# Developing with Amazon S3 This section covers developer-related topics for using Amazon S3. For more information, review the topics below. **Topics** + [ # Making requests ](MakingRequests.md) + [ # Developing with Amazon S3 using the AWS CLI ](setup-aws-cli.md) + [ # Developing with Amazon S3 using the AWS SDKs ](sdk-general-information-section.md) + [ # Getting Amazon S3 request IDs for AWS Support ](get-request-ids.md) + [ # Supported Amazon S3 object-level API operations for S3 Tables ](developing-s3-tables-APIs.md) # Making requests Amazon S3 is a REST service. You can send requests to Amazon S3 using the REST API or the AWS SDK (see [Sample Code and Libraries](https://aws.amazon.com/code)) wrapper libraries that wrap the underlying Amazon S3 REST API, simplifying your programming tasks. Every interaction with Amazon S3 is either authenticated or anonymous. Authentication is a process of verifying the identity of the requester trying to access an Amazon Web Services (AWS) product. Authenticated requests must include a signature value that authenticates the request sender. The signature value is, in part, generated from the requester's AWS access keys (access key ID and secret access key). For more information about getting access keys, see [How Do I Get Security Credentials?](https://docs.aws.amazon.com/general/latest/gr/getting-aws-sec-creds.html) in the *AWS General Reference*. If you are using the AWS SDK, the libraries compute the signature from the keys you provide. However, if you make direct REST API calls in your application, you must write the code to compute the signature and add it to the request. **Topics** + [ ## About access keys ](#TypesofSecurityCredentials) + [ ## Request endpoints ](#RequestEndpoints) + [ # Making requests to Amazon S3 over IPv6 ](ipv6-access.md) + [ # Making requests using the AWS SDKs ](MakingAuthenticatedRequests.md) + [ # Making requests using the REST API ](RESTAPI.md) ## About access keys The following sections review the types of access keys that you can use to make authenticated requests. ### AWS account access keys The account access keys provide full access to the AWS resources owned by the account. The following are examples of access keys: + Access key ID (a 20-character, alphanumeric string). For example: AKIAIOSFODNN7EXAMPLE + Secret access key (a 40-character string). For example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY The access key ID uniquely identifies an AWS account. You can use these access keys to send authenticated requests to Amazon S3. ### IAM user access keys You can create one AWS account for your company; however, there may be several employees in the organization who need access to your organization's AWS resources. Sharing your AWS account access keys reduces security, and creating individual AWS accounts for each employee might not be practical. Also, you cannot easily share resources such as buckets and objects because they are owned by different accounts. To share resources, you must grant permissions, which is additional work. In such scenarios, you can use AWS Identity and Access Management (IAM) to create users under your AWS account with their own access keys and attach IAM user policies that grant appropriate resource access permissions to these users. To better manage these users, IAM enables you to create groups of users and grant group-level permissions that apply to all users in that group. These users are referred to as IAM users that you create and manage within AWS. The parent account controls a user's ability to access AWS. Any resources an IAM user creates are under the control of and paid for by the parent AWS account. These IAM users can send authenticated requests to Amazon S3 using their own security credentials. For more information about creating and managing users under your AWS account, go to the [AWS Identity and Access Management product details page](https://aws.amazon.com/iam/). ### Temporary security credentials In addition to creating IAM users with their own access keys, IAM also enables you to grant temporary security credentials (temporary access keys and a security token) to any IAM user to enable them to access your AWS services and resources. You can also manage users in your system outside AWS. These are referred to as federated users. Additionally, users can be applications that you create to access your AWS resources. IAM provides the AWS Security Token Service API for you to request temporary security credentials. You can use either the AWS STS API or the AWS SDK to request these credentials. The API returns temporary security credentials (access key ID and secret access key), and a security token. These credentials are valid only for the duration you specify when you request them. You use the access key ID and secret key the same way you use them when sending requests using your AWS account or IAM user access keys. In addition, you must include the token in each request you send to Amazon S3. An IAM user can request these temporary security credentials for their own use or hand them out to federated users or applications. When requesting temporary security credentials for federated users, you must provide a user name and an IAM policy defining the permissions you want to associate with these temporary security credentials. The federated user cannot get more permissions than the parent IAM user who requested the temporary credentials. You can use these temporary security credentials in making requests to Amazon S3. The API libraries compute the necessary signature value using those credentials to authenticate your request. If you send requests using expired credentials, Amazon S3 denies the request. For information on signing requests using temporary security credentials in your REST API requests, see [Signing and authenticating REST requests (AWS signature version 2)](RESTAuthentication.md). For information about sending requests using AWS SDKs, see [Making requests using the AWS SDKs](MakingAuthenticatedRequests.md). For more information about IAM support for temporary security credentials, see [Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) in the *IAM User Guide*. For added security, you can require multifactor authentication (MFA) when accessing your Amazon S3 resources by configuring a bucket policy. For information, see [Example bucket policies: Requiring MFA ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-MFA). After you require MFA to access your Amazon S3 resources, the only way you can access these resources is by providing temporary credentials that are created with an MFA key. For more information, see the [AWS Multi-Factor Authentication](https://aws.amazon.com/mfa/) detail page and [Configuring MFA-Protected API Access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html) in the *IAM User Guide*. ## Request endpoints You send REST requests to the service's predefined endpoint. For a list of all AWS services and their corresponding endpoints, go to [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html) in the *AWS General Reference*. # Making requests to Amazon S3 over IPv6 Amazon Simple Storage Service (Amazon S3) supports the ability to access S3 buckets using the Internet Protocol version 6 (IPv6), in addition to the IPv4 protocol. Amazon S3 dual-stack endpoints support requests to S3 buckets over IPv6 and IPv4. There are no additional charges for accessing Amazon S3 over IPv6. For more information about pricing, see [Amazon S3 Pricing](https://aws.amazon.com/s3/pricing/). **Note** The following information is for public Amazon S3 IPv6 endpoints. For information about AWS Virtual Private Cloud (VPC) endpoints, refer to [AWS PrivateLink for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html). **Topics** + [ ## Getting started making requests over IPv6 ](#ipv6-access-getting-started) + [ ## Using IPv6 addresses in IAM policies ](#ipv6-access-iam) + [ ## Testing IP address compatibility ](#ipv6-access-test-compatabilty) + [ # Using Amazon S3 dual-stack endpoints ](dual-stack-endpoints.md) ## Getting started making requests over IPv6 To make a request to an S3 bucket over IPv6, you need to use a dual-stack endpoint. The next section describes how to make requests over IPv6 by using dual-stack endpoints. The following are some things you should know before trying to access a bucket over IPv6: + The client and the network accessing the bucket must be enabled to use IPv6. + Both virtual hosted-style and path style requests are supported for IPv6 access. For more information, see [Amazon S3 dual-stack endpoints](dual-stack-endpoints.md#dual-stack-endpoints-description). + If you use source IP address filtering in your AWS Identity and Access Management (IAM) user or bucket policies, you need to update the policies to include IPv6 address ranges. For more information, see [Using IPv6 addresses in IAM policies](#ipv6-access-iam). + When using IPv6, server access log files output IP addresses in an IPv6 format. You need to update existing tools, scripts, and software that you use to parse Amazon S3 log files so that they can parse the IPv6 formatted `Remote IP` addresses. For more information, see [Logging requests with server access logging ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/ServerLogs.html). **Note** If you experience issues related to the presence of IPv6 addresses in log files, contact [AWS Support](https://aws.amazon.com/premiumsupport/). ### Making requests over IPv6 by using dual-stack endpoints You make requests with Amazon S3 API calls over IPv6 by using dual-stack endpoints. The Amazon S3 API operations work the same way whether you're accessing Amazon S3 over IPv6 or over IPv4. Performance should be the same too. When using the REST API, you access a dual-stack endpoint directly. For more information, see [Dual-stack endpoints](dual-stack-endpoints.md#dual-stack-endpoints-description). When using the AWS Command Line Interface (AWS CLI) and AWS SDKs, you can use a parameter or flag to change to a dual-stack endpoint. You can also specify the dual-stack endpoint directly as an override of the Amazon S3 endpoint in the config file. You can use a dual-stack endpoint to access a bucket over IPv6 from any of the following: + The AWS CLI, see [Using dual-stack endpoints from the AWS CLI](dual-stack-endpoints.md#dual-stack-endpoints-cli). + The AWS SDKs, see [Using dual-stack endpoints from the AWS SDKs](dual-stack-endpoints.md#dual-stack-endpoints-sdks). + The REST API, see [Making requests to dual-stack endpoints by using the REST API](RESTAPI.md#rest-api-dual-stack). ### Features not available over IPv6 The following feature is currently not supported when accessing an S3 bucket over IPv6: Static website hosting from an S3 bucket. ## Using IPv6 addresses in IAM policies Before trying to access a bucket using IPv6, you must ensure that any IAM user or S3 bucket polices that are used for IP address filtering are updated to include IPv6 address ranges. IP address filtering policies that are not updated to handle IPv6 addresses may result in clients incorrectly losing or gaining access to the bucket when they start using IPv6. For more information about managing access permissions with IAM, see [Identity and Access Management for Amazon S3](https://docs.aws.amazon.com//AmazonS3/latest/userguide/security-iam.html) . IAM policies that filter IP addresses use [IP Address Condition Operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Conditions_IPAddress). The following bucket policy identifies the 54.240.143.\$1 range of allowed IPv4 addresses by using IP address condition operators. Any IP addresses outside of this range will be denied access to the bucket (`examplebucket`). Since all IPv6 addresses are outside of the allowed range, this policy prevents IPv6 addresses from being able to access `examplebucket`. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": "*", "Action": "s3:*", "Resource": "arn:aws:s3:::examplebucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "54.240.143.0/24"} } } ] } ``` ------ You can modify the bucket policy's `Condition` element to allow both IPv4 (`54.240.143.0/24`) and IPv6 (`2001:DB8:1234:5678::/64`) address ranges as shown in the following example. You can use the same type of `Condition` block shown in the example to update both your IAM user and bucket policies. ``` 1. "Condition": { 2. "IpAddress": { 3. "aws:SourceIp": [ 4. "54.240.143.0/24", 5. "2001:DB8:1234:5678::/64" 6. ] 7. } 8. } ``` Before using IPv6 you must update all relevant IAM user and bucket policies that use IP address filtering. We do not recommend using IP address filterig in bucket policies. You can review your IAM user policies using the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). For more information about IAM, see the [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/). For information about editing S3 bucket policies, see [Adding a bucket policy](https://docs.aws.amazon.com//AmazonS3/latest/userguide/add-bucket-policy.html). ## Testing IP address compatibility If you are using use Linux/Unix or Mac OS X, you can test whether you can access a dual-stack endpoint over IPv6 by using the `curl` command as shown in the following example: **Example** ``` curl -v http://s3.dualstack.us-west-2.amazonaws.com/ ``` You get back information similar to the following example. If you are connected over IPv6 the connected IP address will be an IPv6 address. ``` * About to connect() to s3-us-west-2.amazonaws.com port 80 (#0) * Trying IPv6 address... connected * Connected to s3.dualstack.us-west-2.amazonaws.com (IPv6 address) port 80 (#0) > GET / HTTP/1.1 > User-Agent: curl/7.18.1 (x86_64-unknown-linux-gnu) libcurl/7.18.1 OpenSSL/1.0.1t zlib/1.2.3 > Host: s3.dualstack.us-west-2.amazonaws.com ``` If you are using Microsoft Windows 7 or Windows 10, you can test whether you can access a dual-stack endpoint over IPv6 or IPv4 by using the `ping` command as shown in the following example. ``` ping ipv6.s3.dualstack.us-west-2.amazonaws.com ``` # Using Amazon S3 dual-stack endpoints Amazon S3 dual-stack endpoints support requests to S3 buckets over IPv6 and IPv4. This section describes how to use dual-stack endpoints. **Topics** + [ ## Amazon S3 dual-stack endpoints ](#dual-stack-endpoints-description) + [ ## Using dual-stack endpoints from the AWS CLI ](#dual-stack-endpoints-cli) + [ ## Using dual-stack endpoints from the AWS SDKs ](#dual-stack-endpoints-sdks) + [ ## Using dual-stack endpoints from the REST API ](#dual-stack-endpoints-examples-rest-api) ## Amazon S3 dual-stack endpoints When you make a request to a dual-stack endpoint, the bucket URL resolves to an IPv6 or an IPv4 address. For more information about accessing a bucket over IPv6, see [Making requests to Amazon S3 over IPv6](ipv6-access.md). When using the REST API, you directly access an Amazon S3 endpoint by using the endpoint name (URI). You can access an S3 bucket through a dual-stack endpoint by using a virtual hosted-style or a path-style endpoint name. Amazon S3 supports only regional dual-stack endpoint names, which means that you must specify the region as part of the name. Use the following naming conventions for the dual-stack virtual hosted-style and path-style endpoint names: + Virtual hosted-style dual-stack endpoint: *bucketname*.s3.dualstack.*aws-region*.amazonaws.com   + Path-style dual-stack endpoint: s3.dualstack.*aws-region*.amazonaws.com/*bucketname* For more information, about endpoint name style, see [Accessing and listing an Amazon S3 bucket ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/access-bucket-intro.html). For a list of Amazon S3 endpoints, see [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/s3.html) in the *AWS General Reference*. **Important** You can use transfer acceleration with dual-stack endpoints. For more information, see [Getting started with Amazon S3 Transfer Acceleration ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/transfer-acceleration-getting-started.html). **Note** The two types of Virtual Private Cloud (VPC) endpoints that access Amazon S3 (*Interface VPC endpoints* and *Gateway VPC endpoints*) now have dual-stack support. For more information about VPC endpoints for Amazon S3, see [AWS PrivateLink for Amazon S3 ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/privatelink-interface-endpoints.html). When using the AWS Command Line Interface (AWS CLI) and AWS SDKs, you can use a parameter or flag to change to a dual-stack endpoint. You can also specify the dual-stack endpoint directly as an override of the Amazon S3 endpoint in the config file. The following sections describe how to use dual-stack endpoints from the AWS CLI and the AWS SDKs. ## Using dual-stack endpoints from the AWS CLI This section provides examples of AWS CLI commands used to make requests to a dual-stack endpoint. For instructions on setting up the AWS CLI, see [Developing with Amazon S3 using the AWS CLI](setup-aws-cli.md). You set the configuration value `use_dualstack_endpoint` to `true` in a profile in your AWS Config file to direct all Amazon S3 requests made by the `s3` and `s3api` AWS CLI commands to the dual-stack endpoint for the specified region. You specify the region in the config file or in a command using the `--region` option. When using dual-stack endpoints with the AWS CLI, both `path` and `virtual` addressing styles are supported. The addressing style, set in the config file, controls if the bucket name is in the hostname or part of the URL. By default, the CLI will attempt to use virtual style where possible, but will fall back to path style if necessary. For more information, see [AWS CLI Amazon S3 Configuration](https://docs.aws.amazon.com/cli/latest/topic/s3-config.html). You can also make configuration changes by using a command, as shown in the following example, which sets `use_dualstack_endpoint` to `true` and `addressing_style` to `virtual` in the default profile. ``` $ aws configure set default.s3.use_dualstack_endpoint true $ aws configure set default.s3.addressing_style virtual ``` If you want to use a dual-stack endpoint for specified AWS CLI commands only (not all commands), you can use either of the following methods: + You can use the dual-stack endpoint per command by setting the `--endpoint-url` parameter to `https://s3.dualstack.aws-region.amazonaws.com` or `http://s3.dualstack.aws-region.amazonaws.com` for any `s3` or `s3api` command. ``` $ aws s3api list-objects --bucket bucketname --endpoint-url https://s3.dualstack.aws-region.amazonaws.com ``` + You can set up separate profiles in your AWS Config file. For example, create one profile that sets `use_dualstack_endpoint` to `true` and a profile that does not set `use_dualstack_endpoint`. When you run a command, specify which profile you want to use, depending upon whether or not you want to use the dual-stack endpoint. **Note** When using the AWS CLI you currently cannot use transfer acceleration with dual-stack endpoints. However, support for the AWS CLI is coming soon. For more information, see [Enabling and using S3 Transfer Acceleration ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/transfer-acceleration.html#transfer-acceleration-requirements). ## Using dual-stack endpoints from the AWS SDKs This section provides examples of how to access a dual-stack endpoint by using the AWS SDKs. ### AWS SDK for Java dual-stack endpoint example The following example shows how to enable dual-stack endpoints when creating an Amazon S3 client using the AWS SDK for Java. For instructions on creating and testing a working Java sample, see [Getting Started](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/getting-started.html) in the AWS SDK for Java Developer Guide. ``` import com.amazonaws.AmazonServiceException; import com.amazonaws.SdkClientException; import com.amazonaws.auth.profile.ProfileCredentialsProvider; import com.amazonaws.regions.Regions; import com.amazonaws.services.s3.AmazonS3; import com.amazonaws.services.s3.AmazonS3ClientBuilder; public class DualStackEndpoints { public static void main(String[] args) { Regions clientRegion = Regions.DEFAULT_REGION; String bucketName = "*** Bucket name ***"; try { // Create an Amazon S3 client with dual-stack endpoints enabled. AmazonS3 s3Client = AmazonS3ClientBuilder.standard() .withCredentials(new ProfileCredentialsProvider()) .withRegion(clientRegion) .withDualstackEnabled(true) .build(); s3Client.listObjects(bucketName); } catch (AmazonServiceException e) { // The call was transmitted successfully, but Amazon S3 couldn't process // it, so it returned an error response. e.printStackTrace(); } catch (SdkClientException e) { // Amazon S3 couldn't be contacted for a response, or the client // couldn't parse the response from Amazon S3. e.printStackTrace(); } } } ``` If you are using the AWS SDK for Java on Windows, you might have to set the following Java virtual machine (JVM) property: ``` java.net.preferIPv6Addresses=true ``` ### AWS .NET SDK dual-stack endpoint example When using the AWS SDK for .NET you use the `AmazonS3Config` class to enable the use of a dual-stack endpoint as shown in the following example. ``` using Amazon; using Amazon.S3; using Amazon.S3.Model; using System; using System.Threading.Tasks; namespace Amazon.DocSamples.S3 { class DualStackEndpointTest { private const string bucketName = "*** bucket name ***"; // Specify your bucket region (an example region is shown). private static readonly RegionEndpoint bucketRegion = RegionEndpoint.USWest2; private static IAmazonS3 client; public static void Main() { var config = new AmazonS3Config { UseDualstackEndpoint = true, RegionEndpoint = bucketRegion }; client = new AmazonS3Client(config); Console.WriteLine("Listing objects stored in a bucket"); ListingObjectsAsync().Wait(); } private static async Task ListingObjectsAsync() { try { var request = new ListObjectsV2Request { BucketName = bucketName, MaxKeys = 10 }; ListObjectsV2Response response; do { response = await client.ListObjectsV2Async(request); // Process the response. foreach (S3Object entry in response.S3Objects) { Console.WriteLine("key = {0} size = {1}", entry.Key, entry.Size); } Console.WriteLine("Next Continuation Token: {0}", response.NextContinuationToken); request.ContinuationToken = response.NextContinuationToken; } while (response.IsTruncated == true); } catch (AmazonS3Exception amazonS3Exception) { Console.WriteLine("An AmazonS3Exception was thrown. Exception: " + amazonS3Exception.ToString()); } catch (Exception e) { Console.WriteLine("Exception: " + e.ToString()); } } } } ``` For information about setting up and running the code examples, see [Getting Started with the AWS SDK for .NET](https://docs.aws.amazon.com/sdk-for-net/latest/developer-guide/net-dg-setup.html) in the *AWS SDK for .NET Developer Guide*. ## Using dual-stack endpoints from the REST API For information about making requests to dual-stack endpoints by using the REST API, see [Making requests to dual-stack endpoints by using the REST API](RESTAPI.md#rest-api-dual-stack). # Making requests using the AWS SDKs **Topics** + [ # Making requests using AWS account or IAM user credentials ](AuthUsingAcctOrUserCredentials.md) + [ # Making requests using IAM user temporary credentials ](AuthUsingTempSessionToken.md) + [ # Making requests using federated user temporary credentials ](AuthUsingTempFederationToken.md) You can send authenticated requests to Amazon S3 using either the AWS SDK or by making the REST API calls directly in your application. The AWS SDK API uses the credentials that you provide to compute the signature for authentication. If you use the REST API directly in your applications, you must write the necessary code to compute the signature for authenticating your request. For a list of available AWS SDKs go to, [Sample Code and Libraries](https://aws.amazon.com/code/). # Making requests using AWS account or IAM user credentials You can use your AWS account or IAM user security credentials to send authenticated requests to Amazon S3. This section provides examples of how you can send authenticated requests using the AWS SDK for Java, AWS SDK for .NET, and AWS SDK for PHP. For a list of available AWS SDKs, go to [Sample Code and Libraries](https://aws.amazon.com/code/). Each of these AWS SDKs uses an SDK-specific credentials provider chain to find and use credentials and perform actions on behalf of the credentials owner. What all these credentials provider chains have in common is that they all look for your local AWS credentials file. For more information, see the topics below: **Topics** + [ ## To create a local AWS credentials file ](#create-local-aws-credentials-file) + [ ## Sending authenticated requests using the AWS SDKs ](#send-authenticated-request-SDKs) ## To create a local AWS credentials file The easiest way to configure credentials for your AWS SDKs is to use an AWS credentials file. If you use the AWS Command Line Interface (AWS CLI), you may already have a local AWS credentials file configured. Otherwise, use the following procedure to set up a credentials file: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. Create a new user with permissions limited to the services and actions that you want your code to have access to. For more information about creating a new user, see [Creating IAM users (Console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html#id_users_create_console), and follow the instructions through step 8. 1. Choose **Download .csv** to save a local copy of your AWS credentials. 1. On your computer, navigate to your home directory, and create an `.aws` directory. On Unix-based systems, such as Linux or OS X, this is in the following location: ``` ~/.aws ``` On Windows, this is in the following location: ``` %HOMEPATH%\.aws ``` 1. In the `.aws` directory, create a new file named `credentials`. 1. Open the credentials `.csv` file that you downloaded from the IAM console, and copy its contents into the `credentials` file using the following format: ``` [default] aws_access_key_id = your_access_key_id aws_secret_access_key = your_secret_access_key ``` 1. Save the `credentials` file, and delete the `.csv` file that you downloaded in step 3. Your shared credentials file is now configured on your local computer, and it's ready to be used with the AWS SDKs. ## Sending authenticated requests using the AWS SDKs Use the AWS SDKs to send authenticated requests. For more information about sending authenticated requests, see [AWS security credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html) or [IAM Identity Center Authentication](https://docs.aws.amazon.com//sdkref/latest/guide/access-sso.html). ------ #### [ Java ] For information about authenticating requests using the AWS SDK for Java, see [Using shared config and credentials files to globally configure AWS SDKs and tools](https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html) and [Authentication and access using AWS SDKs and tools](https://docs.aws.amazon.com/sdkref/latest/guide/access.html) in the AWS SDKs and Tools Reference Guide. ------ #### [ .NET ] To send authenticated requests using your AWS account or IAM user credentials: + Create an instance of the `AmazonS3Client` class. + Run one of the `AmazonS3Client` methods to send requests to Amazon S3. The client generates the necessary signature from the credentials that you provide and includes it in the request it sends to Amazon S3. For more information, see [Making requests using AWS account or IAM user credentials ](https://docs.aws.amazon.com/AmazonS3/latest/userguide/AuthUsingAcctOrUserCredentials.html)>. **Note** You can create the `AmazonS3Client` client without providing your security credentials. Requests sent using this client are anonymous requests, without a signature. Amazon S3 returns an error if you send anonymous requests for a resource that is not publicly available. You can create an AWS account and create the required users. You can also manage credentials for those users. You need these credentials to perform the task in the following example. For more information, see [Configure AWS credentials](https://docs.aws.amazon.com/sdk-for-net/latest/developer-guide/net-dg-config-creds.html) in the *SDK for .NET Developer Guide*. You can then also configure your application to actively retrieve profiles and credentials, and then explicitly use those credentials when creating an AWS service client. For more information, see [Accessing credentials and profiles in an application](https://docs.aws.amazon.com/sdk-for-net/latest/developer-guide/creds-locate.html) in the *SDK for .NET Developer Guide*. The following C\$1 example shows how to perform the preceding tasks. For information about setting up and running the code examples, see [Getting Started with the AWS SDK for .NET](https://docs.aws.amazon.com/sdk-for-net/latest/developer-guide/net-dg-setup.html) in the *AWS SDK for .NET Developer Guide*. **Example** ``` using Amazon; using Amazon.S3; using Amazon.S3.Model; using System; using System.Threading.Tasks; namespace Amazon.DocSamples.S3 { class MakeS3RequestTest { private const string bucketName = "*** bucket name ***"; // Specify your bucket region (an example region is shown). private static readonly RegionEndpoint bucketRegion = RegionEndpoint.USWest2; private static IAmazonS3 client; public static void Main() { using (client = new AmazonS3Client(bucketRegion)) { Console.WriteLine("Listing objects stored in a bucket"); ListingObjectsAsync().Wait(); } } static async Task ListingObjectsAsync() { try { ListObjectsRequest request = new ListObjectsRequest { BucketName = bucketName, MaxKeys = 2 }; do { ListObjectsResponse response = await client.ListObjectsAsync(request); // Process the response. foreach (S3Object entry in response.S3Objects) { Console.WriteLine("key = {0} size = {1}", entry.Key, entry.Size); } // If the response is truncated, set the marker to get the next // set of keys. if (response.IsTruncated) { request.Marker = response.NextMarker; } else { request = null; } } while (request != null); } catch (AmazonS3Exception e) { Console.WriteLine("Error encountered on server. Message:'{0}' when writing an object", e.Message); } catch (Exception e) { Console.WriteLine("Unknown encountered on server. Message:'{0}' when writing an object", e.Message); } } } } ``` ------ #### [ PHP ] The following PHP example shows how the client makes a request using your security credentials to list all of the buckets for your account. **Example** ``` require 'vendor/autoload.php'; use Aws\S3\Exception\S3Exception; use Aws\S3\S3Client; $bucket = '*** Your Bucket Name ***'; $s3 = new S3Client([ 'region' => 'us-east-1', 'version' => 'latest', ]); // Retrieve the list of buckets. $result = $s3->listBuckets(); try { // Retrieve a paginator for listing objects. $objects = $s3->getPaginator('ListObjects', [ 'Bucket' => $bucket ]); echo "Keys retrieved!" . PHP_EOL; // Print the list of objects to the page. foreach ($objects as $object) { echo $object['Key'] . PHP_EOL; } } catch (S3Exception $e) { echo $e->getMessage() . PHP_EOL; } ``` **Note** You can create the `S3Client` client without providing your security credentials. Requests sent using this client are anonymous requests, without a signature. Amazon S3 returns an error if you send anonymous requests for a resource that is not publicly available. For more information, see [Creating Anonymous Clients](https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials_anonymous.html) in the [AWS SDK for PHP Documentation](http://aws.amazon.com/documentation/sdk-for-php/). ------ #### [ Ruby ] Before you can use version 3 of the AWS SDK for Ruby to make calls to Amazon S3, you must set the AWS access credentials that the SDK uses to verify your access to your buckets and objects. If you have shared credentials set up in the AWS credentials profile on your local system, version 3 of the SDK for Ruby can use those credentials without your having to declare them in your code. For more information about setting up shared credentials, see [Making requests using AWS account or IAM user credentials ](https://docs.aws.amazon.com/AmazonS3/latest/userguide/AuthUsingAcctOrUserCredentials.html). The following Ruby code snippet uses the credentials in a shared AWS credentials file on a local computer to authenticate a request to get all of the object key names in a specific bucket. It does the following: 1. Creates an instance of the `Aws::S3::Client` class. 1. Makes a request to Amazon S3 by enumerating objects in a bucket using the `list_objects_v2` method of `Aws::S3::Client`. The client generates the necessary signature value from the credentials in the AWS credentials file on your computer, and includes it in the request it sends to Amazon S3. 1. Prints the array of object key names to the terminal. **Example** ``` # Prerequisites: # - An existing Amazon S3 bucket. require 'aws-sdk-s3' # @param s3_client [Aws::S3::Client] An initialized Amazon S3 client. # @param bucket_name [String] The bucket's name. # @return [Boolean] true if all operations succeed; otherwise, false. # @example # s3_client = Aws::S3::Client.new(region: 'us-west-2') # exit 1 unless list_bucket_objects?(s3_client, 'amzn-s3-demo-bucket') def list_bucket_objects?(s3_client, bucket_name) puts "Accessing the bucket named '#{bucket_name}'..." objects = s3_client.list_objects_v2( bucket: bucket_name, max_keys: 50 ) if objects.count.positive? puts 'The object keys in this bucket are (first 50 objects):' objects.contents.each do |object| puts object.key end else puts 'No objects found in this bucket.' end true rescue StandardError => e puts "Error while accessing the bucket named '#{bucket_name}': #{e.message}" false end # Example usage: def run_me region = 'us-west-2' bucket_name = 'BUCKET_NAME' s3_client = Aws::S3::Client.new(region: region) exit 1 unless list_bucket_objects?(s3_client, bucket_name) end run_me if $PROGRAM_NAME == __FILE__ ``` If you don't have a local AWS credentials file, you can still create the `Aws::S3::Client` resource and run code against Amazon S3 buckets and objects. Requests that are sent using version 3 of the SDK for Ruby are anonymous, with no signature by default. Amazon S3 returns an error if you send anonymous requests for a resource that's not publicly available. You can use and expand the previous code snippet for SDK for Ruby applications, as in the following more robust example. ``` # Prerequisites: # - An existing Amazon S3 bucket. require 'aws-sdk-s3' # @param s3_client [Aws::S3::Client] An initialized Amazon S3 client. # @param bucket_name [String] The bucket's name. # @return [Boolean] true if all operations succeed; otherwise, false. # @example # s3_client = Aws::S3::Client.new(region: 'us-west-2') # exit 1 unless list_bucket_objects?(s3_client, 'amzn-s3-demo-bucket') def list_bucket_objects?(s3_client, bucket_name) puts "Accessing the bucket named '#{bucket_name}'..." objects = s3_client.list_objects_v2( bucket: bucket_name, max_keys: 50 ) if objects.count.positive? puts 'The object keys in this bucket are (first 50 objects):' objects.contents.each do |object| puts object.key end else puts 'No objects found in this bucket.' end true rescue StandardError => e puts "Error while accessing the bucket named '#{bucket_name}': #{e.message}" false end # Example usage: def run_me region = 'us-west-2' bucket_name = 'BUCKET_NAME' s3_client = Aws::S3::Client.new(region: region) exit 1 unless list_bucket_objects?(s3_client, bucket_name) end run_me if $PROGRAM_NAME == __FILE__ ``` ------ #### [ Go ] **Example** The following example uses AWS credentials automatically loaded by the SDK for Go from the shared credentials file. ``` package main import ( "context" "errors" "fmt" "github.com/aws/aws-sdk-go-v2/config" "github.com/aws/aws-sdk-go-v2/service/s3" "github.com/aws/smithy-go" ) // main uses the AWS SDK for Go V2 to create an Amazon Simple Storage Service // (Amazon S3) client and list up to 10 buckets in your account. // This example uses the default settings specified in your shared credentials // and config files. func main() { ctx := context.Background() sdkConfig, err := config.LoadDefaultConfig(ctx) if err != nil { fmt.Println("Couldn't load default configuration. Have you set up your AWS account?") fmt.Println(err) return } s3Client := s3.NewFromConfig(sdkConfig) count := 10 fmt.Printf("Let's list up to %v buckets for your account.\n", count) result, err := s3Client.ListBuckets(ctx, &s3.ListBucketsInput{}) if err != nil { var ae smithy.APIError if errors.As(err, &ae) && ae.ErrorCode() == "AccessDenied" { fmt.Println("You don't have permission to list buckets for this account.") } else { fmt.Printf("Couldn't list buckets for your account. Here's why: %v\n", err) } return } if len(result.Buckets) == 0 { fmt.Println("You don't have any buckets!") } else { if count > len(result.Buckets) { count = len(result.Buckets) } for _, bucket := range result.Buckets[:count] { fmt.Printf("\t%v\n", *bucket.Name) } } } ``` ------ # Making requests using IAM user temporary credentials An AWS account or an IAM user can request temporary security credentials and use them to send authenticated requests to Amazon S3. This section provides examples of how to use the AWS SDK for Java, .NET, and PHP to obtain temporary security credentials and use them to authenticate your requests to Amazon S3. ------ #### [ Java ] An IAM user or an AWS account can request temporary security credentials (see [Making requests](MakingRequests.md)) using the AWS SDK for Java and use them to access Amazon S3. These credentials expire after the specified session duration. By default, the session duration is one hour. If you use IAM user credentials, you can specify the duration when requesting the temporary security credentials from 15 minutes to the maximum session duration for the role. For more information about temporary security credentials, see [Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) in the *IAM User Guide*. For more information about making requests, see [Making requests](MakingRequests.md). **To get temporary security credentials and access Amazon S3** 1. Create an instance of the `AWSSecurityTokenService` class. 1. Retrieve the temporary security credentials for the desired role by calling the `assumeRole()` method of the Security Token Service (STS) client. 1. Package the temporary security credentials into a `BasicSessionCredentials` object. You use this object to provide the temporary security credentials to your Amazon S3 client. 1. Create an instance of the `AmazonS3Client` class using the temporary security credentials. You send requests to Amazon S3 using this client. If you send requests using expired credentials, Amazon S3 will return an error. The following example lists a set of object keys in the specified bucket. The example obtains temporary security credentials for a session and uses them to send an authenticated request to Amazon S3. If you want to test the sample by using IAM user credentials, you must create an IAM user under your AWS account. For more information about how to create an IAM user, see [Creating Your First IAM user and Administrators Group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html) in the *IAM User Guide*. For instructions on creating and testing a working sample, see [Getting Started](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/getting-started.html) in the AWS SDK for Java Developer Guide. ``` import com.amazonaws.AmazonServiceException; import com.amazonaws.SdkClientException; import com.amazonaws.auth.AWSStaticCredentialsProvider; import com.amazonaws.auth.BasicSessionCredentials; import com.amazonaws.auth.profile.ProfileCredentialsProvider; import com.amazonaws.services.s3.AmazonS3; import com.amazonaws.services.s3.AmazonS3ClientBuilder; import com.amazonaws.services.s3.model.ObjectListing; import com.amazonaws.services.securitytoken.AWSSecurityTokenService; import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder; import com.amazonaws.services.securitytoken.model.AssumeRoleRequest; import com.amazonaws.services.securitytoken.model.AssumeRoleResult; import com.amazonaws.services.securitytoken.model.Credentials; public class MakingRequestsWithIAMTempCredentials { public static void main(String[] args) { String clientRegion = "*** Client region ***"; String roleARN = "*** ARN for role to be assumed ***"; String roleSessionName = "*** Role session name ***"; String bucketName = "*** Bucket name ***"; try { // Creating the STS client is part of your trusted code. It has // the security credentials you use to obtain temporary security credentials. AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder.standard() .withCredentials(new ProfileCredentialsProvider()) .withRegion(clientRegion) .build(); // Obtain credentials for the IAM role. Note that you cannot assume the role of // an AWS root account; // Amazon S3 will deny access. You must use credentials for an IAM user or an // IAM role. AssumeRoleRequest roleRequest = new AssumeRoleRequest() .withRoleArn(roleARN) .withRoleSessionName(roleSessionName); AssumeRoleResult roleResponse = stsClient.assumeRole(roleRequest); Credentials sessionCredentials = roleResponse.getCredentials(); // Create a BasicSessionCredentials object that contains the credentials you // just retrieved. BasicSessionCredentials awsCredentials = new BasicSessionCredentials( sessionCredentials.getAccessKeyId(), sessionCredentials.getSecretAccessKey(), sessionCredentials.getSessionToken()); // Provide temporary security credentials so that the Amazon S3 client // can send authenticated requests to Amazon S3. You create the client // using the sessionCredentials object. AmazonS3 s3Client = AmazonS3ClientBuilder.standard() .withCredentials(new AWSStaticCredentialsProvider(awsCredentials)) .withRegion(clientRegion) .build(); // Verify that assuming the role worked and the permissions are set correctly // by getting a set of object keys from the bucket. ObjectListing objects = s3Client.listObjects(bucketName); System.out.println("No. of Objects: " + objects.getObjectSummaries().size()); } catch (AmazonServiceException e) { // The call was transmitted successfully, but Amazon S3 couldn't process // it, so it returned an error response. e.printStackTrace(); } catch (SdkClientException e) { // Amazon S3 couldn't be contacted for a response, or the client // couldn't parse the response from Amazon S3. e.printStackTrace(); } } } ``` ------ #### [ .NET ] An IAM user or an AWS account can request temporary security credentials using the AWS SDK for .NET and use them to access Amazon S3. These credentials expire after the session duration. By default, the session duration is one hour. If you use IAM user credentials, you can specify the duration when requesting the temporary security credentials from 15 minutes to the maximum session duration for the role. For more information about temporary security credentials, see [Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) in the *IAM User Guide*. For more information about making requests, see [Making requests](MakingRequests.md). **To get temporary security credentials and access Amazon S3** 1. Create an instance of the AWS Security Token Service client, `AmazonSecurityTokenServiceClient`. 1. Start a session by calling the `GetSessionToken` method of the STS client you created in the preceding step. You provide session information to this method using a `GetSessionTokenRequest` object. The method returns your temporary security credentials. 1. Package the temporary security credentials in an instance of the `SessionAWSCredentials` object. You use this object to provide the temporary security credentials to your Amazon S3 client. 1. Create an instance of the `AmazonS3Client` class by passing in the temporary security credentials. You send requests to Amazon S3 using this client. If you send requests using expired credentials, Amazon S3 returns an error. The following C\$1 example lists object keys in the specified bucket. For illustration, the example obtains temporary security credentials for a default one-hour session and uses them to send authenticated request to Amazon S3. If you want to test the sample by using IAM user credentials, you must create an IAM user under your AWS account. For more information about how to create an IAM user, see [Creating Your First IAM user and Administrators Group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html) in the *IAM User Guide*. For more information about making requests, see [Making requests](MakingRequests.md). For information about setting up and running the code examples, see [Getting Started with the AWS SDK for .NET](https://docs.aws.amazon.com/sdk-for-net/latest/developer-guide/net-dg-setup.html) in the *AWS SDK for .NET Developer Guide*. ``` using Amazon; using Amazon.Runtime; using Amazon.S3; using Amazon.S3.Model; using Amazon.SecurityToken; using Amazon.SecurityToken.Model; using System; using System.Collections.Generic; using System.Threading.Tasks; namespace Amazon.DocSamples.S3 { class TempCredExplicitSessionStartTest { private const string bucketName = "*** bucket name ***"; // Specify your bucket region (an example region is shown). private static readonly RegionEndpoint bucketRegion = RegionEndpoint.USWest2; private static IAmazonS3 s3Client; public static void Main() { ListObjectsAsync().Wait(); } private static async Task ListObjectsAsync() { try { // Credentials use the default AWS SDK for .NET credential search chain. // On local development machines, this is your default profile. Console.WriteLine("Listing objects stored in a bucket"); SessionAWSCredentials tempCredentials = await GetTemporaryCredentialsAsync(); // Create a client by providing temporary security credentials. using (s3Client = new AmazonS3Client(tempCredentials, bucketRegion)) { var listObjectRequest = new ListObjectsRequest { BucketName = bucketName }; // Send request to Amazon S3. ListObjectsResponse response = await s3Client.ListObjectsAsync(listObjectRequest); List objects = response.S3Objects; Console.WriteLine("Object count = {0}", objects.Count); } } catch (AmazonS3Exception s3Exception) { Console.WriteLine(s3Exception.Message, s3Exception.InnerException); } catch (AmazonSecurityTokenServiceException stsException) { Console.WriteLine(stsException.Message, stsException.InnerException); } } private static async Task GetTemporaryCredentialsAsync() { using (var stsClient = new AmazonSecurityTokenServiceClient()) { var getSessionTokenRequest = new GetSessionTokenRequest { DurationSeconds = 7200 // seconds }; GetSessionTokenResponse sessionTokenResponse = await stsClient.GetSessionTokenAsync(getSessionTokenRequest); Credentials credentials = sessionTokenResponse.Credentials; var sessionCredentials = new SessionAWSCredentials(credentials.AccessKeyId, credentials.SecretAccessKey, credentials.SessionToken); return sessionCredentials; } } } } ``` ------ #### [ PHP ] For more information about the AWS SDK for Ruby API, go to [AWS SDK for Ruby - Version 2](https://docs.aws.amazon.com/sdkforruby/api/index.html). An IAM user or an AWS account can request temporary security credentials using version 3 of the AWS SDK for PHP. It can then use the temporary credentials to access Amazon S3. The credentials expire when the session duration expires. By default, the session duration is one hour. If you use IAM user credentials, you can specify the duration when requesting the temporary security credentials from 15 minutes to the maximum session duration for the role. For more information about temporary security credentials, see [Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) in the *IAM User Guide*. For more information about making requests, see [Making requests](MakingRequests.md). **Example** The following PHP example lists object keys in the specified bucket using temporary security credentials. The example obtains temporary security credentials for a default one-hour session, and uses them to send authenticated request to Amazon S3. For more information about the AWS SDK for Ruby API, go to [AWS SDK for Ruby - Version 2](https://docs.aws.amazon.com/sdkforruby/api/index.html). If you want to test the example by using IAM user credentials, you must create an IAM user under your AWS account. For information about how to create an IAM user, see [Creating Your First IAM user and Administrators Group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html) in the *IAM User Guide*. For examples of setting the session duration when using IAM user credentials to request a session, see [Making requests using IAM user temporary credentials](#AuthUsingTempSessionToken). ``` require 'vendor/autoload.php'; use Aws\S3\Exception\S3Exception; use Aws\S3\S3Client; use Aws\Sts\StsClient; $bucket = '*** Your Bucket Name ***'; $sts = new StsClient([ 'version' => 'latest', 'region' => 'us-east-1' ]); $sessionToken = $sts->getSessionToken(); $s3 = new S3Client([ 'region' => 'us-east-1', 'version' => 'latest', 'credentials' => [ 'key' => $sessionToken['Credentials']['AccessKeyId'], 'secret' => $sessionToken['Credentials']['SecretAccessKey'], 'token' => $sessionToken['Credentials']['SessionToken'] ] ]); $result = $s3->listBuckets(); try { // Retrieve a paginator for listing objects. $objects = $s3->getPaginator('ListObjects', [ 'Bucket' => $bucket ]); echo "Keys retrieved!" . PHP_EOL; // List objects foreach ($objects as $object) { echo $object['Key'] . PHP_EOL; } } catch (S3Exception $e) { echo $e->getMessage() . PHP_EOL; } ``` ------ #### [ Ruby ] An IAM user or an AWS account can request temporary security credentials using AWS SDK for Ruby and use them to access Amazon S3. These credentials expire after the session duration. By default, the session duration is one hour. If you use IAM user credentials, you can specify the duration when requesting the temporary security credentials from 15 minutes to the maximum session duration for the role. For more information about temporary security credentials, see [Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) in the *IAM User Guide*. For more information about making requests, see [Making requests](MakingRequests.md). The following Ruby example creates a temporary user to list the items in a specified bucket for one hour. To use this example, you must have AWS credentials that have the necessary permissions to create new AWS Security Token Service (AWS STS) clients, and list Amazon S3 buckets. ``` # Prerequisites: # - A user in AWS Identity and Access Management (IAM). This user must # be able to assume the following IAM role. You must run this code example # within the context of this user. # - An existing role in IAM that allows all of the Amazon S3 actions for all of the # resources in this code example. This role must also trust the preceding IAM user. # - An existing S3 bucket. require 'aws-sdk-core' require 'aws-sdk-s3' require 'aws-sdk-iam' # Checks whether a user exists in IAM. # # @param iam [Aws::IAM::Client] An initialized IAM client. # @param user_name [String] The user's name. # @return [Boolean] true if the user exists; otherwise, false. # @example # iam_client = Aws::IAM::Client.new(region: 'us-west-2') # exit 1 unless user_exists?(iam_client, 'my-user') def user_exists?(iam_client, user_name) response = iam_client.get_user(user_name: user_name) return true if response.user.user_name rescue Aws::IAM::Errors::NoSuchEntity # User doesn't exist. rescue StandardError => e puts 'Error while determining whether the user ' \ "'#{user_name}' exists: #{e.message}" end # Creates a user in IAM. # # @param iam_client [Aws::IAM::Client] An initialized IAM client. # @param user_name [String] The user's name. # @return [AWS:IAM::Types::User] The new user. # @example # iam_client = Aws::IAM::Client.new(region: 'us-west-2') # user = create_user(iam_client, 'my-user') # exit 1 unless user.user_name def create_user(iam_client, user_name) response = iam_client.create_user(user_name: user_name) response.user rescue StandardError => e puts "Error while creating the user '#{user_name}': #{e.message}" end # Gets a user in IAM. # # @param iam_client [Aws::IAM::Client] An initialized IAM client. # @param user_name [String] The user's name. # @return [AWS:IAM::Types::User] The existing user. # @example # iam_client = Aws::IAM::Client.new(region: 'us-west-2') # user = get_user(iam_client, 'my-user') # exit 1 unless user.user_name def get_user(iam_client, user_name) response = iam_client.get_user(user_name: user_name) response.user rescue StandardError => e puts "Error while getting the user '#{user_name}': #{e.message}" end # Checks whether a role exists in IAM. # # @param iam_client [Aws::IAM::Client] An initialized IAM client. # @param role_name [String] The role's name. # @return [Boolean] true if the role exists; otherwise, false. # @example # iam_client = Aws::IAM::Client.new(region: 'us-west-2') # exit 1 unless role_exists?(iam_client, 'my-role') def role_exists?(iam_client, role_name) response = iam_client.get_role(role_name: role_name) return true if response.role.role_name rescue StandardError => e puts 'Error while determining whether the role ' \ "'#{role_name}' exists: #{e.message}" end # Gets credentials for a role in IAM. # # @param sts_client [Aws::STS::Client] An initialized AWS STS client. # @param role_arn [String] The role's Amazon Resource Name (ARN). # @param role_session_name [String] A name for this role's session. # @param duration_seconds [Integer] The number of seconds this session is valid. # @return [AWS::AssumeRoleCredentials] The credentials. # @example # sts_client = Aws::STS::Client.new(region: 'us-west-2') # credentials = get_credentials( # sts_client, # 'arn:aws:iam::123456789012:role/AmazonS3ReadOnly', # 'ReadAmazonS3Bucket', # 3600 # ) # exit 1 if credentials.nil? def get_credentials(sts_client, role_arn, role_session_name, duration_seconds) Aws::AssumeRoleCredentials.new( client: sts_client, role_arn: role_arn, role_session_name: role_session_name, duration_seconds: duration_seconds ) rescue StandardError => e puts "Error while getting credentials: #{e.message}" end # Checks whether a bucket exists in Amazon S3. # # @param s3_client [Aws::S3::Client] An initialized Amazon S3 client. # @param bucket_name [String] The name of the bucket. # @return [Boolean] true if the bucket exists; otherwise, false. # @example # s3_client = Aws::S3::Client.new(region: 'us-west-2') # exit 1 unless bucket_exists?(s3_client, 'amzn-s3-demo-bucket') def bucket_exists?(s3_client, bucket_name) response = s3_client.list_buckets response.buckets.each do |bucket| return true if bucket.name == bucket_name end rescue StandardError => e puts "Error while checking whether the bucket '#{bucket_name}' " \ "exists: #{e.message}" end # Lists the keys and ETags for the objects in an Amazon S3 bucket. # # @param s3_client [Aws::S3::Client] An initialized Amazon S3 client. # @param bucket_name [String] The bucket's name. # @return [Boolean] true if the objects were listed; otherwise, false. # @example # s3_client = Aws::S3::Client.new(region: 'us-west-2') # exit 1 unless list_objects_in_bucket?(s3_client, 'amzn-s3-demo-bucket') def list_objects_in_bucket?(s3_client, bucket_name) puts "Accessing the contents of the bucket named '#{bucket_name}'..." response = s3_client.list_objects_v2( bucket: bucket_name, max_keys: 50 ) if response.count.positive? puts "Contents of the bucket named '#{bucket_name}' (first 50 objects):" puts 'Name => ETag' response.contents.each do |obj| puts "#{obj.key} => #{obj.etag}" end else puts "No objects in the bucket named '#{bucket_name}'." end true rescue StandardError => e puts "Error while accessing the bucket named '#{bucket_name}': #{e.message}" end ``` ------ # Making requests using federated user temporary credentials You can request temporary security credentials and provide them to your federated users or applications who need to access your AWS resources. This section provides examples of how you can use the AWS SDK to obtain temporary security credentials for your federated users or applications and send authenticated requests to Amazon S3 using those credentials. For a list of available AWS SDKs, see [Sample Code and Libraries](https://aws.amazon.com/code/). **Note** Both the AWS account and an IAM user can request temporary security credentials for federated users. However, for added security, only an IAM user with the necessary permissions should request these temporary credentials to ensure that the federated user gets at most the permissions of the requesting IAM user. In some applications, you might find it suitable to create an IAM user with specific permissions for the sole purpose of granting temporary security credentials to your federated users and applications. ------ #### [ Java ] You can provide temporary security credentials for your federated users and applications so that they can send authenticated requests to access your AWS resources. When requesting these temporary credentials, you must provide a user name and an IAM policy that describes the resource permissions that you want to grant. By default, the session duration is one hour. You can explicitly set a different duration value when requesting the temporary security credentials for federated users and applications. **Note** For added security when requesting temporary security credentials for federated users and applications, we recommend that you use a dedicated IAM user with only the necessary access permissions. The temporary user you create can never get more permissions than the IAM user who requested the temporary security credentials. For more information, see [AWS Identity and Access Management FAQs ](https://aws.amazon.com/iam/faqs/#What_are_the_best_practices_for_using_temporary_security_credentials). To provide security credentials and send authenticated request to access resources, do the following: + Create an instance of the `AWSSecurityTokenServiceClient` class. + Start a session by calling the `getFederationToken()` method of the Security Token Service (STS) client. Provide session information, including the user name and an IAM policy, that you want to attach to the temporary credentials. You can provide an optional session duration. This method returns your temporary security credentials. + Package the temporary security credentials in an instance of the `BasicSessionCredentials` object. You use this object to provide the temporary security credentials to your Amazon S3 client. + Create an instance of the `AmazonS3Client` class using the temporary security credentials. You send requests to Amazon S3 using this client. If you send requests using expired credentials, Amazon S3 returns an error. **Example** The example lists keys in the specified S3 bucket. In the example, you obtain temporary security credentials for a two-hour session for your federated user and use the credentials to send authenticated requests to Amazon S3. To run the example, you need to create an IAM user with an attached policy that allows the user to request temporary security credentials and list your AWS resources. The following policy accomplishes this: ``` 1. { 2. "Statement":[{ 3. "Action":["s3:ListBucket", 4. "sts:GetFederationToken*" 5. ], 6. "Effect":"Allow", 7. "Resource":"*" 8. } 9. ] 10. } ``` For more information about how to create an IAM user, see [Creating Your First IAM user and Administrators Group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html) in the *IAM User Guide*. After creating an IAM user and attaching the preceding policy, you can run the following example. For instructions on creating and testing a working sample, see [Getting Started](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/getting-started.html) in the AWS SDK for Java Developer Guide. ``` import com.amazonaws.AmazonServiceException; import com.amazonaws.SdkClientException; import com.amazonaws.auth.AWSStaticCredentialsProvider; import com.amazonaws.auth.BasicSessionCredentials; import com.amazonaws.auth.policy.Policy; import com.amazonaws.auth.policy.Resource; import com.amazonaws.auth.policy.Statement; import com.amazonaws.auth.policy.Statement.Effect; import com.amazonaws.auth.policy.actions.S3Actions; import com.amazonaws.auth.profile.ProfileCredentialsProvider; import com.amazonaws.regions.Regions; import com.amazonaws.services.s3.AmazonS3; import com.amazonaws.services.s3.AmazonS3ClientBuilder; import com.amazonaws.services.s3.model.ObjectListing; import com.amazonaws.services.securitytoken.AWSSecurityTokenService; import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder; import com.amazonaws.services.securitytoken.model.Credentials; import com.amazonaws.services.securitytoken.model.GetFederationTokenRequest; import com.amazonaws.services.securitytoken.model.GetFederationTokenResult; import java.io.IOException; public class MakingRequestsWithFederatedTempCredentials { public static void main(String[] args) throws IOException { Regions clientRegion = Regions.DEFAULT_REGION; String bucketName = "*** Specify bucket name ***"; String federatedUser = "*** Federated user name ***"; String resourceARN = "arn:aws:s3:::" + bucketName; try { AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder .standard() .withCredentials(new ProfileCredentialsProvider()) .withRegion(clientRegion) .build(); GetFederationTokenRequest getFederationTokenRequest = new GetFederationTokenRequest(); getFederationTokenRequest.setDurationSeconds(7200); getFederationTokenRequest.setName(federatedUser); // Define the policy and add it to the request. Policy policy = new Policy(); policy.withStatements(new Statement(Effect.Allow) .withActions(S3Actions.ListObjects) .withResources(new Resource(resourceARN))); getFederationTokenRequest.setPolicy(policy.toJson()); // Get the temporary security credentials. GetFederationTokenResult federationTokenResult = stsClient.getFederationToken(getFederationTokenRequest); Credentials sessionCredentials = federationTokenResult.getCredentials(); // Package the session credentials as a BasicSessionCredentials // object for an Amazon S3 client object to use. BasicSessionCredentials basicSessionCredentials = new BasicSessionCredentials( sessionCredentials.getAccessKeyId(), sessionCredentials.getSecretAccessKey(), sessionCredentials.getSessionToken()); AmazonS3 s3Client = AmazonS3ClientBuilder.standard() .withCredentials(new AWSStaticCredentialsProvider(basicSessionCredentials)) .withRegion(clientRegion) .build(); // To verify that the client works, send a listObjects request using // the temporary security credentials. ObjectListing objects = s3Client.listObjects(bucketName); System.out.println("No. of Objects = " + objects.getObjectSummaries().size()); } catch (AmazonServiceException e) { // The call was transmitted successfully, but Amazon S3 couldn't process // it, so it returned an error response. e.printStackTrace(); } catch (SdkClientException e) { // Amazon S3 couldn't be contacted for a response, or the client // couldn't parse the response from Amazon S3. e.printStackTrace(); } } } ``` ------ #### [ .NET ] You can provide temporary security credentials for your federated users and applications so that they can send authenticated requests to access your AWS resources. When requesting these temporary credentials, you must provide a user name and an IAM policy that describes the resource permissions that you want to grant. By default, the duration of a session is one hour. You can explicitly set a different duration value when requesting the temporary security credentials for federated users and applications. For information about sending authenticated requests, see [Making requests](MakingRequests.md). **Note** When requesting temporary security credentials for federated users and applications, for added security, we suggest that you use a dedicated IAM user with only the necessary access permissions. The temporary user you create can never get more permissions than the IAM user who requested the temporary security credentials. For more information, see [AWS Identity and Access Management FAQs ](https://aws.amazon.com/iam/faqs/#What_are_the_best_practices_for_using_temporary_security_credentials). You do the following: + Create an instance of the AWS Security Token Service client, `AmazonSecurityTokenServiceClient` class. + Start a session by calling the `GetFederationToken` method of the STS client. You need to provide session information, including the user name and an IAM policy that you want to attach to the temporary credentials. Optionally, you can provide a session duration. This method returns your temporary security credentials. + Package the temporary security credentials in an instance of the `SessionAWSCredentials` object. You use this object to provide the temporary security credentials to your Amazon S3 client. + Create an instance of the `AmazonS3Client` class by passing the temporary security credentials. You use this client to send requests to Amazon S3. If you send requests using expired credentials, Amazon S3 returns an error. **Example** The following C\$1 example lists the keys in the specified bucket. In the example, you obtain temporary security credentials for a two-hour session for your federated user (User1), and use the credentials to send authenticated requests to Amazon S3. + For this exercise, you create an IAM user with minimal permissions. Using the credentials of this IAM user, you request temporary credentials for others. This example lists only the objects in a specific bucket. Create an IAM user with the following policy attached: ``` 1. { 2. "Statement":[{ 3. "Action":["s3:ListBucket", 4. "sts:GetFederationToken*" 5. ], 6. "Effect":"Allow", 7. "Resource":"*" 8. } 9. ] 10. } ``` The policy allows the IAM user to request temporary security credentials and access permission only to list your AWS resources. For more information about how to create an IAM user, see [Creating Your IAM user User and Administrators Group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html) in the *IAM User Guide*. + Use the IAM user security credentials to test the following example. The example sends authenticated request to Amazon S3 using temporary security credentials. The example specifies the following policy when requesting temporary security credentials for the federated user (User1), which restricts access to listing objects in a specific bucket (`YourBucketName`). You must update the policy and provide your own existing bucket name. ``` 1. { 2. "Statement":[ 3. { 4. "Sid":"1", 5. "Action":["s3:ListBucket"], 6. "Effect":"Allow", 7. "Resource":"arn:aws:s3:::YourBucketName" 8. } 9. ] 10. } ``` + **Example** Update the following sample and provide the bucket name that you specified in the preceding federated user access policy. For information about setting up and running the code examples, see [Getting Started with the AWS SDK for .NET](https://docs.aws.amazon.com/sdk-for-net/latest/developer-guide/net-dg-setup.html) in the *AWS SDK for .NET Developer Guide*. ``` using Amazon; using Amazon.Runtime; using Amazon.S3; using Amazon.S3.Model; using Amazon.SecurityToken; using Amazon.SecurityToken.Model; using System; using System.Collections.Generic; using System.Threading.Tasks; namespace Amazon.DocSamples.S3 { class TempFederatedCredentialsTest { private const string bucketName = "*** bucket name ***"; // Specify your bucket region (an example region is shown). private static readonly RegionEndpoint bucketRegion = RegionEndpoint.USWest2; private static IAmazonS3 client; public static void Main() { ListObjectsAsync().Wait(); } private static async Task ListObjectsAsync() { try { Console.WriteLine("Listing objects stored in a bucket"); // Credentials use the default AWS SDK for .NET credential search chain. // On local development machines, this is your default profile. SessionAWSCredentials tempCredentials = await GetTemporaryFederatedCredentialsAsync(); // Create a client by providing temporary security credentials. using (client = new AmazonS3Client(bucketRegion)) { ListObjectsRequest listObjectRequest = new ListObjectsRequest(); listObjectRequest.BucketName = bucketName; ListObjectsResponse response = await client.ListObjectsAsync(listObjectRequest); List objects = response.S3Objects; Console.WriteLine("Object count = {0}", objects.Count); Console.WriteLine("Press any key to continue..."); Console.ReadKey(); } } catch (AmazonS3Exception e) { Console.WriteLine("Error encountered ***. Message:'{0}' when writing an object", e.Message); } catch (Exception e) { Console.WriteLine("Unknown encountered on server. Message:'{0}' when writing an object", e.Message); } } private static async Task GetTemporaryFederatedCredentialsAsync() { AmazonSecurityTokenServiceConfig config = new AmazonSecurityTokenServiceConfig(); AmazonSecurityTokenServiceClient stsClient = new AmazonSecurityTokenServiceClient( config); GetFederationTokenRequest federationTokenRequest = new GetFederationTokenRequest(); federationTokenRequest.DurationSeconds = 7200; federationTokenRequest.Name = "User1"; federationTokenRequest.Policy = @"{ ""Statement"": [ { ""Sid"":""Stmt1311212314284"", ""Action"":[""s3:ListBucket""], ""Effect"":""Allow"", ""Resource"":""arn:aws:s3:::" + bucketName + @""" } ] } "; GetFederationTokenResponse federationTokenResponse = await stsClient.GetFederationTokenAsync(federationTokenRequest); Credentials credentials = federationTokenResponse.Credentials; SessionAWSCredentials sessionCredentials = new SessionAWSCredentials(credentials.AccessKeyId, credentials.SecretAccessKey, credentials.SessionToken); return sessionCredentials; } } } ``` ------ #### [ PHP ] This topic explains how to use classes from version 3 of the AWS SDK for PHP to request temporary security credentials for federated users and applications and use them to access resources stored in Amazon S3. For more information about the AWS SDK for Ruby API, go to [AWS SDK for Ruby - Version 2](https://docs.aws.amazon.com/sdkforruby/api/index.html). You can provide temporary security credentials to your federated users and applications so they can send authenticated requests to access your AWS resources. When requesting these temporary credentials, you must provide a user name and an IAM policy that describes the resource permissions that you want to grant. These credentials expire when the session duration expires. By default, the session duration is one hour. You can explicitly set a different value for the duration when requesting the temporary security credentials for federated users and applications. For more information about temporary security credentials, see [Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) in the *IAM User Guide*. For information about providing temporary security credentials to your federated users and applications, see [Making requests](MakingRequests.md). For added security when requesting temporary security credentials for federated users and applications, we recommend using a dedicated IAM user with only the necessary access permissions. The temporary user you create can never get more permissions than the IAM user who requested the temporary security credentials. For information about identity federation, see [AWS Identity and Access Management FAQs](https://aws.amazon.com/iam/faqs/#What_are_the_best_practices_for_using_temporary_security_credentials). For more information about the AWS SDK for Ruby API, go to [AWS SDK for Ruby - Version 2](https://docs.aws.amazon.com/sdkforruby/api/index.html). **Example** The following PHP example lists keys in the specified bucket. In the example, you obtain temporary security credentials for an hour session for your federated user (User1). Then you use the temporary security credentials to send authenticated requests to Amazon S3. For added security when requesting temporary credentials for others, you use the security credentials of an IAM user who has permissions to request temporary security credentials. To ensure that the IAM user grants only the minimum application-specific permissions to the federated user, you can also limit the access permissions of this IAM user. This example lists only objects in a specific bucket. Create an IAM user with the following policy attached: ``` 1. { 2. "Statement":[{ 3. "Action":["s3:ListBucket", 4. "sts:GetFederationToken*" 5. ], 6. "Effect":"Allow", 7. "Resource":"*" 8. } 9. ] 10. } ``` The policy allows the IAM user to request temporary security credentials and access permission only to list your AWS resources. For more information about how to create an IAM user, see [Creating Your First IAM user and Administrators Group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html) in the *IAM User Guide*. You can now use the IAM user security credentials to test the following example. The example sends an authenticated request to Amazon S3 using temporary security credentials. When requesting temporary security credentials for the federated user (User1), the example specifies the following policy, which restricts access to list objects in a specific bucket. Update the policy with your bucket name. ``` 1. { 2. "Statement":[ 3. { 4. "Sid":"1", 5. "Action":["s3:ListBucket"], 6. "Effect":"Allow", 7. "Resource":"arn:aws:s3:::YourBucketName" 8. } 9. ] 10. } ``` In the following example, when specifying the policy resource, replace `YourBucketName` with the name of your bucket.: ``` require 'vendor/autoload.php'; use Aws\S3\Exception\S3Exception; use Aws\S3\S3Client; use Aws\Sts\StsClient; $bucket = '*** Your Bucket Name ***'; // In real applications, the following code is part of your trusted code. It has // the security credentials that you use to obtain temporary security credentials. $sts = new StsClient([ 'version' => 'latest', 'region' => 'us-east-1' ]); // Fetch the federated credentials. $sessionToken = $sts->getFederationToken([ 'Name' => 'User1', 'DurationSeconds' => '3600', 'Policy' => json_encode([ 'Statement' => [ 'Sid' => 'randomstatementid' . time(), 'Action' => ['s3:ListBucket'], 'Effect' => 'Allow', 'Resource' => 'arn:aws:s3:::' . $bucket ] ]) ]); // The following will be part of your less trusted code. You provide temporary // security credentials so the code can send authenticated requests to Amazon S3. $s3 = new S3Client([ 'region' => 'us-east-1', 'version' => 'latest', 'credentials' => [ 'key' => $sessionToken['Credentials']['AccessKeyId'], 'secret' => $sessionToken['Credentials']['SecretAccessKey'], 'token' => $sessionToken['Credentials']['SessionToken'] ] ]); try { $result = $s3->listObjects([ 'Bucket' => $bucket ]); } catch (S3Exception $e) { echo $e->getMessage() . PHP_EOL; } ``` ------ #### [ Ruby ] You can provide temporary security credentials for your federated users and applications so that they can send authenticated requests to access your AWS resources. When requesting temporary credentials from the IAM service, you must provide a user name and an IAM policy that describes the resource permissions that you want to grant. By default, the session duration is one hour. However, if you are requesting temporary credentials using IAM user credentials, you can explicitly set a different duration value when requesting the temporary security credentials for federated users and applications. For information about temporary security credentials for your federated users and applications, see [Making requests](MakingRequests.md). **Note** For added security when you request temporary security credentials for federated users and applications, you might want to use a dedicated IAM user with only the necessary access permissions. The temporary user you create can never get more permissions than the IAM user who requested the temporary security credentials. For more information, see [AWS Identity and Access Management FAQs ](https://aws.amazon.com/iam/faqs/#What_are_the_best_practices_for_using_temporary_security_credentials). **Example** The following Ruby code example allows a federated user with a limited set of permissions to lists keys in the specified bucket. ``` # Prerequisites: # - An existing Amazon S3 bucket. require 'aws-sdk-s3' require 'aws-sdk-iam' require 'json' # Checks to see whether a user exists in IAM; otherwise, # creates the user. # # @param iam [Aws::IAM::Client] An initialized IAM client. # @param user_name [String] The user's name. # @return [Aws::IAM::Types::User] The existing or new user. # @example # iam = Aws::IAM::Client.new(region: 'us-west-2') # user = get_user(iam, 'my-user') # exit 1 unless user.user_name # puts "User's name: #{user.user_name}" def get_user(iam, user_name) puts "Checking for a user with the name '#{user_name}'..." response = iam.get_user(user_name: user_name) puts "A user with the name '#{user_name}' already exists." response.user # If the user doesn't exist, create them. rescue Aws::IAM::Errors::NoSuchEntity puts "A user with the name '#{user_name}' doesn't exist. Creating this user..." response = iam.create_user(user_name: user_name) iam.wait_until(:user_exists, user_name: user_name) puts "Created user with the name '#{user_name}'." response.user rescue StandardError => e puts "Error while accessing or creating the user named '#{user_name}': #{e.message}" end # Gets temporary AWS credentials for an IAM user with the specified permissions. # # @param sts [Aws::STS::Client] An initialized AWS STS client. # @param duration_seconds [Integer] The number of seconds for valid credentials. # @param user_name [String] The user's name. # @param policy [Hash] The access policy. # @return [Aws::STS::Types::Credentials] AWS credentials for API authentication. # @example # sts = Aws::STS::Client.new(region: 'us-west-2') # credentials = get_temporary_credentials(sts, duration_seconds, user_name, # { # 'Version' => '2012-10-17', # 'Statement' => [ # 'Sid' => 'Stmt1', # 'Effect' => 'Allow', # 'Action' => 's3:ListBucket', # 'Resource' => 'arn:aws:s3:::amzn-s3-demo-bucket' # ] # } # ) # exit 1 unless credentials.access_key_id # puts "Access key ID: #{credentials.access_key_id}" def get_temporary_credentials(sts, duration_seconds, user_name, policy) response = sts.get_federation_token( duration_seconds: duration_seconds, name: user_name, policy: policy.to_json ) response.credentials rescue StandardError => e puts "Error while getting federation token: #{e.message}" end # Lists the keys and ETags for the objects in an Amazon S3 bucket. # # @param s3_client [Aws::S3::Client] An initialized Amazon S3 client. # @param bucket_name [String] The bucket's name. # @return [Boolean] true if the objects were listed; otherwise, false. # @example # s3_client = Aws::S3::Client.new(region: 'us-west-2') # exit 1 unless list_objects_in_bucket?(s3_client, 'amzn-s3-demo-bucket') def list_objects_in_bucket?(s3_client, bucket_name) puts "Accessing the contents of the bucket named '#{bucket_name}'..." response = s3_client.list_objects_v2( bucket: bucket_name, max_keys: 50 ) if response.count.positive? puts "Contents of the bucket named '#{bucket_name}' (first 50 objects):" puts 'Name => ETag' response.contents.each do |obj| puts "#{obj.key} => #{obj.etag}" end else puts "No objects in the bucket named '#{bucket_name}'." end true rescue StandardError => e puts "Error while accessing the bucket named '#{bucket_name}': #{e.message}" end # Example usage: def run_me region = "us-west-2" user_name = "my-user" bucket_name = "amzn-s3-demo-bucket" iam = Aws::IAM::Client.new(region: region) user = get_user(iam, user_name) exit 1 unless user.user_name puts "User's name: #{user.user_name}" sts = Aws::STS::Client.new(region: region) credentials = get_temporary_credentials(sts, 3600, user_name, { 'Version' => '2012-10-17', 'Statement' => [ 'Sid' => 'Stmt1', 'Effect' => 'Allow', 'Action' => 's3:ListBucket', 'Resource' => "arn:aws:s3:::#{bucket_name}" ] }) exit 1 unless credentials.access_key_id puts "Access key ID: #{credentials.access_key_id}" s3_client = Aws::S3::Client.new(region: region, credentials: credentials) exit 1 unless list_objects_in_bucket?(s3_client, bucket_name) end run_me if $PROGRAM_NAME == __FILE__ ``` ------ # Making requests using the REST API This section contains information on how to make requests to Amazon S3 endpoints by using the REST API. For a list of Amazon S3 endpoints, see [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/s3.html) in the *AWS General Reference*. ## Constructing S3 hostnames for REST API requests Amazon S3 endpoints follow the structure shown below: ``` s3.Region.amazonaws.com ``` Amazon S3 access points endpoints and dual-stack endpoints also follow the standard structure: + **Amazon S3 access points** ‐`s3-accesspoint.Region.amazonaws.com` + **Dual-stack** ‐ `s3.dualstack.Region.amazonaws.com` For a complete list of Amazon S3 Regions and endpoints, see [Amazon S3 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/s3.html) in the *Amazon Web Services General Reference*. ## Virtual hosted‐style and path‐style requests When making requests by using the REST API, you can use virtual hosted–style or path-style URIs for the Amazon S3 endpoints. For more information, see [Path-style requests ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/VirtualHosting.html#path-style-access). **Example Virtual hosted–Style request** Following is an example of a virtual hosted–style request to delete the `puppy.jpg` file from the bucket named `examplebucket` in the US West (Oregon) Region. For more information about virtual hosted-style requests, see [Path-style requests ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/VirtualHosting.html#virtual-hosted-style-access). ``` 1. DELETE /puppy.jpg HTTP/1.1 2. Host: examplebucket.s3.us-west-2.amazonaws.com 3. Date: Mon, 11 Apr 2016 12:00:00 GMT 4. x-amz-date: Mon, 11 Apr 2016 12:00:00 GMT 5. Authorization: authorization string ``` **Example Path-style request** Following is an example of a path-style version of the same request. ``` 1. DELETE /examplebucket/puppy.jpg HTTP/1.1 2. Host: s3.us-west-2.amazonaws.com 3. Date: Mon, 11 Apr 2016 12:00:00 GMT 4. x-amz-date: Mon, 11 Apr 2016 12:00:00 GMT 5. Authorization: authorization string ``` You will receive an HTTP response code 307 Temporary Redirect error and a message indicating what the correct URI is for your resource if you try to access a bucket outside the US East (N. Virginia) region with path-style syntax that uses either of the following: For more information about path-style requests, see [Path-style requests ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/VirtualHosting.html#path-style-access). Update (September 23, 2020) – To make sure that customers have the time that they need to transition to virtual-hosted–style URLs, we have decided to delay the deprecation of path-style URLs. For more information, see [Amazon S3 Path Deprecation Plan – The Rest of the Story](https://aws.amazon.com/blogs/aws/amazon-s3-path-deprecation-plan-the-rest-of-the-story/) in the *AWS News Blog*. ## Making requests to dual-stack endpoints by using the REST API When using the REST API, you can directly access a dual-stack endpoint by using a virtual hosted–style or a path style endpoint name (URI). All Amazon S3 dual-stack endpoint names include the region in the name. Unlike the standard IPv4-only endpoints, both virtual hosted–style and a path-style endpoints use region-specific endpoint names. **Example Virtual hosted–Style dual-stack endpoint request** You can use a virtual hosted–style endpoint in your REST request as shown in the following example that retrieves the `puppy.jpg` object from the bucket named `examplebucket` in the US West (Oregon) Region. ``` 1. GET /puppy.jpg HTTP/1.1 2. Host: examplebucket.s3.dualstack.us-west-2.amazonaws.com 3. Date: Mon, 11 Apr 2016 12:00:00 GMT 4. x-amz-date: Mon, 11 Apr 2016 12:00:00 GMT 5. Authorization: authorization string ``` **Example Path-style dual-stack endpoint request** Or you can use a path-style endpoint in your request as shown in the following example. ``` 1. GET /examplebucket/puppy.jpg HTTP/1.1 2. Host: s3.dualstack.us-west-2.amazonaws.com 3. Date: Mon, 11 Apr 2016 12:00:00 GMT 4. x-amz-date: Mon, 11 Apr 2016 12:00:00 GMT 5. Authorization: authorization string ``` For more information about dual-stack endpoints, see [Using Amazon S3 dual-stack endpoints](dual-stack-endpoints.md). For more information about making requests using the REST API, see the topics below. **Topics** + [ ## Constructing S3 hostnames for REST API requests ](#constructing-hostname-rest-api-requests) + [ ## Virtual hosted‐style and path‐style requests ](#virtual-hosted-path-style-requests) + [ ## Making requests to dual-stack endpoints by using the REST API ](#rest-api-dual-stack) + [ # Request redirection and the REST API ](RESTRedirect.md) + [ # Request routing ](UsingRouting.md) # Request redirection and the REST API **Topics** + [ ## Redirects and HTTP user-agents ](#RESTRedirectHTTPUserAgents) + [ ## Redirects and 100-Continue ](#RESTRedirect100Continue) + [ ## Redirect example ](#RESTRedirectExample) This section describes how to handle HTTP redirects by using the Amazon S3 REST API. For general information about Amazon S3 redirects, see [Making requests](MakingRequests.md) in the Amazon Simple Storage Service API Reference. ## Redirects and HTTP user-agents Programs that use the Amazon S3 REST API should handle redirects either at the application layer or the HTTP layer. Many HTTP client libraries and user agents can be configured to correctly handle redirects automatically; however, many others have incorrect or incomplete redirect implementations. Before you rely on a library to fulfill the redirect requirement, test the following cases: + Verify all HTTP request headers are correctly included in the redirected request (the second request after receiving a redirect) including HTTP standards such as Authorization and Date. + Verify non-GET redirects, such as PUT and DELETE, work correctly. + Verify large PUT requests follow redirects correctly. + Verify PUT requests follow redirects correctly if the 100-continue response takes a long time to arrive. HTTP user-agents that strictly conform to RFC 2616 might require explicit confirmation before following a redirect when the HTTP request method is not GET or HEAD. It is generally safe to follow redirects generated by Amazon S3 automatically, as the system will issue redirects only to hosts within the amazonaws.com domain and the effect of the redirected request will be the same as that of the original request. ## Redirects and 100-Continue To simplify redirect handling, improve efficiencies, and avoid the costs associated with sending a redirected request body twice, configure your application to use 100-continues for PUT operations. When your application uses 100-continue, it does not send the request body until it receives an acknowledgement. If the message is rejected based on the headers, the body of the message is not sent. For more information about 100-continue, go to [RFC 2616 Section 8.2.3](http://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html#sec8.2.3) **Note** According to RFC 2616, when using `Expect: Continue` with an unknown HTTP server, you should not wait an indefinite period before sending the request body. This is because some HTTP servers do not recognize 100-continue. However, Amazon S3 does recognize if your request contains an `Expect: Continue` and will respond with a provisional 100-continue status or a final status code. Additionally, no redirect error will occur after receiving the provisional 100 continue go-ahead. This will help you avoid receiving a redirect response while you are still writing the request body. ## Redirect example This section provides an example of client-server interaction using HTTP redirects and 100-continue. Following is a sample PUT to the `quotes.s3.amazonaws.com` bucket. ``` 1. PUT /nelson.txt HTTP/1.1 2. Host: quotes.s3.amazonaws.com 3. Date: Mon, 15 Oct 2007 22:18:46 +0000 4. 5. Content-Length: 6 6. Expect: 100-continue ``` Amazon S3 returns the following: ``` 1. HTTP/1.1 307 Temporary Redirect 2. Location: http://quotes.s3-4c25d83b.amazonaws.com/nelson.txt?rk=8d47490b 3. Content-Type: application/xml 4. Transfer-Encoding: chunked 5. Date: Mon, 15 Oct 2007 22:18:46 GMT 6. 7. Server: AmazonS3 8. 9. 10. 11. TemporaryRedirect 12. Please re-send this request to the 13. specified temporary endpoint. Continue to use the 14. original request endpoint for future requests. 15. 16. quotes.s3-4c25d83b.amazonaws.com 17. quotes 18. ``` The client follows the redirect response and issues a new request to the `quotes.s3-4c25d83b.amazonaws.com` temporary endpoint. ``` 1. PUT /nelson.txt?rk=8d47490b HTTP/1.1 2. Host: quotes.s3-4c25d83b.amazonaws.com 3. Date: Mon, 15 Oct 2007 22:18:46 +0000 4. 5. Content-Length: 6 6. Expect: 100-continue ``` Amazon S3 returns a 100-continue indicating the client should proceed with sending the request body. ``` 1. HTTP/1.1 100 Continue ``` The client sends the request body. ``` 1. ha ha\n ``` Amazon S3 returns the final response. ``` 1. HTTP/1.1 200 OK 2. Date: Mon, 15 Oct 2007 22:18:48 GMT 3. 4. ETag: "a2c8d6b872054293afd41061e93bc289" 5. Content-Length: 0 6. Server: AmazonS3 ``` # Request routing Programs that make requests against buckets created using the [CreateBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html) API that include a [CreateBucketConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketConfiguration.html) must support redirects. Additionally, some clients that do not respect DNS TTLs might encounter issues. This section describes routing and DNS issues to consider when designing your service or application for use with Amazon S3. ## Request redirection and the REST API Amazon S3 uses the Domain Name System (DNS) to route requests to facilities that can process them. This system works effectively, but temporary routing errors can occur. If a request arrives at the wrong Amazon S3 location, Amazon S3 responds with a temporary redirect that tells the requester to resend the request to a new endpoint. If a request is incorrectly formed, Amazon S3 uses permanent redirects to provide direction on how to perform the request correctly. **Important** To use this feature, you must have an application that can handle Amazon S3 redirect responses. The only exception is for applications that work exclusively with buckets that were created without ``. For more information about location constraints, see [Accessing and listing an Amazon S3 bucket ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/access-bucket-intro.html). For all Regions that launched after March 20, 2019, if a request arrives at the wrong Amazon S3 location, Amazon S3 returns an HTTP 400 Bad Request error. For more information about enabling or disabling an AWS Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the *AWS General Reference*. **Topics** + [ ### DNS routing ](#DNSRouting) + [ ### Temporary request redirection ](#TemporaryRedirection) + [ ### Permanent request redirection ](#RedirectsPermanentRedirection) + [ ### Request redirection examples ](#redirect-examples) ### DNS routing DNS routing routes requests to appropriate Amazon S3 facilities. The following figure and procedure show an example of DNS routing. ![\[Diagram showing steps that occur when a DNS server routes requests from the client to facility B.\]](http://docs.aws.amazon.com/AmazonS3/latest/API/images/DNS_virthost.png) **DNS routing request steps** 1. The client makes a DNS request to get an object stored on Amazon S3. 1. The client receives one or more IP addresses for facilities that can process the request. In this example, the IP address is for Facility B. 1. The client makes a request to Amazon S3 Facility B. 1. Facility B returns a copy of the object to the client. ### Temporary request redirection A temporary redirect is a type of error response that signals to the requester that they should resend the request to a different endpoint. Due to the distributed nature of Amazon S3, requests can be temporarily routed to the wrong facility. This is most likely to occur immediately after buckets are created or deleted. For example, if you create a new bucket and immediately make a request to the bucket, you might receive a temporary redirect, depending on the location constraint of the bucket. If you created the bucket in the US East (N. Virginia) AWS Region, you will not see the redirect because this is also the default Amazon S3 endpoint. However, if the bucket is created in any other Region, any requests for the bucket go to the default endpoint while the bucket's DNS entry is propagated. The default endpoint redirects the request to the correct endpoint with an HTTP 302 response. Temporary redirects contain a URI to the correct facility, which you can use to immediately resend the request. **Important** Don't reuse an endpoint provided by a previous redirect response. It might appear to work (even for long periods of time), but it might provide unpredictable results and will eventually fail without notice. The following figure and procedure shows an example of a temporary redirect. ![\[Diagram showing steps that occur when a client sends a request to B and is redirected to C.\]](http://docs.aws.amazon.com/AmazonS3/latest/API/images/DNS_virthost_redirect.png) **Temporary request redirection steps** 1. The client makes a DNS request to get an object stored on Amazon S3. 1. The client receives one or more IP addresses for facilities that can process the request. 1. The client makes a request to Amazon S3 Facility B. 1. Facility B returns a redirect indicating the object is available from Location C. 1. The client resends the request to Facility C. 1. Facility C returns a copy of the object. ### Permanent request redirection A permanent redirect indicates that your request addressed a resource inappropriately. For example, permanent redirects occur if you use a path-style request to access a bucket that was created using ``. For more information, see [Accessing and listing an Amazon S3 bucket ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/access-bucket-intro.html). To help you find these errors during development, this type of redirect does not contain a Location HTTP header that allows you to automatically follow the request to the correct location. Consult the resulting XML error document for help using the correct Amazon S3 endpoint. ### Request redirection examples The following are examples of temporary request redirection responses. #### REST API temporary redirect response ``` 1. HTTP/1.1 307 Temporary Redirect 2. Location: http://awsexamplebucket1.s3-gztb4pa9sq.amazonaws.com/photos/puppy.jpg?rk=e2c69a31 3. Content-Type: application/xml 4. Transfer-Encoding: chunked 5. Date: Fri, 12 Oct 2007 01:12:56 GMT 6. Server: AmazonS3 7. 8. 9. 10. TemporaryRedirect 11. Please re-send this request to the specified temporary endpoint. 12. Continue to use the original request endpoint for future requests. 13. awsexamplebucket1.s3-gztb4pa9sq.amazonaws.com 14. ``` #### SOAP API temporary redirect response **Note** SOAP APIs for Amazon S3 are not available for new customers, and are approaching End of Life (EOL) on October 31, 2025. We recommend that you use either the REST API or the AWS SDKs. ``` 1. 2. 3. soapenv:Client.TemporaryRedirect 4. Please re-send this request to the specified temporary endpoint. 5. Continue to use the original request endpoint for future requests. 6. 7. images 8. s3-gztb4pa9sq.amazonaws.com 9. 10. 11. ``` ## DNS considerations One of the design requirements of Amazon S3 is extremely high availability. One of the ways we meet this requirement is by updating the IP addresses associated with the Amazon S3 endpoint in DNS as needed. These changes are automatically reflected in short-lived clients, but not in some long-lived clients. Long-lived clients will need to take special action to re-resolve the Amazon S3 endpoint periodically to benefit from these changes. For more information about virtual machines (VMs), refer to the following: + For Java, Sun's JVM caches DNS lookups forever by default; go to the "InetAddress Caching" section of [the InetAddress documentation](https://docs.oracle.com/javase/9/docs/api/java/net/InetAddress.html) for information on how to change this behavior. + For PHP, the persistent PHP VM that runs in the most popular deployment configurations caches DNS lookups until the VM is restarted. Go to [the getHostByName PHP docs.](http://us2.php.net/manual/en/function.gethostbyname.php) # Developing with Amazon S3 using the AWS CLI The Amazon S3 AWS CLI commands are organized into different sets in AWS CLI Command Reference and each has it’s own available commands. If you don't find the command that you're looking for in one set, check one of the other sets. The different sets are as follows: + `s3` – Describes high-level commands for working with objects and buckets. These include copy, list and move actions. For a complete list of commands in this set, see [s3](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3/index.html) in the AWS CLI Command Reference. + `s3api` – Describes low-level commands that manage S3 resources such as buckets, objects, sessions and multipart uploads. These commands correspond to the [Amazon S3 API](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations_Amazon_Simple_Storage_Service.html) operations. For a complete list of CLI commands in this set, see [s3api](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/index.html) in the AWS CLI Command Reference. + `s3control` – Describes low-level commands that manage all other S3 resources such as Access Grants, Storage Lens groups, and Amazon S3 on Outposts buckets. These commands correspond to the [Amazon S3 Control](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations_AWS_S3_Control.html) API operations. For a complete list of CLI commands in this set, see [s3control](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3control/index.html) in the AWS CLI Command Reference. If you are having issues setting up the AWS CLI, see [see How do I resolve the "Unable to locate credentials" error in Amazon S3](https://repost.aws/knowledge-center/s3-locate-credentials-error) in the AWS re:Post Knowledge Center. **Note** Services in AWS, such as Amazon S3, require that you provide credentials when you access them. The service can then determine whether you have permissions to access the resources that it owns. The console requires your password. You can create access keys for your AWS account to access the AWS CLI or API. However, we don't recommend that you access AWS using the credentials for your AWS account. Instead, we recommend that you use AWS Identity and Access Management (IAM). Create an IAM user, add the user to an IAM group with administrative permissions, and then grant administrative permissions to the IAM user that you created. You can then access AWS using a special URL and the credentials of that IAM user. For instructions, go to [Creating Your First IAM user and Administrators Group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html) in the *IAM User Guide*. ## Learn more about the AWS CLI To learn more about the AWS, see the following resources: + [AWS Command Line Interface](https://aws.amazon.com/cli) + [AWS Command Line Interface User Guide for Version 2](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-welcome.html) # Developing with Amazon S3 using the AWS SDKs AWS software development kits (SDKs) are available for many popular programming languages. Each SDK provides an API, code examples, and documentation that make it easier for developers to build applications in their preferred language. **Note** You can use AWS Amplify for end-to-end fullstack development of web and mobile apps. Amplify Storage seamlessly integrates file storage and management capabilities into frontend web and mobile apps, built on top of Amazon S3. For more information, see [Storage](https://docs.amplify.aws/react/build-a-backend/storage/) in the Amplify user guide. | SDK documentation | Code examples | | --- | --- | | [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/sdk-for-cpp) | [AWS SDK for C\$1\$1 code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp) | | [AWS CLI](https://docs.aws.amazon.com/cli) | [AWS CLI code examples](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_code_examples.html) | | [AWS SDK for Go](https://docs.aws.amazon.com/sdk-for-go) | [AWS SDK for Go code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2) | | [AWS SDK for Java](https://docs.aws.amazon.com/sdk-for-java) | [AWS SDK for Java code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2) | | [AWS SDK for JavaScript](https://docs.aws.amazon.com/sdk-for-javascript) | [AWS SDK for JavaScript code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3) | | [AWS SDK for Kotlin](https://docs.aws.amazon.com/sdk-for-kotlin) | [AWS SDK for Kotlin code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin) | | [AWS SDK for .NET](https://docs.aws.amazon.com/sdk-for-net) | [AWS SDK for .NET code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3) | | [AWS SDK for PHP](https://docs.aws.amazon.com/sdk-for-php) | [AWS SDK for PHP code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php) | | [AWS Tools for PowerShell](https://docs.aws.amazon.com/powershell) | [Tools for PowerShell code examples](https://docs.aws.amazon.com/code-library/latest/ug/powershell_4_code_examples.html) | | [AWS SDK for Python (Boto3)](https://docs.aws.amazon.com/pythonsdk) | [AWS SDK for Python (Boto3) code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python) | | [AWS SDK for Ruby](https://docs.aws.amazon.com/sdk-for-ruby) | [AWS SDK for Ruby code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby) | | [AWS SDK for Rust](https://docs.aws.amazon.com/sdk-for-rust) | [AWS SDK for Rust code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1) | | [AWS SDK for SAP ABAP](https://docs.aws.amazon.com/sdk-for-sapabap) | [AWS SDK for SAP ABAP code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap) | | [AWS SDK for Swift](https://docs.aws.amazon.com/sdk-for-swift) | [AWS SDK for Swift code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift) | For specific examples, see [Code examples for Amazon S3 using AWS SDKs](service_code_examples.md). ## SDK Programming interfaces Each AWS SDK provides one or more programmatic interfaces for working with Amazon S3. Each SDK provides a low-level interface for Amazon S3, with methods that closely resemble API operations. Some SDKs provide high-level interfaces for Amazon S3, that are abstractions intended to simplify common use cases. For example, when you perform a multipart upload by using the low-level API operations, you use an operation to initiate the upload, another operation to upload parts, and a final operation to complete the upload. A high-level multipart upload API operation lets you to do all of the operations required for upload in a single API call. For examples, see [Uploading an object using multipart upload](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpu-upload-object.html) in the *Amazon S3 User Guide*. Low-level API operations allow greater control over the upload. We recommend that you use the low-level API operations if you need to pause and resume uploads, vary part sizes during the upload, or begin uploads when you don't know the size of the data in advance. # Specifying the Signature Version in request authentication Amazon S3 supports only AWS Signature Version 4 in most AWS Regions. In some of the older AWS Regions, Amazon S3 supports both Signature Version 4 and Signature Version 2. However, Signature Version 2 is being turned off (deprecated). For more information about the end of support for Signature Version 2, see [AWS Signature Version 2 turned off (deprecated) for Amazon S3](#UsingAWSSDK-sig2-deprecation). For a list of all the Amazon S3 Regions and the signature versions they support, see [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region) in the *AWS General Reference*. For all AWS Regions, AWS SDKs use Signature Version 4 by default to authenticate requests. When using AWS SDKs that were released before May 2016, you might be required to request Signature Version 4, as shown in the following table. | SDK | Requesting Signature Version 4 for Request Authentication | | --- | --- | | AWS CLI | For the default profile, run the following command: 
$ aws configure set default.s3.signature_version s3v4
For a custom profile, run the following command: 
$ aws configure set profile.your_profile_name.s3.signature_version s3v4
| | Java SDK | Add the following in your code: 
System.setProperty(SDKGlobalConfiguration.ENABLE_S3_SIGV4_SYSTEM_PROPERTY, "true");
Or, on the command line, specify the following: 
-Dcom.amazonaws.services.s3.enableV4
| | JavaScript SDK | Set the `signatureVersion` parameter to `v4` when constructing the client: 
var s3 = new AWS.S3({signatureVersion: 'v4'});
| | PHP SDK | Set the `signature` parameter to `v4` when constructing the Amazon S3 service client for PHP SDK v2: 
$client = S3Client::factory([
    'region' => 'YOUR-REGION',
    'version' => 'latest',
    'signature' => 'v4'
]);
When using the PHP SDK v3, set the `signature_version` parameter to `v4` during construction of the Amazon S3 service client: 
$s3 = new Aws\S3\S3Client([
    'version' => '2006-03-01',
    'region' => 'YOUR-REGION',
    'signature_version' => 'v4'
]);
| | Python-Boto SDK | Specify the following in the boto default config file: 
[s3] use-sigv4 = True
| | Ruby SDK | Ruby SDK - Version 1: Set the `:s3_signature_version` parameter to `:v4` when constructing the client: 
s3 = AWS::S3::Client.new(:s3_signature_version => :v4)
Ruby SDK - Version 3: Set the `signature_version` parameter to `v4` when constructing the client: 
s3 = Aws::S3::Client.new(signature_version: 'v4')
| | .NET SDK | Add the following to the code before creating the Amazon S3 client: 
AWSConfigsS3.UseSignatureVersion4 = true;
Or, add the following to the config file:
|   ## AWS Signature Version 2 turned off (deprecated) for Amazon S3 Signature Version 2 is being turned off (deprecated) in Amazon S3. Amazon S3 will then only accept API requests that are signed using Signature Version 4. This section provides answers to common questions regarding the end of support for Signature Version 2. **What is Signature Version 2/4, and What Does It Mean to Sign Requests?** The Signature Version 2 or Signature Version 4 signing process is used to authenticate your Amazon S3 API requests. Signing requests enables Amazon S3 to identify who is sending the request and protects your requests from bad actors. For more information about signing AWS requests, see [Signing AWS API Requests](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) in the *AWS General Reference*. **What Update Are You Making?** We currently support Amazon S3 API requests that are signed using Signature Version 2 and Signature Version 4 processes. After that, Amazon S3 will only accept requests that are signed using Signature Version 4. For more information about signing AWS requests, see [Changes in Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/sigv4_changes.html) in the *AWS General Reference*. **Why Are You Making the Update?** Signature Version 4 provides improved security by using a signing key instead of your secret access key. Signature Version 4 is currently supported in all AWS Regions, whereas Signature Version 2 is only supported in Regions that were launched before January 2014. This update allows us to provide a more consistent experience across all Regions. **How Do I Ensure That I'm Using Signature Version 4, and What Updates Do I Need?** The signature version that is used to sign your requests is usually set by the tool or the SDK on the client side. By default, the latest versions of our AWS SDKs use Signature Version 4. For third-party software, contact the appropriate support team for your software to confirm what version you need. If you are sending direct REST calls to Amazon S3, you must modify your application to use the Signature Version 4 signing process. For information about which version of the AWS SDKs to use when moving to Signature Version 4, see [Moving from Signature Version 2 to Signature Version 4](#UsingAWSSDK-move-to-Sig4). For information about using Signature Version 4 with the Amazon S3 REST API, see [Authenticating Requests (AWS Signature Version 4)](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) in the *Amazon Simple Storage Service API Reference*. **What Happens if I Don't Make Updates?** Requests signed with Signature Version 2 that are made after that will fail to authenticate with Amazon S3. Requesters will see errors stating that the request must be signed with Signature Version 4. **Should I Make Changes Even if I’m Using a Presigned URL That Requires Me to Sign for More than 7 Days?** If you are using a presigned URL that requires you to sign for more than 7 days, no action is currently needed. You can continue to use AWS Signature Version 2 to sign and authenticate the presigned URL. We will follow up and provide more details on how to migrate to Signature Version 4 for a presigned URL scenario. ### More Info + For more information about using Signature Version 4, see [Signing AWS API Requests](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html). + View the list of changes between Signature Version 2 and Signature Version 4 in [Changes in Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/sigv4_changes.html). + View the post [AWS Signature Version 4 to replace AWS Signature Version 2 for signing Amazon S3 API requests](https://forums.aws.amazon.com/ann.jspa?annID=5816) in the AWS forums. + If you have any questions or concerns, contact [Support](https://docs.aws.amazon.com/awssupport/latest/user/getting-started.html).   ## Moving from Signature Version 2 to Signature Version 4 If you currently use Signature Version 2 for Amazon S3 API request authentication, you should move to using Signature Version 4. Support is ending for Signature Version 2, as described in [AWS Signature Version 2 turned off (deprecated) for Amazon S3](#UsingAWSSDK-sig2-deprecation). For information about using Signature Version 4 with the Amazon S3 REST API, see [Authenticating Requests (AWS Signature Version 4)](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) in the *Amazon Simple Storage Service API Reference*. The following table lists the SDKs with the necessary minimum version to use Signature Version 4 (SigV4). If you are using presigned URLs with the AWS Java, JavaScript (Node.js), or Python (Boto/CLI) SDKs, you must set the correct AWS Region and set Signature Version 4 in the client configuration. For information about setting `SigV4` in the client configuration, see [Specifying the Signature Version in request authentication](#specify-signature-version). | If you use this SDK/Product | Upgrade to this SDK version | Code change needed to the client to use Sigv4? | Link to SDK documentation | | --- | --- | --- | --- | | AWS SDK for Java v1 | Upgrade to Java 1.11.201\$1 or v2. | Yes | [Specifying the Signature Version in request authentication](#specify-signature-version) | | AWS SDK for Java v2 | No SDK upgrade is needed. | No | [AWS SDK for Java](https://aws.amazon.com/sdk-for-java/) | | AWS SDK for .NET v1 | Upgrade to 3.1.10 or later. | Yes | [AWS SDK for .NET](https://github.com/aws/aws-sdk-net/tree/aws-sdk-net-v1/) | | AWS SDK for .NET v2 | Upgrade to 3.1.10 or later. | No | [AWS SDK for .NET v2](https://github.com/aws/aws-sdk-net/tree/aws-sdk-net-v2/) | | AWS SDK for .NET v3 | Upgrade to 3.3.0.0 or later. | Yes | [AWS SDK for .NET v3](https://github.com/aws/aws-sdk-net) | | AWS SDK for JavaScript v1 | Upgrade to 2.68.0 or later. | Yes | [AWS SDK for JavaScript](https://github.com/aws/aws-sdk-js) | | AWS SDK for JavaScript v2 | Upgrade to 2.68.0 or later. | Yes | [AWS SDK for JavaScript](https://github.com/aws/aws-sdk-js) | | AWS SDK for JavaScript v3 | No action is currently needed. Upgrade to major version V3 in Q3 2019. | No | [AWS SDK for JavaScript](https://github.com/aws/aws-sdk-js) | | AWS SDK for PHP v1 | Recommend to upgrade to the most recent version of PHP or, at least to v2.7.4 with the signature parameter set to v4 in the S3 client's configuration. | Yes | [AWS SDK for PHP](https://aws.amazon.com/sdk-for-php/) | | AWS SDK for PHP v2 | Recommend to upgrade to the most recent version of PHP or, at least to v2.7.4 with the signature parameter set to v4 in the S3 client's configuration. | No | [AWS SDK for PHP](https://aws.amazon.com/sdk-for-php/) | | AWS SDK for PHP v3 | No SDK upgrade is needed. | No | [AWS SDK for PHP](https://aws.amazon.com/sdk-for-php/) | | Boto2 | Upgrade to Boto2 v2.49.0. | Yes | [Boto 2 Upgrade](https://github.com/boto/boto/commit/16729da27b95d6dbbd81bcebb43bcf099ce23fd3) | | Boto3 | Upgrade to 1.5.71 (Botocore), 1.4.6 (Boto3). | Yes | [Boto 3 - AWS SDK for Python](https://github.com/boto/boto3) | | AWS CLI | Upgrade to 1.11.108. | Yes | [AWS Command Line Interface](https://aws.amazon.com/cli/) | | AWS CLI v2 (preview) | No SDK upgrade is needed. | No | [AWS Command Line Interface version 2](https://github.com/aws/aws-cli/tree/v2) | | AWS SDK for Ruby v1 | Upgrade to Ruby V3. | Yes | [Ruby V3 for AWS](https://rubygems.org/gems/aws-sdk/versions) | | AWS SDK for Ruby v2 | Upgrade to Ruby V3. | Yes | [Ruby V3 for AWS](https://rubygems.org/gems/aws-sdk/versions) | | AWS SDK for Ruby v3 | No SDK upgrade is needed. | No | [Ruby V3 for AWS](https://rubygems.org/gems/aws-sdk/versions) | | Go | No SDK upgrade is needed. | No | [AWS SDK for Go](https://aws.amazon.com/sdk-for-go/) | | C\$1\$1 | No SDK upgrade is needed. | No | [AWS SDK for C\$1\$1](https://aws.amazon.com/sdk-for-cpp/) | **AWS Tools for Windows PowerShell or AWS Tools for PowerShell Core** If you are using module versions *earlier* than 3.3.0.0, you must upgrade to 3.3.0.0. To get the version information, use the `Get-Module` cmdlet: ``` Get-Module –Name AWSPowershell Get-Module –Name AWSPowershell.NetCore ``` To update the 3.3.0.0 version, use the `Update-Module` cmdlet: ``` Update-Module –Name AWSPowershell Update-Module –Name AWSPowershell.NetCore ``` You can use presigned URLs that are valid for more than 7 days that you will send Signature Version 2 traffic on. # Getting Amazon S3 request IDs for AWS Support Whenever you contact AWS Support because you've encountered errors or unexpected behavior in Amazon S3, you must provide the request IDs associated with the failed action. AWS Support uses these request IDs to help resolve the problems that you're experiencing. Request IDs come in pairs, are returned in every response that Amazon S3 processes (even the erroneous ones), and can be accessed through verbose logs. There are a number of common methods for getting your request IDs, including S3 server access logs and AWS CloudTrail events or data events. After you've recovered these logs, copy and retain those two values, because you'll need them when you contact AWS Support. For information about contacting AWS Support, see [Contact AWS](https://aws.amazon.com/contact-us/) or the [AWS Support Documentation](https://aws.amazon.com/documentation/aws-support/). **Topics** + [ ## Using the AWS CLI to obtain request IDs ](#cli-request-id) + [ ## Using Windows PowerShell to obtain request IDs ](#powershell-request-id) + [ ## Using AWS CloudTrail data events to obtain request IDs ](#cloudtrail-request-id) + [ ## Using S3 server access logging to obtain request IDs ](#server-access-log-request-id) + [ ## Using HTTP to obtain request IDs ](#http-request-id) + [ ## Using a web browser to obtain request IDs ](#browser-request-id) + [ ## Using the AWS SDKs to obtain request IDs ](#sdk-request-ids) ## Using the AWS CLI to obtain request IDs To get your request IDs when using the AWS Command Line Interface (AWS CLI), add `--debug` to your command. For example you should see `x-amz-request-id` and `x-amz-id-2` in the debug log as shown below: ``` ... 2025-04-30 14:35:28,572 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amz-id-2': 'a+zm50vDJH3LLmCiXvwEo0u0PtPS/qCJaBvB2ZMH9dzyzTiJhiLZkBFFoRfsPfOKztUKT/garCI=', 'x-amz-request-id': 'N4NMN0MJ4VDFZMX9', 'Date': 'Wed, 30 Apr 2025 21:35:29 GMT', 'Content-Type': 'application/xml', 'Transfer-Encoding': 'chunked', 'Server': 'AmazonS3'} ... ``` ## Using Windows PowerShell to obtain request IDs For information on recovering logs with Windows PowerShell, see the [Response Logging in AWS Tools for Windows PowerShell](https://aws.amazon.com/blogs/developer/response-logging-in-aws-tools-for-windows-powershell/) in the *AWS Developer Tools Blog*. ## Using AWS CloudTrail data events to obtain request IDs An Amazon S3 bucket that is configured with CloudTrail data events to log S3 object-level API operations provides detailed information about actions that are taken by a user, role, or an AWS service in Amazon S3. You can identify S3 request IDs by querying CloudTrail events with Athena. For more information, see [Identifying Amazon S3 requests using CloudTrail](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-request-identification.html) in the *Amazon Simple Storage Service User Guide*. ## Using S3 server access logging to obtain request IDs An Amazon S3 bucket configured for S3 server access logging provides detailed records for each request that is made to the bucket. You can identify S3 request IDs by querying the server access logs using Athena. For more information, see [Querying access logs for requests by using Amazon Athena](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-s3-access-logs-to-identify-requests.html#querying-s3-access-logs-for-requests) in the *Amazon Simple Storage Service User Guide*. ## Using HTTP to obtain request IDs You can obtain your request IDs, `x-amz-request-id` and `x-amz-id-2` by logging the bits of an HTTP request before it reaches the target application. There are a variety of third-party tools that can be used to recover verbose logs for HTTP requests. Choose one that you trust, and then run the tool to listen on the port that your Amazon S3 traffic travels on, as you send out another Amazon S3 HTTP request. For HTTP requests, the pair of request IDs will look like the following: ``` x-amz-request-id: 79104EXAMPLEB723 x-amz-id-2: IOWQ4fDEXAMPLEQM+ey7N9WgVhSnQ6JEXAMPLEZb7hSQDASK+Jd1vEXAMPLEa3Km ``` **Note** HTTPS requests are encrypted and hidden in most packet captures. ## Using a web browser to obtain request IDs Most web browsers have developer tools that you can use to view request headers. For web browser-based requests that return an error, the pair of requests IDs will look like the following examples. ``` AccessDeniedAccess Denied 79104EXAMPLEB723IOWQ4fDEXAMPLEQM+ey7N9WgVhSnQ6JEXAMPLEZb7hSQDASK+Jd1vEXAMPLEa3Km ``` To obtain the request ID pair from successful requests, use your browser's developer tools to look at the HTTP response headers. ## Using the AWS SDKs to obtain request IDs The following sections include information for configuring logging by using different AWS SDKs. **Note** Although you can enable verbose logging on every request and response, we don't recommend enabling logging in production systems, because large requests or responses can significantly slow down an application. For AWS SDK requests, the pair of request IDs will look like the following: ``` Status Code: 403, AWS Service: Amazon S3, AWS Request ID: 79104EXAMPLEB723 AWS Error Code: AccessDenied AWS Error Message: Access Denied S3 Extended Request ID: IOWQ4fDEXAMPLEQM+ey7N9WgVhSnQ6JEXAMPLEZb7hSQDASK+Jd1vEXAMPLEa3Km ``` ------ #### [ C\$1\$1 ] The type of logger and the verbosity are specified during the SDK initialization in the `SDKOptions` argument. The following example specifies the verbosity level as `LogLevel::Debug`. The default logger will write to the filesystem and the file is named using the following convention `aws_sdk_YYYY-MM-DD-HH.log`. The logger creates a new file on the hour. ``` Aws::SDKOptions options; options.loggingOptions.logLevel = Aws::Utils::Logging::LogLevel::Debug; Aws::InitAPI(options); // ... Aws::ShutdownAPI(options); ``` For more information, see [How do I turn on logging?](https://github.com/aws/aws-sdk-cpp/wiki#how-do-i-turn-on-logging) in the *AWS SDK for C\$1\$1 wiki on GitHub*. ------ #### [ Go ] You can configure logging by using SDK for Go. For more information, see [Logging](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/configure-logging.html) in the *AWS SDK for Go v2 Developer Guide*. ------ #### [ Java ] You can enable logging for specific requests or responses to catch and return only relevant headers. To do this, import the `com.amazonaws.services.s3.S3ResponseMetadata` class. Afterward, you can store the request in a variable before performing the actual request. To get the logged request or response, call `getCachedResponseMetadata(AmazonWebServiceRequest request).getRequestID()`. ``` PutObjectRequest req = new PutObjectRequest(bucketName, key, createSampleFile()); s3.putObject(req); S3ResponseMetadata md = s3.getCachedResponseMetadata(req); System.out.println("Host ID: " + md.getHostId() + " RequestID: " + md.getRequestId()); ``` Alternatively, you can use verbose logging of every Java request and response. For more information, see [Verbose Wire Logging](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/java-dg-logging.html#sdk-net-logging-verbose) in the *AWS SDK for Java Developer Guide*. ------ #### [ JavaScript ] The AWS SDK for JavaScript has a built-in logger so you can log API calls you make with it. To turn on the logger and print log entries in the console, add the following statement to your code: ``` AWS.config.logger = console; ``` For more information, see [Logging AWS SDK for JavaScript Calls](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/logging-sdk-calls.html) in the *AWS SDK for JavaScript Developer Guide*. ------ #### [ Kotlin ] With the AWS SDK for Kotlin, you can specify log mode for wire-level messages using code or environment settings. You can set log mode for HTTP requests and HTTP responses. To opt into additional logging, set the `logMode` property when you construct a service client: ``` import aws.smithy.kotlin.runtime.client.LogMode // ... val client = S3Client { // ... logMode = LogMode.LogRequestWithBody + LogMode.LogResponse } ``` Alternatively, you can set log mode using an environment variable: ``` export SDK_LOG_MODE=LogRequestWithBody|LogResponse ``` For more information, see [Logging](https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-guide/logging.html) in the *AWS SDK for Kotlin Developer Guide*. ------ #### [ .NET ] You can configure logging with the SDK for .NET by using the built-in `System.Diagnostics` logging tool. For more information, see the [ Logging with the SDK for .NET](https://aws.amazon.com/blogs/developer/logging-with-the-aws-sdk-for-net/) *AWS Developer Blog* post. **Note** By default, the returned log contains only error information. To get the request IDs, the config file must have `AWSLogMetrics` (and optionally, `AWSResponseLogging`) added. ------ #### [ PHP ] You can get debug information, including the data sent over the wire, by setting the debug option to `true` in a client constructor. ``` $s3Client = new Aws\S3\S3Client([ 'region' => 'us-standard', 'version' => '2006-03-01', 'debug' => true ]); ``` For more information, see [How can I see what data is sent over the wire?](https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/faq.html#how-can-i-see-what-data-is-sent-over-the-wire) in the *AWS SDK for PHP Developer Guide*. ------ #### [ Python (Boto3) ] With the AWS SDK for Python (Boto3), you can log specific responses. You can use this feature to capture only the relevant headers. The following code shows how to log parts of the response to a file: ``` import logging import boto3 logging.basicConfig(filename='logfile.txt', level=logging.INFO) logger = logging.getLogger(__name__) s3 = boto3.resource('s3') response = s3.Bucket(bucket_name).Object(object_key).put() logger.info("HTTPStatusCode: %s", response['ResponseMetadata']['HTTPStatusCode']) logger.info("RequestId: %s", response['ResponseMetadata']['RequestId']) logger.info("HostId: %s", response['ResponseMetadata']['HostId']) logger.info("Date: %s", response['ResponseMetadata']['HTTPHeaders']['date']) ``` You can also catch exceptions and log relevant information when an exception is raised. For more information, see [Discerning useful information from error responses](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/error-handling.html#discerning-useful-information-from-error-responses) in the *AWS SDK for Python (Boto) API Reference*. Additionally, you can configure Boto3 to output verbose debugging logs by using the following code: ``` import logging import boto3 boto3.set_stream_logger('', logging.DEBUG) ``` For more information, see [https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/boto3.html#boto3.set_stream_logger](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/boto3.html#boto3.set_stream_logger) in the *AWS SDK for Python (Boto) API Reference*. ------ #### [ Ruby ] You can get your request IDs using the SDK for Ruby Version 3. You can enable HTTP wire logging in your client using the following code: ``` s3 = Aws::S3::Client.new(http_wire_trace: true) ``` **Note** Wire logging can include sensitive information, such as your access key ID. Sensitive information should be sanitized before sharing it with AWS Support. You can also find the request ID of the request context object in the request response or error: ``` # Finding the request ID from an error: begin s3.put_object(bucket: 'bucket', key: 'key', body: 'test') rescue Aws::S3::Errors::ServiceError => e puts e.context[:request_id] puts e.context[:s3_host_id] end # Finding the request ID from a successful call: resp = s3.put_object(bucket: 'bucket', key: 'key', body: 'test') puts resp.context[:request_id] puts resp.context[:s3_host_id] ``` For more information, see [Debugging using wire trace information from an AWS SDK for Ruby client](https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/debugging.html) in the *AWS SDK for Ruby Developer Guide*. ------ #### [ Rust ] To enable logging, add the `tracing-subscriber` crate and initialize it in your Rust application. Add the tracing library to your `Cargo.toml` file: ``` tracing-subscriber = { version = "0.3", features = ["env-filter"] } ``` Then, in your Rust code, initialize the logger in the main function before you call any SDK operation: ``` tracing_subscriber::fmt::init(); ``` For more information, see [Configuring and using logging in the AWS SDK for Rust](https://docs.aws.amazon.com/sdk-for-rust/latest/dg/logging.html) in the *AWS SDK for Rust Developer Guide*. ------ # Supported Amazon S3 object-level API operations for S3 Tables The following table includes supported S3 object-level API operations and corresponding headers for S3 Tables. For a list of Amazon S3 Tables APIs, see [Amazon S3 Tables](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations_Amazon_S3_Tables.html). For more information about Amazon S3 Tables, see [Working with Amazon S3 Tables and table buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables.html) in the *Amazon S3 User Guide*. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/AmazonS3/latest/API/developing-s3-tables-APIs.html)