The AWS::S3::AccessGrantsLocation resource creates the S3 data location that you would like to register in your S3 Access Grants instance. Your S3 data must be in the same Region as your S3 Access Grants instance. The location can be one of the following:
-
The default S3 location
s3:// -
A bucket -
S3://<bucket-name> -
A bucket and prefix -
S3://<bucket-name>/<prefix>
When you register a location, you must include the IAM role that has permission to manage the S3 location that you are registering. Give S3 Access Grants permission to assume this role using a policy. S3 Access Grants assumes this role to manage access to the location and to vend temporary credentials to grantees or client applications.
- Permissions
-
You must have the
s3:CreateAccessGrantsLocationpermission to use this resource. - Additional Permissions
-
You must also have the following permission for the specified IAM role:
iam:PassRole
Syntax
To declare this entity in your AWS CloudFormation template, use the following syntax:
JSON
{
"Type" : "AWS::S3::AccessGrantsLocation",
"Properties" : {
"IamRoleArn" : String,
"LocationScope" : String,
"Tags" : [ Tag, ... ]
}
}
YAML
Type: AWS::S3::AccessGrantsLocation
Properties:
IamRoleArn: String
LocationScope: String
Tags:
- Tag
Properties
IamRoleArn-
The Amazon Resource Name (ARN) of the IAM role for the registered location. S3 Access Grants assumes this role to manage access to the registered location.
Required: No
Type: String
Update requires: No interruption
LocationScope-
The S3 URI path to the location that you are registering. The location scope can be the default S3 location
s3://, the S3 path to a bucket, or the S3 path to a bucket and prefix. A prefix in S3 is a string of characters at the beginning of an object key name used to organize the objects that you store in your S3 buckets. For example, object key names that start with theengineering/prefix or object key names that start with themarketing/campaigns/prefix.Required: No
Type: String
Update requires: No interruption
-
The AWS resource tags that you are adding to the S3 Access Grants location. Each tag is a label consisting of a user-defined key and value. Tags can help you manage, identify, organize, search for, and filter resources.
Required: No
Type: Array of Tag
Update requires: Replacement
Return values
Ref
When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns some information about the S3 data location.
For more information about using the Ref function, see Ref.
Fn::GetAtt
The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.
For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.
AccessGrantsLocationArn-
The ARN of the location you are registering.
AccessGrantsLocationId-
The ID of the registered location to which you are granting access. S3 Access Grants assigns this ID when you register the location. S3 Access Grants assigns the ID
defaultto the default locations3://and assigns an auto-generated ID to other locations that you register.
