Configuring Amazon S3 Inventory

To grant Amazon S3 permissions to encrypt by using your customer managed key

1. Using the AWS account that owns the customer managed key, sign into the AWS Management Console.

2. Open the AWS KMS console at https://console.aws.amazon.com/kms.

3. To change the AWS Region, use the Region selector in the upper-right corner of the page.

4. In the left navigation pane, choose Customer managed keys.

5. Under Customer managed keys, choose the customer managed key that you want to use to encrypt your inventory files.

6. In the Key policy section, choose Switch to policy view.

7. To update the key policy, choose Edit.

8. On the Edit key policy page, add the following lines to the existing key policy. For source-account-id and amzn-s3-demo-source-bucket, supply the appropriate values for your use case.

   {
       "Sid": "Allow Amazon S3 use of the customer managed key",
       "Effect": "Allow",
       "Principal": {
           "Service": "s3.amazonaws.com"
       },
       "Action": [
           "kms:GenerateDataKey"
       ],
       "Resource": "*",
       "Condition":{
         "StringEquals":{
            "aws:SourceAccount":"source-account-id"
        },
         "ArnLike":{
           "aws:SourceARN": "arn:aws:s3:::amzn-s3-demo-source-bucket"
        }
      }
   }

9. Choose Save changes.

Use these instructions to configure inventory by using the S3 console.

1. Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.

2. In the left navigation pane, choose Buckets. In the Buckets list, choose the name of the bucket that you want to configure Amazon S3 Inventory for.

3. Choose the Management tab.

4. Under Inventory configurations, choose Create inventory configuration.

5. For Inventory configuration name, enter a name.

6. For Inventory scope, do the following:

   • Enter an optional prefix.

   • Choose which object versions to include, either Current versions only or Include all versions.

7. Under Report details, choose the location of the AWS account that you want to save the reports to: This account or A different account.

8. Under Destination, choose the destination bucket where you want the inventory reports to be saved.

   The destination bucket must be in the same AWS Region as the bucket for which you are setting up the inventory. The destination bucket can be in a different AWS account. When specifying the destination bucket, you can also include an optional prefix to group your inventory reports together.

   Under the Destination bucket field, you see the Destination bucket permission statement that is added to the destination bucket policy to allow Amazon S3 to place data in that bucket. For more information, see Creating a destination bucket policy.

9. Under Frequency, choose how often the report will be generated, Daily or Weekly.

10. For Output format, choose one of the following formats for the report:

    • CSV – If you plan to use this inventory report with S3 Batch Operations or if you want to analyze this report in another tool, such as Microsoft Excel, choose CSV.

    • Apache ORC

    • Apache Parquet

11. Under Status, choose Enable or Disable.

12. To configure server-side encryption, under Inventory report encryption, follow these steps:

    1. Under Server-side encryption, choose either Do not specify an encryption key or Specify an encryption key to encrypt data.

       • To keep the bucket settings for default server-side encryption of objects when storing them in Amazon S3, choose Do not specify an encryption key. As long as the bucket destination has S3 Bucket Keys enabled, the copy operation applies an S3 Bucket Key at the destination bucket.

         Note

         If the bucket policy for the specified destination requires objects to be encrypted before storing them in Amazon S3, you must choose Specify an encryption key. Otherwise, copying objects to the destination will fail.

       • To encrypt objects before storing them in Amazon S3, choose Specify an encryption key.

    2. If you chose Specify an encryption key, under Encryption type, you must choose either Amazon S3 managed key (SSE-S3) or AWS Key Management Service key (SSE-KMS).

       SSE-S3 uses one of the strongest block ciphers—256-bit Advanced Encryption Standard (AES-256) to encrypt each object. SSE-KMS provides you with more control over your key. For more information about SSE-S3, see Using server-side encryption with Amazon S3 managed keys (SSE-S3). For more information about SSE-KMS, see Using server-side encryption with AWS KMS keys (SSE-KMS).

       Note

       To encrypt the inventory list file with SSE-KMS, you must grant Amazon S3 permission to use the customer managed key. For instructions, see Grant Amazon S3 Permission to Encrypt Using Your KMS Keys.

    3. If you chose AWS Key Management Service key (SSE-KMS), under AWS KMS key, you can specify your AWS KMS key through one of the following options.

       Note

       If the destination bucket that stores the inventory list file is owned by a different AWS account, make sure that you use a fully qualified KMS key ARN to specify your KMS key.

       • To choose from a list of available KMS keys, choose Choose from your AWS KMS keys, and choose a symmetric encryption KMS key from the list of available keys. Make sure the KMS key is in the same Region as your bucket.

         Note

         Both the AWS managed key (aws/s3) and your customer managed keys appear in the list. However, the AWS managed key (aws/s3) is not supported for SSE-KMS encryption with S3 Inventory.

       • To enter the KMS key ARN, choose Enter AWS KMS key ARN, and enter your KMS key ARN in the field that appears.

       • To create a new customer managed key in the AWS KMS console, choose Create a KMS key.

13. For Additional metadata fields, select one or more of the following to add to the inventory report:

    • Size – The object size in bytes, not including the size of incomplete multipart uploads, object metadata, and delete markers.

    • Last modified date – The object creation date or the last modified date, whichever is the latest.

    • Multipart upload – Specifies that the object was uploaded as a multipart upload. For more information, see Uploading and copying objects using multipart upload in Amazon S3.

    • Replication status – The replication status of the object. For more information, see Getting replication status information.

    • Encryption status – The server-side encryption type that's used to encrypt the object. For more information, see Protecting data with server-side encryption.

    • Bucket Key status – Indicates whether a bucket-level key generated by AWS KMS applies to the object. For more information, see Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys.

    • Object access control list – An access control list (ACL) for each object that defines which AWS accounts or groups are granted access to this object and the type of access that is granted. For more information about this field, see Working with the Object ACL field. For more information about ACLs, see Access control list (ACL) overview.

    • Object owner – The owner of the object.

    • Storage class – The storage class that's used for storing the object.

    • Intelligent-Tiering: Access tier – Indicates the access tier (frequent or infrequent) of the object if it was stored in the S3 Intelligent-Tiering storage class. For more information, see Storage class for automatically optimizing data with changing or unknown access patterns.

    • ETag – The entity tag (ETag) is a hash of the object. The ETag reflects changes only to the contents of an object, not to its metadata. The ETag might or might not be an MD5 digest of the object data. Whether it is depends on how the object was created and how it is encrypted. For more information, see Object in the Amazon Simple Storage Service API Reference.

    • Checksum algorithm – Indicates the algorithm that is used to create the checksum for the object. For more information, see Using supported checksum algorithms.

    • All Object Lock configurations – The Object Lock status of the object, including the following settings:

      • Object Lock: Retention mode – The level of protection applied to the object, either Governance or Compliance.

      • Object Lock: Retain until date – The date until which the locked object cannot be deleted.

      • Object Lock: Legal hold status – The legal hold status of the locked object.

      For information about S3 Object Lock, see How S3 Object Lock works.

    For more information about the contents of an inventory report, see Amazon S3 Inventory list.

    For more information about restricting access to certain optional metadata fields in an inventory configuration, see Control S3 Inventory report configuration creation.

14. Choose Create.