Skip to content

Commit 99546b9

Browse files
author
AWS
committed
AWS S3 Control Update: Introduce three new encryption filters: EncryptionType (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C, NOT-SSE), KmsKeyArn (for SSE-KMS and DSSE-KMS), and BucketKeyEnabled (for SSE-KMS).
1 parent 159d9f0 commit 99546b9

File tree

2 files changed

+100
-1
lines changed

2 files changed

+100
-1
lines changed

‎.changes/next-release/feature-AWSS3Control-74d6663.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "AWS S3 Control",
4+
"contributor": "",
5+
"description": "Introduce three new encryption filters: EncryptionType (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C, NOT-SSE), KmsKeyArn (for SSE-KMS and DSSE-KMS), and BucketKeyEnabled (for SSE-KMS)."
6+
}

‎services/s3control/src/main/resources/codegen-resources/service-2.json‎

Lines changed: 94 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2791,6 +2791,17 @@
27912791
"documentation":"<p>The Amazon Web Services Security Token Service temporary credential that S3 Access Grants vends to grantees and client applications. </p>",
27922792
"sensitive":true
27932793
},
2794+
"DSSEKMSFilter":{
2795+
"type":"structure",
2796+
"members":{
2797+
"KmsKeyArn":{
2798+
"shape":"NonEmptyKmsKeyArnString",
2799+
"documentation":"<p>The Amazon Resource Name (ARN) of the customer managed KMS key to use for the filter to return objects that are encrypted by the specified key. For best performance, we recommend using the <code>KMSKeyArn</code> filter in conjunction with other object metadata filters, like <code>MatchAnyPrefix</code>, <code>CreatedAfter</code>, or <code>MatchAnyStorageClass</code>.</p> <note> <p>You must provide the full KMS Key ARN. You can't use an alias name or alias ARN. For more information, see <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN\"> KMS keys</a> in the <i>Amazon Web Services Key Management Service Developer Guide</i>.</p> </note>",
2800+
"box":true
2801+
}
2802+
},
2803+
"documentation":"<p>A filter that returns objects that are encrypted by dual-layer server-side encryption with Amazon Web Services Key Management Service (KMS) keys (DSSE-KMS). You can further refine your filtering by optionally providing a KMS Key ARN to create an object list of DSSE-KMS objects with that specific KMS Key ARN.</p>"
2804+
},
27942805
"DataSourceId":{
27952806
"type":"string",
27962807
"max":191
@@ -4978,6 +4989,10 @@
49784989
"MatchAnyStorageClass":{
49794990
"shape":"StorageClassList",
49804991
"documentation":"<p>If provided, the generated manifest includes only source bucket objects that are stored with the specified storage class.</p>"
4992+
},
4993+
"MatchAnyObjectEncryption":{
4994+
"shape":"ObjectEncryptionFilterList",
4995+
"documentation":"<p>If provided, the generated object list includes only source bucket objects with the indicated server-side encryption type (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C, or NOT-SSE). If you select SSE-KMS or DSSE-KMS, you can optionally further filter your results by specifying a specific KMS Key ARN. If you select SSE-KMS, you can also optionally further filter your results by Bucket Key enabled status.</p>"
49814996
}
49824997
},
49834998
"documentation":"<p>The filter used to describe a set of objects for the job's manifest.</p>"
@@ -5310,7 +5325,7 @@
53105325
},
53115326
"NoncurrentVersionTransitions":{
53125327
"shape":"NoncurrentVersionTransitionList",
5313-
"documentation":"<p> Specifies the transition rule for the lifecycle rule that describes when noncurrent objects transition to a specific storage class. If your bucket is versioning-enabled (or versioning is suspended), you can set this action to request that Amazon S3 transition noncurrent object versions to a specific storage class at a set period in the object's lifetime. </p> <note> <p>This is not supported by Amazon S3 on Outposts buckets.</p> </note>"
5328+
"documentation":"<p> Specifies the transition rule for the lifecycle rule that describes when non-current objects transition to a specific storage class. If your bucket is versioning-enabled (or versioning is suspended), you can set this action to request that Amazon S3 transition noncurrent object versions to a specific storage class at a set period in the object's lifetime. </p> <note> <p>This is not supported by Amazon S3 on Outposts buckets.</p> </note>"
53145329
},
53155330
"NoncurrentVersionExpiration":{
53165331
"shape":"NoncurrentVersionExpiration",
@@ -6379,6 +6394,12 @@
63796394
"exception":true
63806395
},
63816396
"NoSuchPublicAccessBlockConfigurationMessage":{"type":"string"},
6397+
"NonEmptyKmsKeyArnString":{
6398+
"type":"string",
6399+
"max":2000,
6400+
"min":1,
6401+
"pattern":"arn:aws[a-zA-Z0-9-]*:kms:[a-z0-9-]+:[0-9]{12}:key/[a-zA-Z0-9-]+"
6402+
},
63826403
"NonEmptyMaxLength1024String":{
63836404
"type":"string",
63846405
"max":1024,
@@ -6448,8 +6469,54 @@
64486469
"documentation":"<p/>",
64496470
"exception":true
64506471
},
6472+
"NotSSEFilter":{
6473+
"type":"structure",
6474+
"members":{},
6475+
"documentation":"<p>A filter that returns objects that aren't server-side encrypted.</p>"
6476+
},
64516477
"ObjectAgeValue":{"type":"integer"},
64526478
"ObjectCreationTime":{"type":"timestamp"},
6479+
"ObjectEncryptionFilter":{
6480+
"type":"structure",
6481+
"members":{
6482+
"SSES3":{
6483+
"shape":"SSES3Filter",
6484+
"documentation":"<p>Filters for objects that are encrypted by server-side encryption with Amazon S3 managed keys (SSE-S3).</p>",
6485+
"locationName":"SSE-S3"
6486+
},
6487+
"SSEKMS":{
6488+
"shape":"SSEKMSFilter",
6489+
"documentation":"<p>Filters for objects that are encrypted by server-side encryption with Amazon Web Services Key Management Service (KMS) keys (SSE-KMS).</p>",
6490+
"locationName":"SSE-KMS"
6491+
},
6492+
"DSSEKMS":{
6493+
"shape":"DSSEKMSFilter",
6494+
"documentation":"<p>Filters for objects that are encrypted by dual-layer server-side encryption with Amazon Web Services Key Management Service (KMS) keys (DSSE-KMS).</p>",
6495+
"locationName":"DSSE-KMS"
6496+
},
6497+
"SSEC":{
6498+
"shape":"SSECFilter",
6499+
"documentation":"<p>Filters for objects that are encrypted by server-side encryption with customer-provided keys (SSE-C).</p>",
6500+
"locationName":"SSE-C"
6501+
},
6502+
"NOTSSE":{
6503+
"shape":"NotSSEFilter",
6504+
"documentation":"<p>Filters for objects that are not encrypted by server-side encryption. </p>",
6505+
"locationName":"NOT-SSE"
6506+
}
6507+
},
6508+
"documentation":"<p>An optional filter for the <code>S3JobManifestGenerator</code> that identifies the subset of objects by encryption type. This filter is used to create an object list for S3 Batch Operations jobs. If provided, this filter will generate an object list that only includes objects with the specified encryption type.</p>",
6509+
"union":true
6510+
},
6511+
"ObjectEncryptionFilterList":{
6512+
"type":"list",
6513+
"member":{
6514+
"shape":"ObjectEncryptionFilter",
6515+
"locationName":"ObjectEncryption"
6516+
},
6517+
"max":1,
6518+
"min":1
6519+
},
64536520
"ObjectLambdaAccessPoint":{
64546521
"type":"structure",
64556522
"required":["Name"],
@@ -8178,6 +8245,11 @@
81788245
"value":{"shape":"MaxLength1024String"},
81798246
"max":8192
81808247
},
8248+
"SSECFilter":{
8249+
"type":"structure",
8250+
"members":{},
8251+
"documentation":"<p>A filter that returns objects that are encrypted by server-side encryption with customer-provided keys (SSE-C).</p>"
8252+
},
81818253
"SSEKMS":{
81828254
"type":"structure",
81838255
"required":["KeyId"],
@@ -8202,6 +8274,22 @@
82028274
"documentation":"<p>Configuration for the use of SSE-KMS to encrypt generated manifest objects.</p>",
82038275
"locationName":"SSE-KMS"
82048276
},
8277+
"SSEKMSFilter":{
8278+
"type":"structure",
8279+
"members":{
8280+
"KmsKeyArn":{
8281+
"shape":"NonEmptyKmsKeyArnString",
8282+
"documentation":"<p>The Amazon Resource Name (ARN) of the customer managed KMS key to use for the filter to return objects that are encrypted by the specified key. For best performance, we recommend using the <code>KMSKeyArn</code> filter in conjunction with other object metadata filters, like <code>MatchAnyPrefix</code>, <code>CreatedAfter</code>, or <code>MatchAnyStorageClass</code>.</p> <note> <p>You must provide the full KMS Key ARN. You can't use an alias name or alias ARN. For more information, see <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN\"> KMS keys</a> in the <i>Amazon Web Services Key Management Service Developer Guide</i>.</p> </note>",
8283+
"box":true
8284+
},
8285+
"BucketKeyEnabled":{
8286+
"shape":"Boolean",
8287+
"documentation":"<p>Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Amazon Web Services Key Management Service (Amazon Web Services KMS) keys (SSE-KMS). If specified, will filter SSE-KMS encrypted objects by S3 Bucket Key status. For more information, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html\">Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys</a> in the <i>Amazon S3 User Guide</i>.</p>",
8288+
"box":true
8289+
}
8290+
},
8291+
"documentation":"<p>A filter that returns objects that are encrypted by server-side encryption with Amazon Web Services KMS (SSE-KMS).</p>"
8292+
},
82058293
"SSEKMSKeyId":{"type":"string"},
82068294
"SSES3":{
82078295
"type":"structure",
@@ -8215,6 +8303,11 @@
82158303
"documentation":"<p>Configuration for the use of SSE-S3 to encrypt generated manifest objects.</p>",
82168304
"locationName":"SSE-S3"
82178305
},
8306+
"SSES3Filter":{
8307+
"type":"structure",
8308+
"members":{},
8309+
"documentation":"<p>A filter that returns objects that are encrypted by server-side encryption with Amazon S3 managed keys (SSE-S3).</p>"
8310+
},
82188311
"Scope":{
82198312
"type":"structure",
82208313
"members":{

0 commit comments

Comments
 (0)