aws-sdk-s3 1.102.0 → 1.105.1

data/lib/aws-sdk-s3/client_api.rb

@@ -22,6 +22,7 @@ module Aws::S3
     AcceptRanges = Shapes::StringShape.new(name: 'AcceptRanges')
     AccessControlPolicy = Shapes::StructureShape.new(name: 'AccessControlPolicy')
     AccessControlTranslation = Shapes::StructureShape.new(name: 'AccessControlTranslation')
+    AccessPointArn = Shapes::StringShape.new(name: 'AccessPointArn')
     AccountId = Shapes::StringShape.new(name: 'AccountId')
     AllowQuotedRecordDelimiter = Shapes::BooleanShape.new(name: 'AllowQuotedRecordDelimiter')
     AllowedHeader = Shapes::StringShape.new(name: 'AllowedHeader')
@@ -1686,6 +1687,7 @@ module Aws::S3
 
     MetricsAndOperator.add_member(:prefix, Shapes::ShapeRef.new(shape: Prefix, location_name: "Prefix"))
     MetricsAndOperator.add_member(:tags, Shapes::ShapeRef.new(shape: TagSet, location_name: "Tag", metadata: {"flattened"=>true}))
+    MetricsAndOperator.add_member(:access_point_arn, Shapes::ShapeRef.new(shape: AccessPointArn, location_name: "AccessPointArn"))
     MetricsAndOperator.struct_class = Types::MetricsAndOperator
 
     MetricsConfiguration.add_member(:id, Shapes::ShapeRef.new(shape: MetricsId, required: true, location_name: "Id"))
@@ -1696,6 +1698,7 @@ module Aws::S3
 
     MetricsFilter.add_member(:prefix, Shapes::ShapeRef.new(shape: Prefix, location_name: "Prefix"))
     MetricsFilter.add_member(:tag, Shapes::ShapeRef.new(shape: Tag, location_name: "Tag"))
+    MetricsFilter.add_member(:access_point_arn, Shapes::ShapeRef.new(shape: AccessPointArn, location_name: "AccessPointArn"))
     MetricsFilter.add_member(:and, Shapes::ShapeRef.new(shape: MetricsAndOperator, location_name: "And"))
     MetricsFilter.struct_class = Types::MetricsFilter
 

data/lib/aws-sdk-s3/object.rb

@@ -184,10 +184,10 @@ module Aws::S3
     end
 
     # If the object is stored using server-side encryption either with an
-    # Amazon Web Services KMS customer master key (CMK) or an Amazon
-    # S3-managed encryption key, the response includes this header with the
-    # value of the server-side encryption algorithm used when storing this
-    # object in Amazon S3 (for example, AES256, aws:kms).
+    # Amazon Web Services KMS key or an Amazon S3-managed encryption key,
+    # the response includes this header with the value of the server-side
+    # encryption algorithm used when storing this object in Amazon S3 (for
+    # example, AES256, aws:kms).
     # @return [String]
     def server_side_encryption
       data[:server_side_encryption]
@@ -217,8 +217,8 @@ module Aws::S3
     end
 
     # If present, specifies the ID of the Amazon Web Services Key Management
-    # Service (Amazon Web Services KMS) symmetric customer managed customer
-    # master key (CMK) that was used for the object.
+    # Service (Amazon Web Services KMS) symmetric customer managed key that
+    # was used for the object.
     # @return [String]
     def ssekms_key_id
       data[:ssekms_key_id]
@@ -1028,13 +1028,13 @@ module Aws::S3
     #   RFC 1321. Amazon S3 uses this header for a message integrity check to
     #   ensure that the encryption key was transmitted without error.
     # @option options [String] :ssekms_key_id
-    #   Specifies the ID of the symmetric customer managed Amazon Web Services
-    #   KMS CMK to use for object encryption. All GET and PUT requests for an
-    #   object protected by Amazon Web Services KMS will fail if not made via
-    #   SSL or using SigV4. For information about configuring using any of the
-    #   officially supported Amazon Web Services SDKs and Amazon Web Services
-    #   CLI, see [Specifying the Signature Version in Request
-    #   Authentication][1] in the *Amazon S3 User Guide*.
+    #   Specifies the ID of the symmetric customer managed key to use for
+    #   object encryption. All GET and PUT requests for an object protected by
+    #   Amazon Web Services KMS will fail if not made via SSL or using SigV4.
+    #   For information about configuring using any of the officially
+    #   supported Amazon Web Services SDKs and Amazon Web Services CLI, see
+    #   [Specifying the Signature Version in Request Authentication][1] in the
+    #   *Amazon S3 User Guide*.
     #
     #
     #
@@ -1277,12 +1277,12 @@ module Aws::S3
     #   If `x-amz-server-side-encryption` is present and has the value of
     #   `aws:kms`, this header specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetrical customer
-    #   managed customer master key (CMK) that was used for the object. If you
-    #   specify `x-amz-server-side-encryption:aws:kms`, but do not provide`
+    #   managed key that was used for the object. If you specify
+    #   `x-amz-server-side-encryption:aws:kms`, but do not provide`
     #   x-amz-server-side-encryption-aws-kms-key-id`, Amazon S3 uses the
-    #   Amazon Web Services managed CMK in Amazon Web Services to protect the
-    #   data. If the KMS key does not exist in the same account issuing the
-    #   command, you must use the full ARN and not just the ID.
+    #   Amazon Web Services managed key to protect the data. If the KMS key
+    #   does not exist in the same account issuing the command, you must use
+    #   the full ARN and not just the ID.
     # @option options [String] :ssekms_encryption_context
     #   Specifies the Amazon Web Services KMS Encryption Context to use for
     #   object encryption. The value of this header is a base64-encoded UTF-8

data/lib/aws-sdk-s3/object_summary.rb

@@ -772,13 +772,13 @@ module Aws::S3
     #   RFC 1321. Amazon S3 uses this header for a message integrity check to
     #   ensure that the encryption key was transmitted without error.
     # @option options [String] :ssekms_key_id
-    #   Specifies the ID of the symmetric customer managed Amazon Web Services
-    #   KMS CMK to use for object encryption. All GET and PUT requests for an
-    #   object protected by Amazon Web Services KMS will fail if not made via
-    #   SSL or using SigV4. For information about configuring using any of the
-    #   officially supported Amazon Web Services SDKs and Amazon Web Services
-    #   CLI, see [Specifying the Signature Version in Request
-    #   Authentication][1] in the *Amazon S3 User Guide*.
+    #   Specifies the ID of the symmetric customer managed key to use for
+    #   object encryption. All GET and PUT requests for an object protected by
+    #   Amazon Web Services KMS will fail if not made via SSL or using SigV4.
+    #   For information about configuring using any of the officially
+    #   supported Amazon Web Services SDKs and Amazon Web Services CLI, see
+    #   [Specifying the Signature Version in Request Authentication][1] in the
+    #   *Amazon S3 User Guide*.
     #
     #
     #
@@ -1021,12 +1021,12 @@ module Aws::S3
     #   If `x-amz-server-side-encryption` is present and has the value of
     #   `aws:kms`, this header specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetrical customer
-    #   managed customer master key (CMK) that was used for the object. If you
-    #   specify `x-amz-server-side-encryption:aws:kms`, but do not provide`
+    #   managed key that was used for the object. If you specify
+    #   `x-amz-server-side-encryption:aws:kms`, but do not provide`
     #   x-amz-server-side-encryption-aws-kms-key-id`, Amazon S3 uses the
-    #   Amazon Web Services managed CMK in Amazon Web Services to protect the
-    #   data. If the KMS key does not exist in the same account issuing the
-    #   command, you must use the full ARN and not just the ID.
+    #   Amazon Web Services managed key to protect the data. If the KMS key
+    #   does not exist in the same account issuing the command, you must use
+    #   the full ARN and not just the ID.
     # @option options [String] :ssekms_encryption_context
     #   Specifies the Amazon Web Services KMS Encryption Context to use for
     #   object encryption. The value of this header is a base64-encoded UTF-8

data/lib/aws-sdk-s3/plugins/accelerate.rb

@@ -41,11 +41,17 @@ each bucket. [Go here for more information](http://docs.aws.amazon.com/AmazonS3/
               accelerate = context.params.delete(:use_accelerate_endpoint)
             end
             accelerate = context.config.use_accelerate_endpoint if accelerate.nil?
-            # Raise if :endpoint and dualstack are both provided
+            # Raise if :endpoint and accelerate are both provided
             if accelerate && !context.config.regional_endpoint
               raise ArgumentError,
                     'Cannot use both :use_accelerate_endpoint and :endpoint'
             end
+            # Raise if :use_fips_endpoint and accelerate are both provided
+            if accelerate && context.config.use_fips_endpoint
+              raise ArgumentError,
+                    'Cannot use both :use_accelerate_endpoint and '\
+                    ':use_fips_endpoint'
+            end
             context[:use_accelerate_endpoint] = accelerate
             @handler.call(context)
           end

data/lib/aws-sdk-s3/plugins/arn.rb

@@ -77,17 +77,10 @@ result in cross region requests.
               if arn
                 validate_config!(context, arn)
 
-                fips = false
-                if resolved_region.include?('fips')
-                  fips = true
-                  resolved_region = resolved_region.gsub('fips-', '')
-                                                   .gsub('-fips', '')
-                end
-
                 context.metadata[:s3_arn] = {
                   arn: arn,
                   resolved_region: resolved_region,
-                  fips: fips,
+                  fips: context.config.use_fips_endpoint,
                   dualstack: extract_dualstack_config!(context)
                 }
               end
@@ -126,7 +119,8 @@ result in cross region requests.
 
             if !arn.support_dualstack? && context[:use_dualstack_endpoint]
               raise ArgumentError,
-                    'Cannot provide an Outpost Access Point or Multi-region Access Point ARN'\
+                    'Cannot provide an Outpost Access Point, Object Lambda, '\
+                    'or Multi-region Access Point ARN'\
                     ' when `:use_dualstack_endpoint` is set to true.'
             end
 
@@ -135,6 +129,12 @@ result in cross region requests.
                     'Cannot provide a Multi-region Access Point ARN with '\
                     '`:s3_disable_multiregion_access_points` set to true'
             end
+
+            if context.config.use_fips_endpoint && !arn.support_fips?
+              raise ArgumentError,
+                    'FIPS client regions are not supported for this type '\
+                    'of ARN.'
+            end
           end
         end
 
@@ -146,7 +146,7 @@ result in cross region requests.
               s3_arn = resolve_arn_type!(arn)
               s3_arn.validate_arn!
               validate_region_config!(s3_arn, region, use_arn_region)
-              region = s3_arn.region if use_arn_region && !region.include?('fips')
+              region = s3_arn.region if use_arn_region
               [region, s3_arn]
             else
               [region]
@@ -231,19 +231,6 @@ result in cross region requests.
                 raise Aws::Errors::InvalidARNPartitionError
               end
             else
-              if region.include?('fips')
-                # If ARN type doesn't support FIPS but the client region is FIPS
-                unless arn.support_fips?
-                  raise ArgumentError,
-                        'FIPS client regions are not supported for this type '\
-                        'of ARN.'
-                end
-
-                fips = true
-                # Normalize the region so we can compare partition and regions
-                region = region.gsub('fips-', '').gsub('-fips', '')
-              end
-
               # use_arn_region does not apply to MRAP (global) arns
               unless arn.region.empty?
                 # Raise if the ARN and client regions are in different partitions
@@ -254,7 +241,7 @@ result in cross region requests.
 
                 # Raise if regions mismatch
                 # Either when it's a fips client or not using the ARN region
-                if (!use_arn_region || fips) && region != arn.region
+                if !use_arn_region && region != arn.region
                   raise Aws::Errors::InvalidARNRegionError
                 end
               end

data/lib/aws-sdk-s3/plugins/bucket_dns.rb

@@ -24,7 +24,7 @@ request URI and never moved to the host as a sub-domain.
           DOCS
 
         def add_handlers(handlers, config)
-          handlers.add(Handler) unless config.force_path_style
+          handlers.add(Handler, priority: 48) unless config.force_path_style
         end
 
         # @api private

data/lib/aws-sdk-s3/plugins/dualstack.rb

@@ -5,18 +5,9 @@ module Aws
     module Plugins
       # @api private
       class Dualstack < Seahorse::Client::Plugin
-
-        option(:use_dualstack_endpoint,
-          default: false,
-          doc_type: 'Boolean',
-          docstring: <<-DOCS)
-When set to `true`, IPv6-compatible bucket endpoints will be used
-for all operations.
-          DOCS
-
         def add_handlers(handlers, config)
           handlers.add(OptionHandler, step: :initialize)
-          handlers.add(DualstackHandler, step: :build, priority: 11)
+          handlers.add(DualstackHandler, step: :build, priority: 49)
         end
 
         # @api private
@@ -40,38 +31,41 @@ for all operations.
         # @api private
         class DualstackHandler < Seahorse::Client::Handler
           def call(context)
-            if context.config.regional_endpoint && use_dualstack_endpoint?(context)
+            # only rewrite the endpoint if it's not a custom endpoint
+            # accelerate/ARN already handle dualstack cases, so ignore these
+            # check to see if dualstack is on but configured off via operation
+            if context.config.regional_endpoint &&
+               use_dualstack_endpoint?(context)
               apply_dualstack_endpoint(context)
             end
             @handler.call(context)
           end
 
           private
-          def apply_dualstack_endpoint(context)
-            bucket_name = context.params[:bucket]
-            region = context.config.region
-            dns_suffix = Aws::Partitions::EndpointProvider.dns_suffix_for(region)
 
-            if use_bucket_dns?(bucket_name, context)
-              host = "#{bucket_name}.s3.dualstack.#{region}.#{dns_suffix}"
-            else
-              host = "s3.dualstack.#{region}.#{dns_suffix}"
-            end
+          def apply_dualstack_endpoint(context)
+            new_endpoint = Aws::Partitions::EndpointProvider.resolve(
+              context.config.region,
+              's3',
+              'regional',
+              {
+                dualstack: context[:use_dualstack_endpoint],
+                fips: context.config.use_fips_endpoint
+              }
+            )
             endpoint = URI.parse(context.http_request.endpoint.to_s)
-            endpoint.scheme = context.http_request.endpoint.scheme
-            endpoint.port = context.http_request.endpoint.port
-            endpoint.host = host
-            context.http_request.endpoint = endpoint.to_s
-          end
-
-          def use_bucket_dns?(bucket_name, context)
-            ssl = context.http_request.endpoint.scheme == "https"
-            bucket_name && BucketDns.dns_compatible?(bucket_name, ssl) &&
-              !context.config.force_path_style
+            endpoint.host = URI.parse(new_endpoint).host
+            context.http_request.endpoint = endpoint
           end
 
           def use_dualstack_endpoint?(context)
-            context[:use_dualstack_endpoint] && !context[:use_accelerate_endpoint]
+            # case when dualstack is turned off via operation
+            (context[:use_dualstack_endpoint] ||
+              context.config.use_dualstack_endpoint) &&
+              # accelerate plugin already applies dualstack
+              !context[:use_accelerate_endpoint] &&
+              # arns handle dualstack
+              !context.metadata[:s3_arn]
           end
         end
 

data/lib/aws-sdk-s3/plugins/s3_signer.rb

@@ -22,7 +22,9 @@ module Aws
           # S3 removes core's signature_v4 plugin that checks for this
           raise Aws::Errors::MissingRegionError if cfg.region.nil?
 
-          Aws::Partitions::EndpointProvider.signing_region(cfg.region, 's3')
+          Aws::Partitions::EndpointProvider.signing_region(
+            cfg.region, 's3'
+          )
         end
 
         def add_handlers(handlers, cfg)
@@ -162,7 +164,12 @@ module Aws
 
           def custom_endpoint?(resp)
             resolved_suffix = Aws::Partitions::EndpointProvider.dns_suffix_for(
-              resp.context.config.region
+              resp.context.config.region,
+              's3',
+              {
+                dualstack: resp.context[:use_dualstack_endpoint],
+                fips: resp.context.config.use_fips_endpoint
+              }
             )
             !resp.context.http_request.endpoint.hostname.include?(resolved_suffix)
           end
@@ -234,12 +241,20 @@ module Aws
           # Otherwise it will retry with the ARN as the bucket name.
           def new_hostname(context, region)
             uri = URI.parse(
-              Aws::Partitions::EndpointProvider.resolve(region, 's3')
+              Aws::Partitions::EndpointProvider.resolve(
+                region, 's3', 'regional',
+                {
+                  dualstack: context[:use_dualstack_endpoint],
+                  fips: context.config.use_fips_endpoint
+                }
+              )
             )
 
             if (arn = context.metadata[:s3_arn])
               # Retry with the response region and not the ARN resolved one
-              ARN.resolve_url!(uri, arn[:arn], region).host
+              ARN.resolve_url!(
+                uri, arn[:arn], region, arn[:fips], arn[:dualstack]
+              ).host
             else
               "#{context.params[:bucket]}.#{uri.host}"
             end