationName': 'string',
'ObjectVersionId': 'string',
'ETag': 'string',
'ChecksumCRC32': 'string',
'ChecksumCRC32C': 'string',
'ChecksumCRC64NVME': 'string',
'ChecksumSHA1': 'string',
'ChecksumSHA256': 'string',
'ChecksumSHA512': 'string',
'ChecksumMD5': 'string',
'ChecksumXXHASH64': 'string',
'ChecksumXXHASH3': 'string',
'ChecksumXXHASH128': 'string',
'ChecksumType': 'COMPOSITE'|'FULL_OBJECT',
'ServerSideEncryption': 'AES256'|'aws:fsx'|'aws:kms'|'aws:kms:dsse',
'RequestCharged': 'requester'
}
Response Structure
(dict) --
Key (string) --
The object key.
AnnotationName (string) --
The name of the annotation.
ObjectVersionId (string) --
The version ID of the object that the annotation was attached to.
ETag (string) --
The entity tag of the annotation.
ChecksumCRC32 (string) --
The CRC32 checksum of the stored annotation.
ChecksumCRC32C (string) --
The CRC32C checksum of the stored annotation.
ChecksumCRC64NVME (string) --
The CRC64NVME checksum of the stored annotation.
ChecksumSHA1 (string) --
The SHA1 checksum of the stored annotation.
ChecksumSHA256 (string) --
The SHA256 checksum of the stored annotation.
ChecksumSHA512 (string) --
The SHA512 checksum of the stored annotation.
ChecksumMD5 (string) --
The MD5 checksum of the stored annotation.
ChecksumXXHASH64 (string) --
The XXHASH64 checksum of the stored annotation.
ChecksumXXHASH3 (string) --
The XXHASH3 checksum of the stored annotation.
ChecksumXXHASH128 (string) --
The XXHASH128 checksum of the stored annotation.
ChecksumType (string) --
The type of checksum used.
ServerSideEncryption (string) --
The server-side encryption algorithm used to encrypt the annotation.
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
Updates the annotation table configuration for an Amazon S3 bucket's metadata configuration. Use this operation to enable or disable the annotation table, or to update its associated IAM role.
An annotation table is a queryable Iceberg table that contains records of all annotations attached to objects in the bucket. To use this operation, the bucket must have an existing Amazon S3 Metadata configuration.
To use this operation, you must have the s3:UpdateBucketMetadataAnnotationTableConfiguration permission. If you are specifying or changing the IAM role, you must also have iam:PassRole permission for the role.
The IAM role must have a trust policy that allows the Amazon S3 metadata service to assume it, and a permissions policy that grants the actions needed to read annotations from your bucket. The following examples show a trust policy and a permissions policy that you can adapt for your bucket and account.
The following operations are related to UpdateBucketMetadataAnnotationTableConfiguration:
See also: AWS API Documentation
Request Syntax
client.update_bucket_metadata_annotation_table_configuration(
Bucket='string',
ContentMD5='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
AnnotationTableConfiguration={
'ConfigurationState': 'ENABLED'|'DISABLED',
'EncryptionConfiguration': {
'SseAlgorithm': 'aws:kms'|'AES256',
'KmsKeyArn': 'string'
},
'Role': 'string'
},
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket whose annotation table configuration to update.
string
Base64-encoded MD5 digest of the message body.
string
Checksum algorithm for the request payload.
dict
[REQUIRED]
The annotation table configuration updates to apply.
ConfigurationState (string) -- [REQUIRED]
The new configuration state to apply.
EncryptionConfiguration (dict) --
The encryption settings for an S3 Metadata journal table or inventory table configuration.
SseAlgorithm (string) -- [REQUIRED]
The encryption type specified for a metadata table. To specify server-side encryption with Key Management Service (KMS) keys (SSE-KMS), use the aws:kms value. To specify server-side encryption with Amazon S3 managed keys (SSE-S3), use the AES256 value.
KmsKeyArn (string) --
If server-side encryption with Key Management Service (KMS) keys (SSE-KMS) is specified, you must also specify the KMS key Amazon Resource Name (ARN). You must specify a customer-managed KMS key that's located in the same Region as the general purpose bucket that corresponds to the metadata table configuration.
Role (string) --
The new IAM role ARN to apply.
string
The account ID of the expected bucket owner.
None
Retrieves an annotation from an Amazon S3 object. To use this operation, you must have the s3:GetObjectAnnotation permission.
If checksum mode is enabled via the x-amz-checksum-mode header, Amazon S3 returns the stored checksum in the response headers for client-side validation.
The following operations are related to GetObjectAnnotation:
See also: AWS API Documentation
Request Syntax
client.get_object_annotation(
Bucket='string',
Key='string',
AnnotationName='string',
VersionId='string',
RequestPayer='requester',
ExpectedBucketOwner='string',
ChecksumMode='ENABLED'
)
string
[REQUIRED]
The name of the bucket that contains the object.
string
[REQUIRED]
The object key.
string
[REQUIRED]
The name of the annotation to retrieve.
Length Constraints: Minimum length of 1. Maximum length of 512 bytes.
string
The version ID of the object.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The account ID of the expected bucket owner. If the bucket is owned by a different account, the request fails with an HTTP 403 (Access Denied) error.
string
Set to ENABLED to validate the checksum of the annotation payload on retrieval.
dict
Response Syntax
{
'AnnotationPayload': StreamingBody(),
'ObjectVersionId': 'string',
'LastModified': datetime(2015, 1, 1),
'ContentLength': 123,
'ETag': 'string',
'ChecksumCRC32': 'string',
'ChecksumCRC32C': 'string',
'ChecksumCRC64NVME': 'string',
'ChecksumSHA1': 'string',
'ChecksumSHA256': 'string',
'ChecksumSHA512': 'string',
'ChecksumMD5': 'string',
'ChecksumXXHASH64': 'string',
'ChecksumXXHASH3': 'string',
'ChecksumXXHASH128': 'string',
'ChecksumType': 'COMPOSITE'|'FULL_OBJECT',
'ServerSideEncryption': 'AES256'|'aws:fsx'|'aws:kms'|'aws:kms:dsse',
'RequestCharged': 'requester',
'ReplicationStatus': 'COMPLETE'|'PENDING'|'FAILED'|'REPLICA'|'COMPLETED'
}
Response Structure
(dict) --
AnnotationPayload (:class:`.StreamingBody`) --
The annotation payload.
ObjectVersionId (string) --
The version ID of the object that the annotation is attached to.
LastModified (datetime) --
The date and time the annotation was last modified.
ContentLength (integer) --
The size of the annotation payload, in bytes.
ETag (string) --
The entity tag of the annotation.
ChecksumCRC32 (string) --
The CRC32 checksum of the annotation payload.
ChecksumCRC32C (string) --
The CRC32C checksum of the annotation payload.
ChecksumCRC64NVME (string) --
The CRC64NVME checksum of the annotation payload.
ChecksumSHA1 (string) --
The SHA1 checksum of the annotation payload.
ChecksumSHA256 (string) --
The SHA256 checksum of the annotation payload.
ChecksumSHA512 (string) --
The SHA512 checksum of the annotation payload.
ChecksumMD5 (string) --
The MD5 checksum of the annotation payload.
ChecksumXXHASH64 (string) --
The XXHASH64 checksum of the annotation payload.
ChecksumXXHASH3 (string) --
The XXHASH3 checksum of the annotation payload.
ChecksumXXHASH128 (string) --
The XXHASH128 checksum of the annotation payload.
ChecksumType (string) --
The type of checksum used.
ServerSideEncryption (string) --
The server-side encryption algorithm used.
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
ReplicationStatus (string) --
The replication status of the annotation. Possible values include PENDING, COMPLETED, FAILED, and REPLICA.
Lists the annotations attached to an Amazon S3 object. Results are paginated, with a maximum of 1,000 annotations per object. Use the AnnotationPrefix parameter to filter the results by name prefix.
To use this operation, you must have the s3:ListObjectAnnotations permission.
The following operations are related to ListObjectAnnotations:
See also: AWS API Documentation
Request Syntax
client.list_object_annotations(
Bucket='string',
Key='string',
VersionId='string',
MaxAnnotationResults=123,
AnnotationPrefix='string',
ContinuationToken='string',
RequestPayer='requester',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket that contains the object.
string
[REQUIRED]
The object key.
string
The version ID of the object.
integer
The maximum number of annotations to return in the response. Maximum is 1,000.
string
Filter results to annotations whose name begins with the specified prefix.
string
Continuation token returned by a previous request to retrieve the next page.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The account ID of the expected bucket owner.
dict
Response Syntax
{
'Annotations': [
{
'AnnotationName': 'string',
'LastModified': datetime(2015, 1, 1),
'ETag': 'string',
'ChecksumAlgorithm': [
'CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
],
'Size': 123,
'ReplicationStatus': 'COMPLETE'|'PENDING'|'FAILED'|'REPLICA'|'COMPLETED'
},
],
'Bucket': 'string',
'Key': 'string',
'ObjectVersionId': 'string',
'AnnotationPrefix': 'string',
'MaxAnnotationResults': 123,
'AnnotationCount': 123,
'ContinuationToken': 'string',
'NextContinuationToken': 'string',
'RequestCharged': 'requester'
}
Response Structure
(dict) --
Annotations (list) --
The list of annotations attached to the object.
(dict) --
Describes a single annotation attached to an object, including its name, last modified time, size, ETag, checksum algorithm, and replication status. Returned in the response from ListObjectAnnotations.
AnnotationName (string) --
The name of the annotation.
LastModified (datetime) --
The date and time the annotation was last modified.
ETag (string) --
The entity tag of the annotation.
ChecksumAlgorithm (list) --
The checksum algorithm used for the annotation.
(string) --
Size (integer) --
The size of the annotation payload, in bytes.
ReplicationStatus (string) --
The replication status of the annotation.
Bucket (string) --
The bucket name.
Key (string) --
The object key.
ObjectVersionId (string) --
The version ID of the object.
AnnotationPrefix (string) --
The prefix used to filter the response.
MaxAnnotationResults (integer) --
The maximum number of annotations returned in the response.
AnnotationCount (integer) --
The number of annotations returned.
ContinuationToken (string) --
The continuation token used in this request.
NextContinuationToken (string) --
The continuation token to use to retrieve the next page of results.
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
{'AnnotationDirective': 'COPY | EXCLUDE'}
Creates a copy of an object that is already stored in Amazon S3.
You can copy individual objects between general purpose buckets, between directory buckets, and between general purpose buckets and directory buckets.
Both the Region that you want to copy the object from and the Region that you want to copy the object to must be enabled for your account. For more information about how to enable a Region for your account, see Enable or disable a Region for standalone accounts in the Amazon Web Services Account Management Guide.
All CopyObject requests must be authenticated and signed by using IAM credentials (access key ID and secret access key for the IAM identities). All headers with the x-amz- prefix, including x-amz-copy-source, must be signed. For more information, see REST Authentication.
Directory buckets - You must use the IAM credentials to authenticate and authorize your access to the CopyObject API operation, instead of using the temporary security credentials through the CreateSession API operation.
Amazon Web Services CLI or SDKs handles authentication and authorization on your behalf.
Permissions
You must have read access to the source object and write access to the destination bucket.
General purpose bucket permissions - You must have permissions in an IAM policy based on the source and destination bucket types in a CopyObject operation.
If the source object is in a general purpose bucket, you must have s3:GetObject permission to read the source object that is being copied.
If the destination bucket is a general purpose bucket, you must have s3:PutObject permission to write the object copy to the destination bucket.
Directory bucket permissions - You must have permissions in a bucket policy or an IAM identity-based policy based on the source and destination bucket types in a CopyObject operation.
If the source object that you want to copy is in a directory bucket, you must have the s3express:CreateSession permission in the Action element of a policy to read the object. If no session mode is specified, the session will be created with the maximum allowable privilege, attempting ReadWrite first, then ReadOnly if ReadWrite is not permitted. If you want to explicitly restrict the access to be read-only, you can set the s3express:SessionMode condition key to ReadOnly on the copy source bucket.
If the copy destination is a directory bucket, you must have the s3express:CreateSession permission in the Action element of a policy to write the object to the destination. The s3express:SessionMode condition key can't be set to ReadOnly on the copy destination bucket.
If the object is encrypted with SSE-KMS, you must also have the kms:GenerateDataKey and kms:Decrypt permissions in IAM identity-based policies and KMS key policies for the KMS key.
For example policies, see Example bucket policies for S3 Express One Zone and Amazon Web Services Identity and Access Management (IAM) identity-based policies for S3 Express One Zone in the Amazon S3 User Guide.
Response and special errors
When the request is an HTTP 1.1 request, the response is chunk encoded. When the request is not an HTTP 1.1 request, the response would not contain the Content-Length. You always need to read the entire response body to check if the copy succeeds.
If the copy is successful, you receive a response with information about the copied object.
A copy request might return an error when Amazon S3 receives the copy request or while Amazon S3 is copying the files. A 200 OK response can contain either a success or an error.
If the error occurs before the copy action starts, you receive a standard Amazon S3 error.
If the error occurs during the copy operation, the error response is embedded in the 200 OK response. For example, in a cross-region copy, you may encounter throttling and receive a 200 OK response. For more information, see Resolve the Error 200 response when copying objects to Amazon S3. The 200 OK status code means the copy was accepted, but it doesn't mean the copy is complete. Another example is when you disconnect from Amazon S3 before the copy is complete, Amazon S3 might cancel the copy and you may receive a 200 OK response. You must stay connected to Amazon S3 until the entire response is successfully received and processed. If you call this API operation directly, make sure to design your application to parse the content of the response and handle it appropriately. If you use Amazon Web Services SDKs, SDKs handle this condition. The SDKs detect the embedded error and apply error handling per your configuration settings (including automatically retrying the request as appropriate). If the condition persists, the SDKs throw an exception (or, for the SDKs that don't use exceptions, they return an error).
Charge
The copy request charge is based on the storage class and Region that you specify for the destination object. The request can also result in a data retrieval charge for the source if the source storage class bills for data retrieval. If the copy source is in a different region, the data transfer is billed to the copy source account. For pricing information, see Amazon S3 pricing.
HTTP Host header syntax
Directory buckets - The HTTP Host header syntax is Bucket-name.s3express-zone-id.region-code.amazonaws.com.
Amazon S3 on Outposts - When you use this action with S3 on Outposts through the REST API, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. The hostname isn't required when you use the Amazon Web Services CLI or SDKs.
The following operations are related to CopyObject:
See also: AWS API Documentation
Request Syntax
client.copy_object(
ACL='private'|'public-read'|'public-read-write'|'authenticated-read'|'aws-exec-read'|'bucket-owner-read'|'bucket-owner-full-control',
Bucket='string',
CacheControl='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
ContentDisposition='string',
ContentEncoding='string',
ContentLanguage='string',
ContentType='string',
CopySource='string',
CopySourceIfMatch='string',
CopySourceIfModifiedSince=datetime(2015, 1, 1),
CopySourceIfNoneMatch='string',
CopySourceIfUnmodifiedSince=datetime(2015, 1, 1),
Expires=datetime(2015, 1, 1),
GrantFullControl='string',
GrantRead='string',
GrantReadACP='string',
GrantWriteACP='string',
IfMatch='string',
IfNoneMatch='string',
Key='string',
Metadata={
'string': 'string'
},
MetadataDirective='COPY'|'REPLACE',
TaggingDirective='COPY'|'REPLACE',
AnnotationDirective='COPY'|'EXCLUDE',
ServerSideEncryption='AES256'|'aws:fsx'|'aws:kms'|'aws:kms:dsse',
StorageClass='STANDARD'|'REDUCED_REDUNDANCY'|'STANDARD_IA'|'ONEZONE_IA'|'INTELLIGENT_TIERING'|'GLACIER'|'DEEP_ARCHIVE'|'OUTPOSTS'|'GLACIER_IR'|'SNOW'|'EXPRESS_ONEZONE'|'FSX_OPENZFS'|'FSX_ONTAP',
WebsiteRedirectLocation='string',
SSECustomerAlgorithm='string',
SSECustomerKey='string',
SSECustomerKeyMD5='string',
SSEKMSKeyId='string',
SSEKMSEncryptionContext='string',
BucketKeyEnabled=True|False,
CopySourceSSECustomerAlgorithm='string',
CopySourceSSECustomerKey='string',
CopySourceSSECustomerKeyMD5='string',
RequestPayer='requester',
Tagging='string',
ObjectLockMode='GOVERNANCE'|'COMPLIANCE',
ObjectLockRetainUntilDate=datetime(2015, 1, 1),
ObjectLockLegalHoldStatus='ON'|'OFF',
ExpectedBucketOwner='string',
ExpectedSourceBucketOwner='string'
)
string
The canned access control list (ACL) to apply to the object.
When you copy an object, the ACL metadata is not preserved and is set to private by default. Only the owner has full access control. To override the default ACL setting, specify a new ACL when you generate a copy request. For more information, see Using ACLs.
If the destination bucket that you're copying objects to uses the bucket owner enforced setting for S3 Object Ownership, ACLs are disabled and no longer affect permissions. Buckets that use this setting only accept PUT requests that don't specify an ACL or PUT requests that specify bucket owner full control ACLs, such as the bucket-owner-full-control canned ACL or an equivalent form of this ACL expressed in the XML format. For more information, see Controlling ownership of objects and disabling ACLs in the Amazon S3 User Guide.
string
[REQUIRED]
The name of the destination bucket.
Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the format Bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the format bucket-base-name--zone-id--x-s3 (for example, amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide.
Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.*Region*.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
S3 on Outposts - When you use this action with S3 on Outposts, you must use the Outpost bucket access point ARN or the access point alias for the destination bucket. You can only copy objects within the same Outpost bucket. It's not supported to copy objects across different Amazon Web Services Outposts, between buckets on the same Outposts, or between Outposts buckets and any other bucket types. For more information about S3 on Outposts, see What is S3 on Outposts? in the S3 on Outposts guide. When you use this action with S3 on Outposts through the REST API, you must direct requests to the S3 on Outposts hostname, in the format AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. The hostname isn't required when you use the Amazon Web Services CLI or SDKs.
string
Specifies the caching behavior along the request/reply chain.
string
Indicates the algorithm that you want Amazon S3 to use to create the checksum for the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
When you copy an object, if the source object has a checksum, that checksum value will be copied to the new object by default. If the CopyObject request does not include this x-amz-checksum-algorithm header, the checksum algorithm will be copied from the source object to the destination object (if it's present on the source object). You can optionally specify a different checksum algorithm to use with the x-amz-checksum-algorithm header. Unrecognized or unsupported values will respond with the HTTP status code 400 Bad Request.
string
Specifies presentational information for the object. Indicates whether an object should be displayed in a web browser or downloaded as a file. It allows specifying the desired filename for the downloaded file.
string
Specifies what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
string
The language the content is in.
string
A standard MIME type that describes the format of the object data.
string
[REQUIRED]
Specifies the source object for the copy operation. The source object can be up to 5 GB. If the source object is an object that was uploaded by using a multipart upload, the object copy will be a single part object after the source object is copied to the destination bucket.
You specify the value of the copy source in one of two formats, depending on whether you want to access the source object through an access point:
For objects not accessed through an access point, specify the name of the source bucket and the key of the source object, separated by a slash (/). For example, to copy the object reports/january.pdf from the general purpose bucket awsexamplebucket, use awsexamplebucket/reports/january.pdf. The value must be URL-encoded. To copy the object reports/january.pdf from the directory bucket awsexamplebucket--use1-az5--x-s3, use awsexamplebucket--use1-az5--x-s3/reports/january.pdf. The value must be URL-encoded.
For objects accessed through access points, specify the Amazon Resource Name (ARN) of the object as accessed through the access point, in the format arn:aws:s3:<Region>:<account-id>:accesspoint/<access-point-name>/object/<key>. For example, to copy the object reports/january.pdf through access point my-access-point owned by account 123456789012 in Region us-west-2, use the URL encoding of arn:aws:s3:us-west-2:123456789012:accesspoint/my-access-point/object/reports/january.pdf. The value must be URL encoded.
Alternatively, for objects accessed through Amazon S3 on Outposts, specify the ARN of the object as accessed in the format arn:aws:s3-outposts:<Region>:<account-id>:outpost/<outpost-id>/object/<key>. For example, to copy the object reports/january.pdf through outpost my-outpost owned by account 123456789012 in Region us-west-2, use the URL encoding of arn:aws:s3-outposts:us-west-2:123456789012:outpost/my-outpost/object/reports/january.pdf. The value must be URL-encoded.
If your source bucket versioning is enabled, the x-amz-copy-source header by default identifies the current version of an object to copy. If the current version is a delete marker, Amazon S3 behaves as if the object was deleted. To copy a different version, use the versionId query parameter. Specifically, append ?versionId=<version-id> to the value (for example, awsexamplebucket/reports/january.pdf?versionId=QUpfdndhfd8438MNFDN93jdnJFkdmqnh893). If you don't specify a version ID, Amazon S3 copies the latest version of the source object.
If you enable versioning on the destination bucket, Amazon S3 generates a unique version ID for the copied object. This version ID is different from the version ID of the source object. Amazon S3 returns the version ID of the copied object in the x-amz-version-id response header in the response.
If you do not enable versioning or suspend it on the destination bucket, the version ID that Amazon S3 generates in the x-amz-version-id response header is always null.
string
Copies the object if its entity tag (ETag) matches the specified tag.
If both the x-amz-copy-source-if-match and x-amz-copy-source-if-unmodified-since headers are present in the request and evaluate as follows, Amazon S3 returns 200 OK and copies the data:
x-amz-copy-source-if-match condition evaluates to true
x-amz-copy-source-if-unmodified-since condition evaluates to false
datetime
Copies the object if it has been modified since the specified time.
If both the x-amz-copy-source-if-none-match and x-amz-copy-source-if-modified-since headers are present in the request and evaluate as follows, Amazon S3 returns the 412 Precondition Failed response code:
x-amz-copy-source-if-none-match condition evaluates to false
x-amz-copy-source-if-modified-since condition evaluates to true
string
Copies the object if its entity tag (ETag) is different than the specified ETag.
If both the x-amz-copy-source-if-none-match and x-amz-copy-source-if-modified-since headers are present in the request and evaluate as follows, Amazon S3 returns the 412 Precondition Failed response code:
x-amz-copy-source-if-none-match condition evaluates to false
x-amz-copy-source-if-modified-since condition evaluates to true
datetime
Copies the object if it hasn't been modified since the specified time.
If both the x-amz-copy-source-if-match and x-amz-copy-source-if-unmodified-since headers are present in the request and evaluate as follows, Amazon S3 returns 200 OK and copies the data:
x-amz-copy-source-if-match condition evaluates to true
x-amz-copy-source-if-unmodified-since condition evaluates to false
datetime
The date and time at which the object is no longer cacheable.
string
Gives the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.
string
Allows grantee to read the object data and its metadata.
string
Allows grantee to read the object ACL.
string
Allows grantee to write the ACL for the applicable object.
string
Copies the object if the entity tag (ETag) of the destination object matches the specified tag. If the ETag values do not match, the operation returns a 412 Precondition Failed error. If a concurrent operation occurs during the upload S3 returns a 409 ConditionalRequestConflict response. On a 409 failure you should fetch the object's ETag and retry the upload.
Expects the ETag value as a string.
For more information about conditional requests, see RFC 7232.
string
Copies the object only if the object key name at the destination does not already exist in the bucket specified. Otherwise, Amazon S3 returns a 412 Precondition Failed error. If a concurrent operation occurs during the upload S3 returns a 409 ConditionalRequestConflict response. On a 409 failure you should retry the upload.
Expects the '*' (asterisk) character.
For more information about conditional requests, see RFC 7232.
string
[REQUIRED]
The key of the destination object.
dict
A map of metadata to store with the object in S3.
(string) --
(string) --
string
Specifies whether the metadata is copied from the source object or replaced with metadata that's provided in the request. When copying an object, you can preserve all metadata (the default) or specify new metadata. If this header isn’t specified, COPY is the default behavior.
General purpose bucket - For general purpose buckets, when you grant permissions, you can use the s3:x-amz-metadata-directive condition key to enforce certain metadata behavior when objects are uploaded. For more information, see Amazon S3 condition key examples in the Amazon S3 User Guide.
string
Specifies whether the object tag-set is copied from the source object or replaced with the tag-set that's provided in the request.
The default value is COPY.
string
Specifies whether you want to copy annotations from the source object or exclude them. If this header isn't specified, COPY is the default behavior.
Valid Values: COPY | EXCLUDE
You can specify this directive as either an HTTP header ( x-amz-object-annotation-directive) or as a query string parameter. Use the query string form when generating presigned URLs that need to control annotation copy behavior.
When set to COPY, you must have s3:GetObjectAnnotation permission on the source object and s3:PutObjectAnnotation permission on the destination. Each annotation copied is billed as a separate PUT request. If annotations on the source are modified during the copy, Amazon S3 returns a retryable error.
string
The server-side encryption algorithm used when storing this object in Amazon S3. Unrecognized or unsupported values won’t write a destination object and will receive a 400 Bad Request response.
Amazon S3 automatically encrypts all new objects that are copied to an S3 bucket. When copying an object, if you don't specify encryption information in your copy request, the encryption setting of the target object is set to the default encryption configuration of the destination bucket. By default, all buckets have a base level of encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3). If the destination bucket has a different default encryption configuration, Amazon S3 uses the corresponding encryption key to encrypt the target object copy.
With server-side encryption, Amazon S3 encrypts your data as it writes your data to disks in its data centers and decrypts the data when you access it. For more information about server-side encryption, see Using Server-Side Encryption in the Amazon S3 User Guide.
General purpose buckets
For general purpose buckets, there are the following supported options for server-side encryption: server-side encryption with Key Management Service (KMS) keys (SSE-KMS), dual-layer server-side encryption with Amazon Web Services KMS keys (DSSE-KMS), and server-side encryption with customer-provided encryption keys (SSE-C). Amazon S3 uses the corresponding KMS key, or a customer-provided key to encrypt the target object copy.
When you perform a CopyObject operation, if you want to use a different type of encryption setting for the target object, you can specify appropriate encryption-related headers to encrypt the target object with an Amazon S3 managed key, a KMS key, or a customer-provided key. If the encryption setting in your request is different from the default encryption configuration of the destination bucket, the encryption setting in your request takes precedence.
Directory buckets
For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) ( AES256) and server-side encryption with KMS keys (SSE-KMS) ( aws:kms). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your CreateSession requests or PUT object requests. Then, new objects are automatically encrypted with the desired encryption settings. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide. For more information about the encryption overriding behaviors in directory buckets, see Specifying server-side encryption with KMS for new object uploads.
To encrypt new object copies to a directory bucket with SSE-KMS, we recommend you specify SSE-KMS as the directory bucket's default encryption configuration with a KMS key (specifically, a customer managed key). The Amazon Web Services managed key ( aws/s3) isn't supported. Your SSE-KMS configuration can only support 1 customer managed key per directory bucket for the lifetime of the bucket. After you specify a customer managed key for SSE-KMS, you can't override the customer managed key for the bucket's SSE-KMS configuration. Then, when you perform a CopyObject operation and want to specify server-side encryption settings for new object copies with SSE-KMS in the encryption-related request headers, you must ensure the encryption key is the same customer managed key that you specified for the directory bucket's default encryption configuration.
S3 access points for Amazon FSx - When accessing data stored in Amazon FSx file systems using S3 access points, the only valid server side encryption option is aws:fsx. All Amazon FSx file systems have encryption configured by default and are encrypted at rest. Data is automatically encrypted before being written to the file system, and automatically decrypted as it is read. These processes are handled transparently by Amazon FSx.
string
If the x-amz-storage-class header is not used, the copied object will be stored in the STANDARD Storage Class by default. The STANDARD storage class provides high durability and high availability. Depending on performance needs, you can specify a different Storage Class.
You can use the CopyObject action to change the storage class of an object that is already stored in Amazon S3 by using the x-amz-storage-class header. For more information, see Storage Classes in the Amazon S3 User Guide.
Before using an object as a source object for the copy operation, you must restore a copy of it if it meets any of the following conditions:
The storage class of the source object is GLACIER or DEEP_ARCHIVE.
The storage class of the source object is INTELLIGENT_TIERING and it's S3 Intelligent-Tiering access tier is Archive Access or Deep Archive Access.
For more information, see RestoreObject and Copying Objects in the Amazon S3 User Guide.
string
If the destination bucket is configured as a website, redirects requests for this object copy to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata. This value is unique to each object and is not copied when using the x-amz-metadata-directive header. Instead, you may opt to provide this header in combination with the x-amz-metadata-directive header.
string
Specifies the algorithm to use when encrypting the object (for example, AES256).
When you perform a CopyObject operation, if you want to use a different type of encryption setting for the target object, you can specify appropriate encryption-related headers to encrypt the target object with an Amazon S3 managed key, a KMS key, or a customer-provided key. If the encryption setting in your request is different from the default encryption configuration of the destination bucket, the encryption setting in your request takes precedence.
string
Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded. Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.
string
Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
string
Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. All GET and PUT requests for an object protected by KMS will fail if they're not made via SSL or using SigV4. For information about configuring any of the officially supported Amazon Web Services SDKs and Amazon Web Services CLI, see Specifying the Signature Version in Request Authentication in the Amazon S3 User Guide.
Directory buckets - To encrypt data using SSE-KMS, it's recommended to specify the x-amz-server-side-encryption header to aws:kms. Then, the x-amz-server-side-encryption-aws-kms-key-id header implicitly uses the bucket's default KMS customer managed key ID. If you want to explicitly set the x-amz-server-side-encryption-aws-kms-key-id header, it must match the bucket's default customer managed key (using key ID or ARN, not alias). Your SSE-KMS configuration can only support 1 customer managed key per directory bucket's lifetime. The Amazon Web Services managed key ( aws/s3) isn't supported. Incorrect key specification results in an HTTP 400 Bad Request error.
string
Specifies the Amazon Web Services KMS Encryption Context as an additional encryption context to use for the destination object encryption. The value of this header is a base64-encoded UTF-8 string holding JSON with the encryption context key-value pairs.
General purpose buckets - This value must be explicitly added to specify encryption context for CopyObject requests if you want an additional encryption context for your destination object. The additional encryption context of the source object won't be copied to the destination object. For more information, see Encryption context in the Amazon S3 User Guide.
Directory buckets - You can optionally provide an explicit encryption context value. The value must match the default encryption context - the bucket Amazon Resource Name (ARN). An additional encryption context value is not supported.
boolean
Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Key Management Service (KMS) keys (SSE-KMS). If a target object uses SSE-KMS, you can enable an S3 Bucket Key for the object.
Setting this header to true causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS. Specifying this header with a COPY action doesn’t affect bucket-level settings for S3 Bucket Key.
For more information, see Amazon S3 Bucket Keys in the Amazon S3 User Guide.
string
Specifies the algorithm to use when decrypting the source object (for example, AES256).
If the source object for the copy is stored in Amazon S3 using SSE-C, you must provide the necessary encryption information in your request so that Amazon S3 can decrypt the object for copying.
string
Specifies the customer-provided encryption key for Amazon S3 to use to decrypt the source object. The encryption key provided in this header must be the same one that was used when the source object was created.
If the source object for the copy is stored in Amazon S3 using SSE-C, you must provide the necessary encryption information in your request so that Amazon S3 can decrypt the object for copying.
string
Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
If the source object for the copy is stored in Amazon S3 using SSE-C, you must provide the necessary encryption information in your request so that Amazon S3 can decrypt the object for copying.
string
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for the corresponding charges. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
string
The tag-set for the object copy in the destination bucket. This value must be used in conjunction with the x-amz-tagging-directive if you choose REPLACE for the x-amz-tagging-directive. If you choose COPY for the x-amz-tagging-directive, you don't need to set the x-amz-tagging header, because the tag-set will be copied from the source object directly. The tag-set must be encoded as URL Query parameters.
The default value is the empty value.
string
The Object Lock mode that you want to apply to the object copy.
datetime
The date and time when you want the Object Lock of the object copy to expire.
string
Specifies whether you want to apply a legal hold to the object copy.
string
The account ID of the expected destination bucket owner. If the account ID that you provide does not match the actual owner of the destination bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
string
The account ID of the expected source bucket owner. If the account ID that you provide does not match the actual owner of the source bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'CopyObjectResult': {
'ETag': 'string',
'LastModified': datetime(2015, 1, 1),
'ChecksumType': 'COMPOSITE'|'FULL_OBJECT',
'ChecksumCRC32': 'string',
'ChecksumCRC32C': 'string',
'ChecksumCRC64NVME': 'string',
'ChecksumSHA1': 'string',
'ChecksumSHA256': 'string',
'ChecksumSHA512': 'string',
'ChecksumMD5': 'string',
'ChecksumXXHASH64': 'string',
'ChecksumXXHASH3': 'string',
'ChecksumXXHASH128': 'string'
},
'Expiration': 'string',
'CopySourceVersionId': 'string',
'VersionId': 'string',
'ServerSideEncryption': 'AES256'|'aws:fsx'|'aws:kms'|'aws:kms:dsse',
'SSECustomerAlgorithm': 'string',
'SSECustomerKeyMD5': 'string',
'SSEKMSKeyId': 'string',
'SSEKMSEncryptionContext': 'string',
'BucketKeyEnabled': True|False,
'RequestCharged': 'requester'
}
Response Structure
(dict) --
CopyObjectResult (dict) --
Container for all response elements.
ETag (string) --
Returns the ETag of the new object. The ETag reflects only changes to the contents of an object, not its metadata.
LastModified (datetime) --
Creation date of the object.
ChecksumType (string) --
The checksum type that is used to calculate the object’s checksum value. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC32 (string) --
The Base64 encoded, 32-bit CRC32 checksum of the object. This checksum is only present if the object was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC32C (string) --
The Base64 encoded, 32-bit CRC32C checksum of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumCRC64NVME (string) --
The Base64 encoded, 64-bit CRC64NVME checksum of the object. This checksum is present if the object being copied was uploaded with the CRC64NVME checksum algorithm, or if the object was uploaded without a checksum (and Amazon S3 added the default checksum, CRC64NVME, to the uploaded object). For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA1 (string) --
The Base64 encoded, 160-bit SHA1 digest of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA256 (string) --
The Base64 encoded, 256-bit SHA256 digest of the object. This checksum is only present if the checksum was uploaded with the object. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumSHA512 (string) --
The Base64 encoded, 512-bit SHA512 digest of the object. This checksum is only present if the object was uploaded with the SHA512 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumMD5 (string) --
The Base64 encoded, 128-bit MD5 digest of the object. This checksum is only present if the object was uploaded with the MD5 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH64 (string) --
The Base64 encoded, 64-bit XXHASH64 checksum of the object. This checksum is only present if the object was uploaded with the XXHASH64 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH3 (string) --
The Base64 encoded, 64-bit XXHASH3 checksum of the object. This checksum is only present if the object was uploaded with the XXHASH3 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
ChecksumXXHASH128 (string) --
The Base64 encoded, 128-bit XXHASH128 checksum of the object. This checksum is only present if the object was uploaded with the XXHASH128 checksum algorithm. For more information, see Checking object integrity in the Amazon S3 User Guide.
Expiration (string) --
If the object expiration is configured, the response includes this header.
CopySourceVersionId (string) --
Version ID of the source object that was copied.
VersionId (string) --
Version ID of the newly created copy.
ServerSideEncryption (string) --
The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.
SSECustomerAlgorithm (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to confirm the encryption algorithm that's used.
SSECustomerKeyMD5 (string) --
If server-side encryption with a customer-provided encryption key was requested, the response will include this header to provide the round-trip message integrity verification of the customer-provided encryption key.
SSEKMSKeyId (string) --
If present, indicates the ID of the KMS key that was used for object encryption.
SSEKMSEncryptionContext (string) --
If present, indicates the Amazon Web Services KMS Encryption Context to use for object encryption. The value of this header is a Base64 encoded UTF-8 string holding JSON with the encryption context key-value pairs.
BucketKeyEnabled (boolean) --
Indicates whether the copied object uses an S3 Bucket Key for server-side encryption with Key Management Service (KMS) keys (SSE-KMS).
RequestCharged (string) --
If present, indicates that the requester was successfully charged for the request. For more information, see Using Requester Pays buckets for storage transfers and usage in the Amazon Simple Storage Service user guide.
{'MetadataConfiguration': {'AnnotationTableConfiguration': {'ConfigurationState': 'ENABLED '
'| '
'DISABLED',
'EncryptionConfiguration': {'KmsKeyArn': 'string',
'SseAlgorithm': 'aws:kms '
'| '
'AES256'},
'Role': 'string'}}}
Creates an S3 Metadata V2 metadata configuration for a general purpose bucket. For more information, see Accelerating data discovery with S3 Metadata in the Amazon S3 User Guide.
Permissions
To use this operation, you must have the following permissions. For more information, see Setting up permissions for configuring metadata tables in the Amazon S3 User Guide.
If you want to encrypt your metadata tables with server-side encryption with Key Management Service (KMS) keys (SSE-KMS), you need additional permissions in your KMS key policy. For more information, see Setting up permissions for configuring metadata tables in the Amazon S3 User Guide.
If you also want to integrate your table bucket with Amazon Web Services analytics services so that you can query your metadata table, you need additional permissions. For more information, see Integrating Amazon S3 Tables with Amazon Web Services analytics services in the Amazon S3 User Guide.
To query your metadata tables, you need additional permissions. For more information, see Permissions for querying metadata tables in the Amazon S3 User Guide.
s3:CreateBucketMetadataTableConfiguration
s3tables:CreateTableBucket
s3tables:CreateNamespace
s3tables:GetTable
s3tables:CreateTable
s3tables:PutTablePolicy
s3tables:PutTableBucketPolicy
s3tables:PutTableEncryption
kms:DescribeKey
iam:PassRole - required if you include an AnnotationTableConfiguration with an IAM role.
The following operations are related to CreateBucketMetadataConfiguration:
If you include an AnnotationTableConfiguration with an IAM role, the role must have a trust policy that allows the Amazon S3 metadata service to assume it, and a permissions policy that grants the actions needed to read annotations from your bucket. The following examples show a trust policy and a permissions policy that you can adapt for your bucket and account.
See also: AWS API Documentation
Request Syntax
client.create_bucket_metadata_configuration(
Bucket='string',
ContentMD5='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
MetadataConfiguration={
'JournalTableConfiguration': {
'RecordExpiration': {
'Expiration': 'ENABLED'|'DISABLED',
'Days': 123
},
'EncryptionConfiguration': {
'SseAlgorithm': 'aws:kms'|'AES256',
'KmsKeyArn': 'string'
}
},
'InventoryTableConfiguration': {
'ConfigurationState': 'ENABLED'|'DISABLED',
'EncryptionConfiguration': {
'SseAlgorithm': 'aws:kms'|'AES256',
'KmsKeyArn': 'string'
}
},
'AnnotationTableConfiguration': {
'ConfigurationState': 'ENABLED'|'DISABLED',
'EncryptionConfiguration': {
'SseAlgorithm': 'aws:kms'|'AES256',
'KmsKeyArn': 'string'
},
'Role': 'string'
}
},
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The general purpose bucket that you want to create the metadata configuration for.
string
The Content-MD5 header for the metadata configuration.
string
The checksum algorithm to use with your metadata configuration.
dict
[REQUIRED]
The contents of your metadata configuration.
JournalTableConfiguration (dict) -- [REQUIRED]
The journal table configuration for a metadata configuration.
RecordExpiration (dict) -- [REQUIRED]
The journal table record expiration settings for the journal table.
Expiration (string) -- [REQUIRED]
Specifies whether journal table record expiration is enabled or disabled.
Days (integer) --
If you enable journal table record expiration, you can set the number of days to retain your journal table records. Journal table records must be retained for a minimum of 7 days. To set this value, specify any whole number from 7 to 2147483647. For example, to retain your journal table records for one year, set this value to 365.
EncryptionConfiguration (dict) --
The encryption configuration for the journal table.
SseAlgorithm (string) -- [REQUIRED]
The encryption type specified for a metadata table. To specify server-side encryption with Key Management Service (KMS) keys (SSE-KMS), use the aws:kms value. To specify server-side encryption with Amazon S3 managed keys (SSE-S3), use the AES256 value.
KmsKeyArn (string) --
If server-side encryption with Key Management Service (KMS) keys (SSE-KMS) is specified, you must also specify the KMS key Amazon Resource Name (ARN). You must specify a customer-managed KMS key that's located in the same Region as the general purpose bucket that corresponds to the metadata table configuration.
InventoryTableConfiguration (dict) --
The inventory table configuration for a metadata configuration.
ConfigurationState (string) -- [REQUIRED]
The configuration state of the inventory table, indicating whether the inventory table is enabled or disabled.
EncryptionConfiguration (dict) --
The encryption configuration for the inventory table.
SseAlgorithm (string) -- [REQUIRED]
The encryption type specified for a metadata table. To specify server-side encryption with Key Management Service (KMS) keys (SSE-KMS), use the aws:kms value. To specify server-side encryption with Amazon S3 managed keys (SSE-S3), use the AES256 value.
KmsKeyArn (string) --
If server-side encryption with Key Management Service (KMS) keys (SSE-KMS) is specified, you must also specify the KMS key Amazon Resource Name (ARN). You must specify a customer-managed KMS key that's located in the same Region as the general purpose bucket that corresponds to the metadata table configuration.
AnnotationTableConfiguration (dict) --
Optional annotation table configuration to include with the metadata configuration.
ConfigurationState (string) -- [REQUIRED]
The state of the annotation table. Valid values are ENABLED and DISABLED.
EncryptionConfiguration (dict) --
The encryption settings for an S3 Metadata journal table or inventory table configuration.
SseAlgorithm (string) -- [REQUIRED]
The encryption type specified for a metadata table. To specify server-side encryption with Key Management Service (KMS) keys (SSE-KMS), use the aws:kms value. To specify server-side encryption with Amazon S3 managed keys (SSE-S3), use the AES256 value.
KmsKeyArn (string) --
If server-side encryption with Key Management Service (KMS) keys (SSE-KMS) is specified, you must also specify the KMS key Amazon Resource Name (ARN). You must specify a customer-managed KMS key that's located in the same Region as the general purpose bucket that corresponds to the metadata table configuration.
Role (string) --
The ARN of the IAM role used to manage the annotation table.
string
The expected owner of the general purpose bucket that corresponds to your metadata configuration.
None
{'GetBucketMetadataConfigurationResult': {'MetadataConfigurationResult': {'AnnotationTableConfigurationResult': {'ConfigurationState': 'ENABLED '
'| '
'DISABLED',
'Error': {'ErrorCode': 'string',
'ErrorMessage': 'string'},
'Role': 'string',
'TableArn': 'string',
'TableName': 'string',
'TableStatus': 'string'}}}}
Retrieves the S3 Metadata configuration for a general purpose bucket. For more information, see Accelerating data discovery with S3 Metadata in the Amazon S3 User Guide.
To use this operation, you must have the s3:GetBucketMetadataTableConfiguration permission. For more information, see Setting up permissions for configuring metadata tables in the Amazon S3 User Guide.
The following operations are related to GetBucketMetadataConfiguration:
See also: AWS API Documentation
Request Syntax
client.get_bucket_metadata_configuration(
Bucket='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The general purpose bucket that corresponds to the metadata configuration that you want to retrieve.
string
The expected owner of the general purpose bucket that you want to retrieve the metadata table configuration for.
dict
Response Syntax
{
'GetBucketMetadataConfigurationResult': {
'MetadataConfigurationResult': {
'DestinationResult': {
'TableBucketType': 'aws'|'customer',
'TableBucketArn': 'string',
'TableNamespace': 'string'
},
'JournalTableConfigurationResult': {
'TableStatus': 'string',
'Error': {
'ErrorCode': 'string',
'ErrorMessage': 'string'
},
'TableName': 'string',
'TableArn': 'string',
'RecordExpiration': {
'Expiration': 'ENABLED'|'DISABLED',
'Days': 123
}
},
'InventoryTableConfigurationResult': {
'ConfigurationState': 'ENABLED'|'DISABLED',
'TableStatus': 'string',
'Error': {
'ErrorCode': 'string',
'ErrorMessage': 'string'
},
'TableName': 'string',
'TableArn': 'string'
},
'AnnotationTableConfigurationResult': {
'ConfigurationState': 'ENABLED'|'DISABLED',
'TableStatus': 'string',
'Error': {
'ErrorCode': 'string',
'ErrorMessage': 'string'
},
'TableName': 'string',
'TableArn': 'string',
'Role': 'string'
}
}
}
}
Response Structure
(dict) --
GetBucketMetadataConfigurationResult (dict) --
The metadata configuration for the general purpose bucket.
MetadataConfigurationResult (dict) --
The metadata configuration for a general purpose bucket.
DestinationResult (dict) --
The destination settings for a metadata configuration.
TableBucketType (string) --
The type of the table bucket where the metadata configuration is stored. The aws value indicates an Amazon Web Services managed table bucket, and the customer value indicates a customer-managed table bucket. V2 metadata configurations are stored in Amazon Web Services managed table buckets, and V1 metadata configurations are stored in customer-managed table buckets.
TableBucketArn (string) --
The Amazon Resource Name (ARN) of the table bucket where the metadata configuration is stored.
TableNamespace (string) --
The namespace in the table bucket where the metadata tables for a metadata configuration are stored.
JournalTableConfigurationResult (dict) --
The journal table configuration for a metadata configuration.
TableStatus (string) --
The status of the journal table. The status values are:
CREATING - The journal table is in the process of being created in the specified table bucket.
ACTIVE - The journal table has been created successfully, and records are being delivered to the table.
FAILED - Amazon S3 is unable to create the journal table, or Amazon S3 is unable to deliver records.
Error (dict) --
If an S3 Metadata V1 CreateBucketMetadataTableConfiguration or V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code and error message.
ErrorCode (string) --
If the V1 CreateBucketMetadataTableConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable and s3tables:PutTablePolicy permissions, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableAlreadyExists - The table that you specified already exists in the table bucket's namespace. Specify a different table name. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableBucketNotFound - The table bucket that you specified doesn't exist in this Amazon Web Services Region and account. Create or choose a different table bucket. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
If the V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateTableBucket, s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable, s3tables:PutTablePolicy, kms:DescribeKey, and s3tables:PutTableEncryption permissions. Additionally, ensure that the KMS key used to encrypt the table still exists, is active and has a resource policy granting access to the S3 service principals ' maintenance.s3tables.amazonaws.com' and ' metadata.s3.amazonaws.com'. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableAlreadyExists - A journal table already exists in the Amazon Web Services managed table bucket's namespace. Delete the journal table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
InventoryTableAlreadyExists - An inventory table already exists in the Amazon Web Services managed table bucket's namespace. Delete the inventory table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableNotAvailable - The journal table that the inventory table relies on has a FAILED status. An inventory table requires a journal table with an ACTIVE status. To create a new journal or inventory table, you must delete the metadata configuration for this bucket, along with any journal or inventory tables, and then create a new metadata configuration.
NoSuchBucket - The specified general purpose bucket does not exist.
ErrorMessage (string) --
If the V1 CreateBucketMetadataTableConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error message. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable and s3tables:PutTablePolicy permissions, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableAlreadyExists - The table that you specified already exists in the table bucket's namespace. Specify a different table name. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableBucketNotFound - The table bucket that you specified doesn't exist in this Amazon Web Services Region and account. Create or choose a different table bucket. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
If the V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateTableBucket, s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable, s3tables:PutTablePolicy, kms:DescribeKey, and s3tables:PutTableEncryption permissions. Additionally, ensure that the KMS key used to encrypt the table still exists, is active and has a resource policy granting access to the S3 service principals ' maintenance.s3tables.amazonaws.com' and ' metadata.s3.amazonaws.com'. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableAlreadyExists - A journal table already exists in the Amazon Web Services managed table bucket's namespace. Delete the journal table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
InventoryTableAlreadyExists - An inventory table already exists in the Amazon Web Services managed table bucket's namespace. Delete the inventory table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableNotAvailable - The journal table that the inventory table relies on has a FAILED status. An inventory table requires a journal table with an ACTIVE status. To create a new journal or inventory table, you must delete the metadata configuration for this bucket, along with any journal or inventory tables, and then create a new metadata configuration.
NoSuchBucket - The specified general purpose bucket does not exist.
TableName (string) --
The name of the journal table.
TableArn (string) --
The Amazon Resource Name (ARN) for the journal table.
RecordExpiration (dict) --
The journal table record expiration settings for the journal table.
Expiration (string) --
Specifies whether journal table record expiration is enabled or disabled.
Days (integer) --
If you enable journal table record expiration, you can set the number of days to retain your journal table records. Journal table records must be retained for a minimum of 7 days. To set this value, specify any whole number from 7 to 2147483647. For example, to retain your journal table records for one year, set this value to 365.
InventoryTableConfigurationResult (dict) --
The inventory table configuration for a metadata configuration.
ConfigurationState (string) --
The configuration state of the inventory table, indicating whether the inventory table is enabled or disabled.
TableStatus (string) --
The status of the inventory table. The status values are:
CREATING - The inventory table is in the process of being created in the specified Amazon Web Services managed table bucket.
BACKFILLING - The inventory table is in the process of being backfilled. When you enable the inventory table for your metadata configuration, the table goes through a process known as backfilling, during which Amazon S3 scans your general purpose bucket to retrieve the initial metadata for all objects in the bucket. Depending on the number of objects in your bucket, this process can take several hours. When the backfilling process is finished, the status of your inventory table changes from BACKFILLING to ACTIVE. After backfilling is completed, updates to your objects are reflected in the inventory table within one hour.
ACTIVE - The inventory table has been created successfully, and records are being delivered to the table.
FAILED - Amazon S3 is unable to create the inventory table, or Amazon S3 is unable to deliver records.
Error (dict) --
If an S3 Metadata V1 CreateBucketMetadataTableConfiguration or V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code and error message.
ErrorCode (string) --
If the V1 CreateBucketMetadataTableConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable and s3tables:PutTablePolicy permissions, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableAlreadyExists - The table that you specified already exists in the table bucket's namespace. Specify a different table name. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableBucketNotFound - The table bucket that you specified doesn't exist in this Amazon Web Services Region and account. Create or choose a different table bucket. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
If the V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateTableBucket, s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable, s3tables:PutTablePolicy, kms:DescribeKey, and s3tables:PutTableEncryption permissions. Additionally, ensure that the KMS key used to encrypt the table still exists, is active and has a resource policy granting access to the S3 service principals ' maintenance.s3tables.amazonaws.com' and ' metadata.s3.amazonaws.com'. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableAlreadyExists - A journal table already exists in the Amazon Web Services managed table bucket's namespace. Delete the journal table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
InventoryTableAlreadyExists - An inventory table already exists in the Amazon Web Services managed table bucket's namespace. Delete the inventory table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableNotAvailable - The journal table that the inventory table relies on has a FAILED status. An inventory table requires a journal table with an ACTIVE status. To create a new journal or inventory table, you must delete the metadata configuration for this bucket, along with any journal or inventory tables, and then create a new metadata configuration.
NoSuchBucket - The specified general purpose bucket does not exist.
ErrorMessage (string) --
If the V1 CreateBucketMetadataTableConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error message. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable and s3tables:PutTablePolicy permissions, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableAlreadyExists - The table that you specified already exists in the table bucket's namespace. Specify a different table name. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableBucketNotFound - The table bucket that you specified doesn't exist in this Amazon Web Services Region and account. Create or choose a different table bucket. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
If the V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateTableBucket, s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable, s3tables:PutTablePolicy, kms:DescribeKey, and s3tables:PutTableEncryption permissions. Additionally, ensure that the KMS key used to encrypt the table still exists, is active and has a resource policy granting access to the S3 service principals ' maintenance.s3tables.amazonaws.com' and ' metadata.s3.amazonaws.com'. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableAlreadyExists - A journal table already exists in the Amazon Web Services managed table bucket's namespace. Delete the journal table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
InventoryTableAlreadyExists - An inventory table already exists in the Amazon Web Services managed table bucket's namespace. Delete the inventory table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableNotAvailable - The journal table that the inventory table relies on has a FAILED status. An inventory table requires a journal table with an ACTIVE status. To create a new journal or inventory table, you must delete the metadata configuration for this bucket, along with any journal or inventory tables, and then create a new metadata configuration.
NoSuchBucket - The specified general purpose bucket does not exist.
TableName (string) --
The name of the inventory table.
TableArn (string) --
The Amazon Resource Name (ARN) for the inventory table.
AnnotationTableConfigurationResult (dict) --
The annotation table configuration result, if an annotation table is configured.
ConfigurationState (string) --
The current configuration state of the annotation table.
TableStatus (string) --
The provisioning status of the annotation table. Possible values: CREATING, BACKFILLING, ACTIVE, FAILED.
Error (dict) --
If an S3 Metadata V1 CreateBucketMetadataTableConfiguration or V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code and error message.
ErrorCode (string) --
If the V1 CreateBucketMetadataTableConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable and s3tables:PutTablePolicy permissions, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableAlreadyExists - The table that you specified already exists in the table bucket's namespace. Specify a different table name. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableBucketNotFound - The table bucket that you specified doesn't exist in this Amazon Web Services Region and account. Create or choose a different table bucket. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
If the V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateTableBucket, s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable, s3tables:PutTablePolicy, kms:DescribeKey, and s3tables:PutTableEncryption permissions. Additionally, ensure that the KMS key used to encrypt the table still exists, is active and has a resource policy granting access to the S3 service principals ' maintenance.s3tables.amazonaws.com' and ' metadata.s3.amazonaws.com'. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableAlreadyExists - A journal table already exists in the Amazon Web Services managed table bucket's namespace. Delete the journal table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
InventoryTableAlreadyExists - An inventory table already exists in the Amazon Web Services managed table bucket's namespace. Delete the inventory table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableNotAvailable - The journal table that the inventory table relies on has a FAILED status. An inventory table requires a journal table with an ACTIVE status. To create a new journal or inventory table, you must delete the metadata configuration for this bucket, along with any journal or inventory tables, and then create a new metadata configuration.
NoSuchBucket - The specified general purpose bucket does not exist.
ErrorMessage (string) --
If the V1 CreateBucketMetadataTableConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error message. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable and s3tables:PutTablePolicy permissions, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableAlreadyExists - The table that you specified already exists in the table bucket's namespace. Specify a different table name. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
TableBucketNotFound - The table bucket that you specified doesn't exist in this Amazon Web Services Region and account. Create or choose a different table bucket. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
If the V2 CreateBucketMetadataConfiguration request succeeds, but S3 Metadata was unable to create the table, this structure contains the error code. The possible error codes and error messages are as follows:
AccessDeniedCreatingResources - You don't have sufficient permissions to create the required resources. Make sure that you have s3tables:CreateTableBucket, s3tables:CreateNamespace, s3tables:CreateTable, s3tables:GetTable, s3tables:PutTablePolicy, kms:DescribeKey, and s3tables:PutTableEncryption permissions. Additionally, ensure that the KMS key used to encrypt the table still exists, is active and has a resource policy granting access to the S3 service principals ' maintenance.s3tables.amazonaws.com' and ' metadata.s3.amazonaws.com'. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
AccessDeniedWritingToTable - Unable to write to the metadata table because of missing resource permissions. To fix the resource policy, Amazon S3 needs to create a new metadata table. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
DestinationTableNotFound - The destination table doesn't exist. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
ServerInternalError - An internal error has occurred. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableAlreadyExists - A journal table already exists in the Amazon Web Services managed table bucket's namespace. Delete the journal table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
InventoryTableAlreadyExists - An inventory table already exists in the Amazon Web Services managed table bucket's namespace. Delete the inventory table, and then try again. To create a new metadata table, you must delete the metadata configuration for this bucket, and then create a new metadata configuration.
JournalTableNotAvailable - The journal table that the inventory table relies on has a FAILED status. An inventory table requires a journal table with an ACTIVE status. To create a new journal or inventory table, you must delete the metadata configuration for this bucket, along with any journal or inventory tables, and then create a new metadata configuration.
NoSuchBucket - The specified general purpose bucket does not exist.
TableName (string) --
The name of the annotation table.
TableArn (string) --
The ARN of the annotation table.
Role (string) --
The ARN of the IAM role associated with the annotation table.
{'CloudFunctionConfiguration': {'Event': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'},
'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}},
'QueueConfiguration': {'Event': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'},
'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}},
'TopicConfiguration': {'Event': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'},
'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}}}
No longer used, see GetBucketNotificationConfiguration.
See also: AWS API Documentation
Request Syntax
client.get_bucket_notification(
Bucket='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket for which to get the notification configuration.
When you use this API operation with an access point, provide the alias of the access point in place of the bucket name.
When you use this API operation with an Object Lambda access point, provide the alias of the Object Lambda access point in place of the bucket name. If the Object Lambda access point alias in a request is not valid, the error code InvalidAccessPointAliasError is returned. For more information about InvalidAccessPointAliasError, see List of Error Codes.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'TopicConfiguration': {
'Id': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
'Topic': 'string'
},
'QueueConfiguration': {
'Id': 'string',
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Queue': 'string'
},
'CloudFunctionConfiguration': {
'Id': 'string',
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'CloudFunction': 'string',
'InvocationRole': 'string'
}
}
Response Structure
(dict) --
TopicConfiguration (dict) --
This data type is deprecated. A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Events (list) --
A collection of events related to objects
(string) --
The bucket event for which to send notifications.
Event (string) --
Bucket event for which to send notifications.
Topic (string) --
Amazon SNS topic to which Amazon S3 will publish a message to report the specified events for the bucket.
QueueConfiguration (dict) --
This data type is deprecated. This data type specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Event (string) --
The bucket event for which to send notifications.
Events (list) --
A collection of bucket events for which to send notifications.
(string) --
The bucket event for which to send notifications.
Queue (string) --
The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type.
CloudFunctionConfiguration (dict) --
Container for specifying the Lambda notification configuration.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Event (string) --
The bucket event for which to send notifications.
Events (list) --
Bucket events for which to send notifications.
(string) --
The bucket event for which to send notifications.
CloudFunction (string) --
Lambda cloud function ARN that Amazon S3 can invoke when it detects events of the specified type.
InvocationRole (string) --
The role supporting the invocation of the Lambda function
{'LambdaFunctionConfigurations': {'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}},
'QueueConfigurations': {'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}},
'TopicConfigurations': {'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}}}
Returns the notification configuration of a bucket.
If notifications are not enabled on the bucket, the action returns an empty NotificationConfiguration element.
By default, you must be the bucket owner to read the notification configuration of a bucket. However, the bucket owner can use a bucket policy to grant permission to other users to read this configuration with the s3:GetBucketNotification permission.
When you use this API operation with an access point, provide the alias of the access point in place of the bucket name.
When you use this API operation with an Object Lambda access point, provide the alias of the Object Lambda access point in place of the bucket name. If the Object Lambda access point alias in a request is not valid, the error code InvalidAccessPointAliasError is returned. For more information about InvalidAccessPointAliasError, see List of Error Codes.
For more information about setting and reading the notification configuration on a bucket, see Setting Up Notification of Bucket Events. For more information about bucket policies, see Using Bucket Policies.
The following action is related to GetBucketNotification:
See also: AWS API Documentation
Request Syntax
client.get_bucket_notification_configuration(
Bucket='string',
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket for which to get the notification configuration.
When you use this API operation with an access point, provide the alias of the access point in place of the bucket name.
When you use this API operation with an Object Lambda access point, provide the alias of the Object Lambda access point in place of the bucket name. If the Object Lambda access point alias in a request is not valid, the error code InvalidAccessPointAliasError is returned. For more information about InvalidAccessPointAliasError, see List of Error Codes.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
dict
Response Syntax
{
'TopicConfigurations': [
{
'Id': 'string',
'TopicArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'QueueConfigurations': [
{
'Id': 'string',
'QueueArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'LambdaFunctionConfigurations': [
{
'Id': 'string',
'LambdaFunctionArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'EventBridgeConfiguration': {}
}
Response Structure
(dict) --
A container for specifying the notification configuration of the bucket. If this element is empty, notifications are turned off for the bucket.
TopicConfigurations (list) --
The topic to which notifications are sent and the events for which notifications are generated.
(dict) --
A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
TopicArn (string) --
The Amazon Resource Name (ARN) of the Amazon SNS topic to which Amazon S3 publishes a message when it detects events of the specified type.
Events (list) --
The Amazon S3 bucket event about which to send notifications. For more information, see Supported Event Types in the Amazon S3 User Guide.
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
QueueConfigurations (list) --
The Amazon Simple Queue Service queues to publish messages to and the events for which to publish messages.
(dict) --
Specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
QueueArn (string) --
The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type.
Events (list) --
A collection of bucket events for which to send notifications
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
LambdaFunctionConfigurations (list) --
Describes the Lambda functions to invoke and the events for which to invoke them.
(dict) --
A container for specifying the configuration for Lambda notifications.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
LambdaFunctionArn (string) --
The Amazon Resource Name (ARN) of the Lambda function that Amazon S3 invokes when the specified event type occurs.
Events (list) --
The Amazon S3 bucket event for which to invoke the Lambda function. For more information, see Supported Event Types in the Amazon S3 User Guide.
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
EventBridgeConfiguration (dict) --
Enables delivery of events to Amazon EventBridge.
{'NotificationConfiguration': {'CloudFunctionConfiguration': {'Event': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'},
'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}},
'QueueConfiguration': {'Event': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'},
'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}},
'TopicConfiguration': {'Event': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'},
'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}}}}
No longer used, see the PutBucketNotificationConfiguration operation.
See also: AWS API Documentation
Request Syntax
client.put_bucket_notification(
Bucket='string',
ContentMD5='string',
ChecksumAlgorithm='CRC32'|'CRC32C'|'SHA1'|'SHA256'|'CRC64NVME'|'SHA512'|'MD5'|'XXHASH64'|'XXHASH3'|'XXHASH128',
NotificationConfiguration={
'TopicConfiguration': {
'Id': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
'Topic': 'string'
},
'QueueConfiguration': {
'Id': 'string',
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Queue': 'string'
},
'CloudFunctionConfiguration': {
'Id': 'string',
'Event': 's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'CloudFunction': 'string',
'InvocationRole': 'string'
}
},
ExpectedBucketOwner='string'
)
string
[REQUIRED]
The name of the bucket.
string
The MD5 hash of the PutPublicAccessBlock request body.
For requests made using the Amazon Web Services Command Line Interface (CLI) or Amazon Web Services SDKs, this field is calculated automatically.
string
Indicates the algorithm used to create the checksum for the request when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request. For more information, see Checking object integrity in the Amazon S3 User Guide.
If you provide an individual checksum, Amazon S3 ignores any provided ChecksumAlgorithm parameter.
dict
[REQUIRED]
The container for the configuration.
TopicConfiguration (dict) --
This data type is deprecated. A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Events (list) --
A collection of events related to objects
(string) --
The bucket event for which to send notifications.
Event (string) --
Bucket event for which to send notifications.
Topic (string) --
Amazon SNS topic to which Amazon S3 will publish a message to report the specified events for the bucket.
QueueConfiguration (dict) --
This data type is deprecated. This data type specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Event (string) --
The bucket event for which to send notifications.
Events (list) --
A collection of bucket events for which to send notifications.
(string) --
The bucket event for which to send notifications.
Queue (string) --
The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type.
CloudFunctionConfiguration (dict) --
Container for specifying the Lambda notification configuration.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
Event (string) --
The bucket event for which to send notifications.
Events (list) --
Bucket events for which to send notifications.
(string) --
The bucket event for which to send notifications.
CloudFunction (string) --
Lambda cloud function ARN that Amazon S3 can invoke when it detects events of the specified type.
InvocationRole (string) --
The role supporting the invocation of the Lambda function
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
None
{'NotificationConfiguration': {'LambdaFunctionConfigurations': {'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}},
'QueueConfigurations': {'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}},
'TopicConfigurations': {'Events': {'s3:ObjectAnnotation:*',
's3:ObjectAnnotation:Delete',
's3:ObjectAnnotation:Put'}}}}
Enables notifications of specified events for a bucket. For more information about event notifications, see Configuring Event Notifications.
Using this API, you can replace an existing notification configuration. The configuration is an XML file that defines the event types that you want Amazon S3 to publish and the destination where you want Amazon S3 to publish an event notification when it detects an event of the specified type.
By default, your bucket has no event notifications configured. That is, the notification configuration will be an empty NotificationConfiguration.
<NotificationConfiguration>
</NotificationConfiguration>
This action replaces the existing notification configuration with the configuration you include in the request body.
After Amazon S3 receives this request, it first verifies that any Amazon Simple Notification Service (Amazon SNS) or Amazon Simple Queue Service (Amazon SQS) destination exists, and that the bucket owner has permission to publish to it by sending a test notification. In the case of Lambda destinations, Amazon S3 verifies that the Lambda function permissions grant Amazon S3 permission to invoke the function from the Amazon S3 bucket. For more information, see Configuring Notifications for Amazon S3 Events.
You can disable notifications by adding the empty NotificationConfiguration element.
For more information about the number of event notification configurations that you can create per bucket, see Amazon S3 service quotas in Amazon Web Services General Reference.
By default, only the bucket owner can configure notifications on a bucket. However, bucket owners can use a bucket policy to grant permission to other users to set this configuration with the required s3:PutBucketNotification permission.
If the configuration in the request body includes only one TopicConfiguration specifying only the s3:ReducedRedundancyLostObject event type, the response will also include the x-amz-sns-test-message-id header containing the message ID of the test notification sent to the topic.
The following action is related to PutBucketNotificationConfiguration:
See also: AWS API Documentation
Request Syntax
client.put_bucket_notification_configuration(
Bucket='string',
NotificationConfiguration={
'TopicConfigurations': [
{
'Id': 'string',
'TopicArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'QueueConfigurations': [
{
'Id': 'string',
'QueueArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'LambdaFunctionConfigurations': [
{
'Id': 'string',
'LambdaFunctionArn': 'string',
'Events': [
's3:ReducedRedundancyLostObject'|'s3:ObjectCreated:*'|'s3:ObjectCreated:Put'|'s3:ObjectCreated:Post'|'s3:ObjectCreated:Copy'|'s3:ObjectCreated:CompleteMultipartUpload'|'s3:ObjectRemoved:*'|'s3:ObjectRemoved:Delete'|'s3:ObjectRemoved:DeleteMarkerCreated'|'s3:ObjectRestore:*'|'s3:ObjectRestore:Post'|'s3:ObjectRestore:Completed'|'s3:Replication:*'|'s3:Replication:OperationFailedReplication'|'s3:Replication:OperationNotTracked'|'s3:Replication:OperationMissedThreshold'|'s3:Replication:OperationReplicatedAfterThreshold'|'s3:ObjectRestore:Delete'|'s3:LifecycleTransition'|'s3:IntelligentTiering'|'s3:ObjectAcl:Put'|'s3:LifecycleExpiration:*'|'s3:LifecycleExpiration:Delete'|'s3:LifecycleExpiration:DeleteMarkerCreated'|'s3:ObjectTagging:*'|'s3:ObjectTagging:Put'|'s3:ObjectTagging:Delete'|'s3:ObjectAnnotation:*'|'s3:ObjectAnnotation:Put'|'s3:ObjectAnnotation:Delete',
],
'Filter': {
'Key': {
'FilterRules': [
{
'Name': 'prefix'|'suffix',
'Value': 'string'
},
]
}
}
},
],
'EventBridgeConfiguration': {}
},
ExpectedBucketOwner='string',
SkipDestinationValidation=True|False
)
string
[REQUIRED]
The name of the bucket.
dict
[REQUIRED]
A container for specifying the notification configuration of the bucket. If this element is empty, notifications are turned off for the bucket.
TopicConfigurations (list) --
The topic to which notifications are sent and the events for which notifications are generated.
(dict) --
A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
TopicArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon SNS topic to which Amazon S3 publishes a message when it detects events of the specified type.
Events (list) -- [REQUIRED]
The Amazon S3 bucket event about which to send notifications. For more information, see Supported Event Types in the Amazon S3 User Guide.
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
QueueConfigurations (list) --
The Amazon Simple Queue Service queues to publish messages to and the events for which to publish messages.
(dict) --
Specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
QueueArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type.
Events (list) -- [REQUIRED]
A collection of bucket events for which to send notifications
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
LambdaFunctionConfigurations (list) --
Describes the Lambda functions to invoke and the events for which to invoke them.
(dict) --
A container for specifying the configuration for Lambda notifications.
Id (string) --
An optional unique identifier for configurations in a notification configuration. If you don't provide one, Amazon S3 will assign an ID.
LambdaFunctionArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Lambda function that Amazon S3 invokes when the specified event type occurs.
Events (list) -- [REQUIRED]
The Amazon S3 bucket event for which to invoke the Lambda function. For more information, see Supported Event Types in the Amazon S3 User Guide.
(string) --
The bucket event for which to send notifications.
Filter (dict) --
Specifies object key name filtering rules. For information about key name filtering, see Configuring event notifications using object key name filtering in the Amazon S3 User Guide.
Key (dict) --
A container for object key name prefix and suffix filtering rules.
FilterRules (list) --
A list of containers for the key-value pair that defines the criteria for the filter rule.
(dict) --
Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as 2023- or engineering/. Then, you can use FilterRule to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.
Name (string) --
The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see Configuring Event Notifications in the Amazon S3 User Guide.
Value (string) --
The value that the filter searches for in object key names.
EventBridgeConfiguration (dict) --
Enables delivery of events to Amazon EventBridge.
string
The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).
boolean
Skips validation of Amazon SQS, Amazon SNS, and Lambda destinations. True or false value.
None