Skip to content

Commit b474584

Browse files
author
awstools
committed
feat(client-s3): Amazon Simple Storage Service / Features : Add support for conditional writes for PutObject and CompleteMultipartUpload APIs.
1 parent 5154d4f commit b474584

File tree

11 files changed

+162
-47
lines changed

11 files changed

+162
-47
lines changed

‎clients/client-s3/src/commands/CompleteMultipartUploadCommand.ts

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,10 @@ export interface CompleteMultipartUploadCommandOutput extends CompleteMultipartU
8181
* <ul>
8282
* <li>
8383
* <p>
84-
* <b>General purpose bucket permissions</b> - For information about permissions required to use the multipart upload API, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html">Multipart Upload
85-
* and Permissions</a> in the <i>Amazon S3
86-
* User Guide</i>.</p>
84+
* <b>General purpose bucket permissions</b> - For
85+
* information about permissions required to use the multipart upload API, see
86+
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html">Multipart Upload and
87+
* Permissions</a> in the <i>Amazon S3 User Guide</i>.</p>
8788
* </li>
8889
* <li>
8990
* <p>
@@ -94,6 +95,13 @@ export interface CompleteMultipartUploadCommandOutput extends CompleteMultipartU
9495
* <code>CreateSession</code>
9596
* </a>.</p>
9697
* </li>
98+
* <li>
99+
* <p> If you provide an <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_Checksum.html">additional checksum
100+
* value</a> in your <code>MultipartUpload</code> requests and the
101+
* object is encrypted with Key Management Service, you must have permission to use the
102+
* <code>kms:Decrypt</code> action for the
103+
* <code>CompleteMultipartUpload</code> request to succeed.</p>
104+
* </li>
97105
* </ul>
98106
* </dd>
99107
* <dt>Special errors</dt>
@@ -218,6 +226,7 @@ export interface CompleteMultipartUploadCommandOutput extends CompleteMultipartU
218226
* ChecksumSHA256: "STRING_VALUE",
219227
* RequestPayer: "requester",
220228
* ExpectedBucketOwner: "STRING_VALUE",
229+
* IfNoneMatch: "STRING_VALUE",
221230
* SSECustomerAlgorithm: "STRING_VALUE",
222231
* SSECustomerKey: "STRING_VALUE",
223232
* SSECustomerKeyMD5: "STRING_VALUE",

‎clients/client-s3/src/commands/CreateMultipartUploadCommand.ts

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -78,17 +78,20 @@ export interface CreateMultipartUploadCommandOutput extends CreateMultipartUploa
7878
* <ul>
7979
* <li>
8080
* <p>
81-
* <b>General purpose bucket permissions</b> - For information about the permissions required to use the multipart upload API, see
82-
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html">Multipart
83-
* upload and permissions</a> in the <i>Amazon S3 User Guide</i>. </p>
84-
* <p>To perform a multipart upload with encryption by using an Amazon Web Services KMS key, the requester
85-
* must have permission to the <code>kms:Decrypt</code> and <code>kms:GenerateDataKey*</code>
86-
* actions on the key. These permissions are required because Amazon S3 must decrypt and read data
87-
* from the encrypted file parts before it completes the multipart upload. For more
88-
* information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html#mpuAndPermissions">Multipart upload API
89-
* and permissions</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html">Protecting data using
90-
* server-side encryption with Amazon Web Services KMS</a> in the
91-
* <i>Amazon S3 User Guide</i>.</p>
81+
* <b>General purpose bucket permissions</b> - To
82+
* perform a multipart upload with encryption using an Key Management Service (KMS)
83+
* KMS key, the requester must have permission to the
84+
* <code>kms:Decrypt</code> and <code>kms:GenerateDataKey</code> actions on
85+
* the key. The requester must also have permissions for the
86+
* <code>kms:GenerateDataKey</code> action for the
87+
* <code>CreateMultipartUpload</code> API. Then, the requester needs
88+
* permissions for the <code>kms:Decrypt</code> action on the
89+
* <code>UploadPart</code> and <code>UploadPartCopy</code> APIs. These
90+
* permissions are required because Amazon S3 must decrypt and read data from the
91+
* encrypted file parts before it completes the multipart upload. For more
92+
* information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html#mpuAndPermissions">Multipart upload API and permissions</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html">Protecting data
93+
* using server-side encryption with Amazon Web Services KMS</a> in the
94+
* <i>Amazon S3 User Guide</i>.</p>
9295
* </li>
9396
* <li>
9497
* <p>

‎clients/client-s3/src/commands/PutObjectCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ export interface PutObjectCommandOutput extends PutObjectOutput, __MetadataBeare
190190
* ChecksumSHA1: "STRING_VALUE",
191191
* ChecksumSHA256: "STRING_VALUE",
192192
* Expires: new Date("TIMESTAMP"),
193+
* IfNoneMatch: "STRING_VALUE",
193194
* GrantFullControl: "STRING_VALUE",
194195
* GrantRead: "STRING_VALUE",
195196
* GrantReadACP: "STRING_VALUE",

‎clients/client-s3/src/commands/RestoreObjectCommand.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ export interface RestoreObjectCommandOutput extends RestoreObjectOutput, __Metad
3333
* <note>
3434
* <p>This operation is not supported by directory buckets.</p>
3535
* </note>
36+
* <important>
37+
* <p>The <code>SELECT</code> job type for the RestoreObject operation is no longer available to new customers. Existing customers of Amazon S3 Select can continue to use the feature as usual. <a href="http://aws.amazon.com/blogs/storage/how-to-optimize-querying-your-data-in-amazon-s3/">Learn more</a>
38+
* </p>
39+
* </important>
3640
* <p>Restores an archived copy of an object back into Amazon S3</p>
3741
* <p>This functionality is not supported for Amazon S3 on Outposts.</p>
3842
* <p>This action performs the following types of requests: </p>

‎clients/client-s3/src/commands/SelectObjectContentCommand.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ export interface SelectObjectContentCommandOutput extends SelectObjectContentOut
3838
* <note>
3939
* <p>This operation is not supported by directory buckets.</p>
4040
* </note>
41+
* <important>
42+
* <p>The SelectObjectContent operation is no longer available to new customers. Existing customers of Amazon S3 Select can continue to use the operation as usual. <a href="http://aws.amazon.com/blogs/storage/how-to-optimize-querying-your-data-in-amazon-s3/">Learn more</a>
43+
* </p>
44+
* </important>
4145
* <p>This action filters the contents of an Amazon S3 object based on a simple structured query
4246
* language (SQL) statement. In the request, along with the SQL expression, you must also
4347
* specify a data serialization format (JSON, CSV, or Apache Parquet) of the object. Amazon S3 uses

‎clients/client-s3/src/commands/UploadPartCommand.ts

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,21 @@ export interface UploadPartCommandOutput extends UploadPartOutput, __MetadataBea
7676
* <ul>
7777
* <li>
7878
* <p>
79-
* <b>General purpose bucket permissions</b> - For information on the permissions required to use the multipart upload API, see
80-
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html">Multipart
81-
* Upload and Permissions</a> in the <i>Amazon S3 User Guide</i>.</p>
79+
* <b>General purpose bucket permissions</b> - To
80+
* perform a multipart upload with encryption using an Key Management Service key, the
81+
* requester must have permission to the <code>kms:Decrypt</code> and
82+
* <code>kms:GenerateDataKey</code> actions on the key. The requester must
83+
* also have permissions for the <code>kms:GenerateDataKey</code> action for
84+
* the <code>CreateMultipartUpload</code> API. Then, the requester needs
85+
* permissions for the <code>kms:Decrypt</code> action on the
86+
* <code>UploadPart</code> and <code>UploadPartCopy</code> APIs.</p>
87+
* <p>These permissions are required because Amazon S3 must decrypt and read data
88+
* from the encrypted file parts before it completes the multipart upload. For
89+
* more information about KMS permissions, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html">Protecting data
90+
* using server-side encryption with KMS</a> in the
91+
* <i>Amazon S3 User Guide</i>. For information about the
92+
* permissions required to use the multipart upload API, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html">Multipart upload and permissions</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html#mpuAndPermissions">Multipart upload API and permissions</a> in the
93+
* <i>Amazon S3 User Guide</i>.</p>
8294
* </li>
8395
* <li>
8496
* <p>

‎clients/client-s3/src/commands/UploadPartCopyCommand.ts

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -76,23 +76,44 @@ export interface UploadPartCopyCommandOutput extends UploadPartCopyOutput, __Met
7676
* <ul>
7777
* <li>
7878
* <p>
79-
* <b>General purpose bucket permissions</b> - You must have the permissions in a policy based on the bucket types of your source bucket and destination bucket in an <code>UploadPartCopy</code> operation.</p>
79+
* <b>General purpose bucket permissions</b> - You
80+
* must have the permissions in a policy based on the bucket types of your
81+
* source bucket and destination bucket in an <code>UploadPartCopy</code>
82+
* operation.</p>
8083
* <ul>
8184
* <li>
82-
* <p>If the source object is in a general purpose bucket, you must have the <b>
85+
* <p>If the source object is in a general purpose bucket, you must have the
86+
* <b>
8387
* <code>s3:GetObject</code>
84-
* </b> permission to read the source object that is being copied. </p>
88+
* </b>
89+
* permission to read the source object that is being copied. </p>
8590
* </li>
8691
* <li>
87-
* <p>If the destination bucket is a general purpose bucket, you must have the <b>
92+
* <p>If the destination bucket is a general purpose bucket, you must have the
93+
* <b>
8894
* <code>s3:PutObject</code>
89-
* </b> permission to write the object copy to the destination bucket.
90-
* </p>
95+
* </b>
96+
* permission to write the object copy to the destination bucket. </p>
97+
* </li>
98+
* <li>
99+
* <p>To perform a multipart upload with encryption using an Key Management Service
100+
* key, the requester must have permission to the
101+
* <code>kms:Decrypt</code> and <code>kms:GenerateDataKey</code>
102+
* actions on the key. The requester must also have permissions for the
103+
* <code>kms:GenerateDataKey</code> action for the
104+
* <code>CreateMultipartUpload</code> API. Then, the requester needs
105+
* permissions for the <code>kms:Decrypt</code> action on the
106+
* <code>UploadPart</code> and <code>UploadPartCopy</code> APIs. These
107+
* permissions are required because Amazon S3 must decrypt and read data from
108+
* the encrypted file parts before it completes the multipart upload. For
109+
* more information about KMS permissions, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html">Protecting
110+
* data using server-side encryption with KMS</a> in the
111+
* <i>Amazon S3 User Guide</i>. For information about the
112+
* permissions required to use the multipart upload API, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html">Multipart upload
113+
* and permissions</a> and <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html#mpuAndPermissions">Multipart upload API and permissions</a> in the
114+
* <i>Amazon S3 User Guide</i>.</p>
91115
* </li>
92116
* </ul>
93-
* <p>For information about permissions required to use the multipart upload API, see
94-
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html#mpuAndPermissions">Multipart upload API and permissions</a> in the
95-
* <i>Amazon S3 User Guide</i>.</p>
96117
* </li>
97118
* <li>
98119
* <p>

‎clients/client-s3/src/models/models_0.ts

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -714,6 +714,15 @@ export interface CompleteMultipartUploadRequest {
714714
*/
715715
ExpectedBucketOwner?: string;
716716

717+
/**
718+
* <p>Uploads the object only if the object key name does not already exist in the bucket specified. Otherwise, Amazon S3 returns a <code>412 Precondition Failed</code> error.</p>
719+
* <p>If a conflicting operation occurs during the upload S3 returns a <code>409 ConditionalRequestConflict</code> response. On a 409 failure you should re-initiate the multipart upload with <code>CreateMultipartUpload</code> and re-upload each part.</p>
720+
* <p>Expects the '*' (asterisk) character.</p>
721+
* <p>For more information about conditional requests, see <a href="https://tools.ietf.org/html/rfc7232">RFC 7232</a>, or <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/conditional-requests.html">Conditional requests</a> in the <i>Amazon S3 User Guide</i>.</p>
722+
* @public
723+
*/
724+
IfNoneMatch?: string;
725+
717726
/**
718727
* <p>The server-side encryption (SSE) algorithm used to encrypt the object. This parameter is
719728
* required only when the object was created using a checksum algorithm or if
@@ -9513,6 +9522,10 @@ export interface GetObjectRequest {
95139522

95149523
/**
95159524
* <p>To retrieve the checksum, this mode must be enabled.</p>
9525+
* <p>In addition, if you enable checksum mode and the object is uploaded with a
9526+
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_Checksum.html">checksum</a>
9527+
* and encrypted with an Key Management Service (KMS) key, you must have permission to use the
9528+
* <code>kms:Decrypt</code> action to retrieve the checksum.</p>
95169529
* @public
95179530
*/
95189531
ChecksumMode?: ChecksumMode;
@@ -11236,9 +11249,10 @@ export interface HeadObjectRequest {
1123611249

1123711250
/**
1123811251
* <p>To retrieve the checksum, this parameter must be enabled.</p>
11239-
* <p>In addition, if you enable <code>ChecksumMode</code> and the object is encrypted with
11240-
* Amazon Web Services Key Management Service (Amazon Web Services KMS), you must have permission to use the
11241-
* <code>kms:Decrypt</code> action for the request to succeed.</p>
11252+
* <p>In addition, if you enable checksum mode and the object is uploaded with a
11253+
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_Checksum.html">checksum</a>
11254+
* and encrypted with an Key Management Service (KMS) key, you must have permission to use the
11255+
* <code>kms:Decrypt</code> action to retrieve the checksum.</p>
1124211256
* @public
1124311257
*/
1124411258
ChecksumMode?: ChecksumMode;

0 commit comments

Comments
 (0)