Class: Aws::S3::Types::CreateSessionRequest

Inherits:
Struct
  • Object
show all
Includes:
Aws::Structure
Defined in:
lib/aws-sdk-s3/types.rb

Overview

See Also:

Constant Summary collapse

SENSITIVE = 
[:ssekms_key_id, :ssekms_encryption_context]

Instance Attribute Summary collapse

Instance Attribute Details

#bucket ⇒ String

The name of the bucket that you create a session for.

Returns:

  • (String) 


3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
 
# File 'lib/aws-sdk-s3/types.rb', line 3660

class CreateSessionRequest < Struct.new(
  :session_mode,
  :bucket,
  :server_side_encryption,
  :ssekms_key_id,
  :ssekms_encryption_context,
  :bucket_key_enabled)
  SENSITIVE = [:ssekms_key_id, :ssekms_encryption_context]
  include Aws::Structure
end

#bucket_key_enabled ⇒ Boolean

Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using KMS keys (SSE-KMS).

S3 Bucket Keys are always enabled for ‘GET` and `PUT` operations in a directory bucket and can’t be disabled. S3 Bucket Keys aren’t supported, when you copy SSE-KMS encrypted objects from general purpose buckets to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through [CopyObject], [UploadPartCopy], [the Copy operation in Batch Operations], or [the import jobs]. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.

[1]: docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html [2]: docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPartCopy.html [3]: docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-objects-Batch-Ops [4]: docs.aws.amazon.com/AmazonS3/latest/userguide/create-import-job

Returns:

  • (Boolean) 


3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
 
# File 'lib/aws-sdk-s3/types.rb', line 3660

class CreateSessionRequest < Struct.new(
  :session_mode,
  :bucket,
  :server_side_encryption,
  :ssekms_key_id,
  :ssekms_encryption_context,
  :bucket_key_enabled)
  SENSITIVE = [:ssekms_key_id, :ssekms_encryption_context]
  include Aws::Structure
end

#server_side_encryption ⇒ String

The server-side encryption algorithm to use when you store objects in the directory bucket.

For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (‘AES256`) and server-side encryption with KMS keys (SSE-KMS) (`aws:kms`). By default, Amazon S3 encrypts data with SSE-S3. For more information, see [Protecting data with server-side encryption] in the *Amazon S3 User Guide*.

[1]: docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-serv-side-encryption.html

Returns:

  • (String) 


3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
 
# File 'lib/aws-sdk-s3/types.rb', line 3660

class CreateSessionRequest < Struct.new(
  :session_mode,
  :bucket,
  :server_side_encryption,
  :ssekms_key_id,
  :ssekms_encryption_context,
  :bucket_key_enabled)
  SENSITIVE = [:ssekms_key_id, :ssekms_encryption_context]
  include Aws::Structure
end

#session_mode ⇒ String

Specifies the mode of the session that will be created, either ‘ReadWrite` or `ReadOnly`. By default, a `ReadWrite` session is created. A `ReadWrite` session is capable of executing all the Zonal endpoint API operations on a directory bucket. A `ReadOnly` session is constrained to execute the following Zonal endpoint API operations: `GetObject`, `HeadObject`, `ListObjectsV2`, `GetObjectAttributes`, `ListParts`, and `ListMultipartUploads`.

Returns:

  • (String) 


3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
 
# File 'lib/aws-sdk-s3/types.rb', line 3660

class CreateSessionRequest < Struct.new(
  :session_mode,
  :bucket,
  :server_side_encryption,
  :ssekms_key_id,
  :ssekms_encryption_context,
  :bucket_key_enabled)
  SENSITIVE = [:ssekms_key_id, :ssekms_encryption_context]
  include Aws::Structure
end

#ssekms_encryption_context ⇒ String

Specifies the Amazon Web Services KMS Encryption Context as an additional encryption context to use for object encryption. The value of this header is a Base64-encoded string of a UTF-8 encoded JSON, which contains the encryption context as key-value pairs. This value is stored as object metadata and automatically gets passed on to Amazon Web Services KMS for future ‘GetObject` operations on this object.

**General purpose buckets** - This value must be explicitly added during ‘CopyObject` operations if you want an additional encryption context for your object. For more information, see [Encryption context] in the *Amazon S3 User Guide*.

**Directory buckets** - You can optionally provide an explicit encryption context value. The value must match the default encryption context - the bucket Amazon Resource Name (ARN). An additional encryption context value is not supported.

[1]: docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html#encryption-context

Returns:

  • (String) 


3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
 
# File 'lib/aws-sdk-s3/types.rb', line 3660

class CreateSessionRequest < Struct.new(
  :session_mode,
  :bucket,
  :server_side_encryption,
  :ssekms_key_id,
  :ssekms_encryption_context,
  :bucket_key_enabled)
  SENSITIVE = [:ssekms_key_id, :ssekms_encryption_context]
  include Aws::Structure
end

#ssekms_key_id ⇒ String

If you specify ‘x-amz-server-side-encryption` with `aws:kms`, you must specify the ` x-amz-server-side-encryption-aws-kms-key-id` header with the ID (Key ID or Key ARN) of the KMS symmetric encryption customer managed key to use. Otherwise, you get an HTTP `400 Bad Request` error. Only use the key ID or key ARN. The key alias format of the KMS key isn’t supported. Also, if the KMS key doesn’t exist in the same account that’t issuing the command, you must use the full Key ARN not the Key ID.

Your SSE-KMS configuration can only support 1 [customer managed key] per directory bucket for the lifetime of the bucket. The

Amazon Web Services managed key][2

(‘aws/s3`) isn’t supported.

[1]: docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk [2]: docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk

Returns:

  • (String) 


3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
 
# File 'lib/aws-sdk-s3/types.rb', line 3660

class CreateSessionRequest < Struct.new(
  :session_mode,
  :bucket,
  :server_side_encryption,
  :ssekms_key_id,
  :ssekms_encryption_context,
  :bucket_key_enabled)
  SENSITIVE = [:ssekms_key_id, :ssekms_encryption_context]
  include Aws::Structure
end