aws-sdk-s3 1.132.0 → 1.142.0

data/lib/aws-sdk-s3/object_version.rb

@@ -93,7 +93,7 @@ module Aws::S3
       data[:is_latest]
     end
 
-    # Date and time the object was last modified.
+    # Date and time when the object was last modified.
     # @return [Time]
     def last_modified
       data[:last_modified]
@@ -264,13 +264,23 @@ module Aws::S3
     #   space, and the value that is displayed on your authentication device.
     #   Required to permanently delete a versioned object if versioning is
     #   configured with MFA delete enabled.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
     # @option options [String] :request_payer
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
-    #   requests. For information about downloading objects from Requester
+    #   requests. If either the source or destination S3 bucket has Requester
+    #   Pays enabled, the requester will pay for corresponding charges to copy
+    #   the object. For information about downloading objects from Requester
     #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
     #   in the *Amazon S3 User Guide*.
     #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
+    #
     #
     #
     #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
@@ -278,10 +288,14 @@ module Aws::S3
     #   Indicates whether S3 Object Lock should bypass Governance-mode
     #   restrictions to process this operation. To use this header, you must
     #   have the `s3:BypassGovernanceRetention` permission.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
     # @option options [String] :expected_bucket_owner
-    #   The account ID of the expected bucket owner. If the bucket is owned by
-    #   a different account, the request fails with the HTTP status code `403
-    #   Forbidden` (access denied).
+    #   The account ID of the expected bucket owner. If the account ID that
+    #   you provide does not match the actual owner of the bucket, the request
+    #   fails with the HTTP status code `403 Forbidden` (access denied).
     # @return [Types::DeleteObjectOutput]
     def delete(options = {})
       options = options.merge(
@@ -320,18 +334,64 @@ module Aws::S3
     # @param [Hash] options ({})
     # @option options [String] :if_match
     #   Return the object only if its entity tag (ETag) is the same as the one
-    #   specified; otherwise, return a 412 (precondition failed) error.
+    #   specified in this header; otherwise, return a `412 Precondition
+    #   Failed` error.
+    #
+    #   If both of the `If-Match` and `If-Unmodified-Since` headers are
+    #   present in the request as follows: `If-Match` condition evaluates to
+    #   `true`, and; `If-Unmodified-Since` condition evaluates to `false`;
+    #   then, S3 returns `200 OK` and the data requested.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
     # @option options [Time,DateTime,Date,Integer,String] :if_modified_since
     #   Return the object only if it has been modified since the specified
-    #   time; otherwise, return a 304 (not modified) error.
+    #   time; otherwise, return a `304 Not Modified` error.
+    #
+    #   If both of the `If-None-Match` and `If-Modified-Since` headers are
+    #   present in the request as follows:` If-None-Match` condition evaluates
+    #   to `false`, and; `If-Modified-Since` condition evaluates to `true`;
+    #   then, S3 returns `304 Not Modified` status code.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
     # @option options [String] :if_none_match
     #   Return the object only if its entity tag (ETag) is different from the
-    #   one specified; otherwise, return a 304 (not modified) error.
+    #   one specified in this header; otherwise, return a `304 Not Modified`
+    #   error.
+    #
+    #   If both of the `If-None-Match` and `If-Modified-Since` headers are
+    #   present in the request as follows:` If-None-Match` condition evaluates
+    #   to `false`, and; `If-Modified-Since` condition evaluates to `true`;
+    #   then, S3 returns `304 Not Modified` HTTP status code.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
     # @option options [Time,DateTime,Date,Integer,String] :if_unmodified_since
     #   Return the object only if it has not been modified since the specified
-    #   time; otherwise, return a 412 (precondition failed) error.
+    #   time; otherwise, return a `412 Precondition Failed` error.
+    #
+    #   If both of the `If-Match` and `If-Unmodified-Since` headers are
+    #   present in the request as follows: `If-Match` condition evaluates to
+    #   `true`, and; `If-Unmodified-Since` condition evaluates to `false`;
+    #   then, S3 returns `200 OK` and the data requested.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
     # @option options [String] :range
-    #   Downloads the specified range bytes of an object. For more information
+    #   Downloads the specified byte range of an object. For more information
     #   about the HTTP Range header, see
     #   [https://www.rfc-editor.org/rfc/rfc9110.html#name-range][1].
     #
@@ -346,7 +406,7 @@ module Aws::S3
     # @option options [String] :response_cache_control
     #   Sets the `Cache-Control` header of the response.
     # @option options [String] :response_content_disposition
-    #   Sets the `Content-Disposition` header of the response
+    #   Sets the `Content-Disposition` header of the response.
     # @option options [String] :response_content_encoding
     #   Sets the `Content-Encoding` header of the response.
     # @option options [String] :response_content_language
@@ -356,25 +416,99 @@ module Aws::S3
     # @option options [Time,DateTime,Date,Integer,String] :response_expires
     #   Sets the `Expires` header of the response.
     # @option options [String] :sse_customer_algorithm
-    #   Specifies the algorithm to use to when decrypting the object (for
-    #   example, AES256).
+    #   Specifies the algorithm to use when decrypting the object (for
+    #   example, `AES256`).
+    #
+    #   If you encrypt an object by using server-side encryption with
+    #   customer-provided encryption keys (SSE-C) when you store the object in
+    #   Amazon S3, then when you GET the object, you must use the following
+    #   headers:
+    #
+    #   * `x-amz-server-side-encryption-customer-algorithm`
+    #
+    #   * `x-amz-server-side-encryption-customer-key`
+    #
+    #   * `x-amz-server-side-encryption-customer-key-MD5`
+    #
+    #   For more information about SSE-C, see [Server-Side Encryption (Using
+    #   Customer-Provided Encryption Keys)][1] in the *Amazon S3 User Guide*.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html
     # @option options [String] :sse_customer_key
-    #   Specifies the customer-provided encryption key for Amazon S3 used to
-    #   encrypt the data. This value is used to decrypt the object when
-    #   recovering it and must match the one used when storing the data. The
-    #   key must be appropriate for use with the algorithm specified in the
+    #   Specifies the customer-provided encryption key that you originally
+    #   provided for Amazon S3 to encrypt the data before storing it. This
+    #   value is used to decrypt the object when recovering it and must match
+    #   the one used when storing the data. The key must be appropriate for
+    #   use with the algorithm specified in the
     #   `x-amz-server-side-encryption-customer-algorithm` header.
+    #
+    #   If you encrypt an object by using server-side encryption with
+    #   customer-provided encryption keys (SSE-C) when you store the object in
+    #   Amazon S3, then when you GET the object, you must use the following
+    #   headers:
+    #
+    #   * `x-amz-server-side-encryption-customer-algorithm`
+    #
+    #   * `x-amz-server-side-encryption-customer-key`
+    #
+    #   * `x-amz-server-side-encryption-customer-key-MD5`
+    #
+    #   For more information about SSE-C, see [Server-Side Encryption (Using
+    #   Customer-Provided Encryption Keys)][1] in the *Amazon S3 User Guide*.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html
     # @option options [String] :sse_customer_key_md5
-    #   Specifies the 128-bit MD5 digest of the encryption key according to
-    #   RFC 1321. Amazon S3 uses this header for a message integrity check to
-    #   ensure that the encryption key was transmitted without error.
+    #   Specifies the 128-bit MD5 digest of the customer-provided encryption
+    #   key according to RFC 1321. Amazon S3 uses this header for a message
+    #   integrity check to ensure that the encryption key was transmitted
+    #   without error.
+    #
+    #   If you encrypt an object by using server-side encryption with
+    #   customer-provided encryption keys (SSE-C) when you store the object in
+    #   Amazon S3, then when you GET the object, you must use the following
+    #   headers:
+    #
+    #   * `x-amz-server-side-encryption-customer-algorithm`
+    #
+    #   * `x-amz-server-side-encryption-customer-key`
+    #
+    #   * `x-amz-server-side-encryption-customer-key-MD5`
+    #
+    #   For more information about SSE-C, see [Server-Side Encryption (Using
+    #   Customer-Provided Encryption Keys)][1] in the *Amazon S3 User Guide*.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html
     # @option options [String] :request_payer
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
-    #   requests. For information about downloading objects from Requester
+    #   requests. If either the source or destination S3 bucket has Requester
+    #   Pays enabled, the requester will pay for corresponding charges to copy
+    #   the object. For information about downloading objects from Requester
     #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
     #   in the *Amazon S3 User Guide*.
     #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
+    #
     #
     #
     #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
@@ -384,9 +518,9 @@ module Aws::S3
     #   for the part specified. Useful for downloading just a part of an
     #   object.
     # @option options [String] :expected_bucket_owner
-    #   The account ID of the expected bucket owner. If the bucket is owned by
-    #   a different account, the request fails with the HTTP status code `403
-    #   Forbidden` (access denied).
+    #   The account ID of the expected bucket owner. If the account ID that
+    #   you provide does not match the actual owner of the bucket, the request
+    #   fails with the HTTP status code `403 Forbidden` (access denied).
     # @option options [String] :checksum_mode
     #   To retrieve the checksum, this mode must be enabled.
     # @return [Types::GetObjectOutput]
@@ -422,40 +556,118 @@ module Aws::S3
     # @option options [String] :if_match
     #   Return the object only if its entity tag (ETag) is the same as the one
     #   specified; otherwise, return a 412 (precondition failed) error.
+    #
+    #   If both of the `If-Match` and `If-Unmodified-Since` headers are
+    #   present in the request as follows:
+    #
+    #   * `If-Match` condition evaluates to `true`, and;
+    #
+    #   * `If-Unmodified-Since` condition evaluates to `false`;
+    #
+    #   Then Amazon S3 returns `200 OK` and the data requested.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
     # @option options [Time,DateTime,Date,Integer,String] :if_modified_since
     #   Return the object only if it has been modified since the specified
     #   time; otherwise, return a 304 (not modified) error.
+    #
+    #   If both of the `If-None-Match` and `If-Modified-Since` headers are
+    #   present in the request as follows:
+    #
+    #   * `If-None-Match` condition evaluates to `false`, and;
+    #
+    #   * `If-Modified-Since` condition evaluates to `true`;
+    #
+    #   Then Amazon S3 returns the `304 Not Modified` response code.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
     # @option options [String] :if_none_match
     #   Return the object only if its entity tag (ETag) is different from the
     #   one specified; otherwise, return a 304 (not modified) error.
+    #
+    #   If both of the `If-None-Match` and `If-Modified-Since` headers are
+    #   present in the request as follows:
+    #
+    #   * `If-None-Match` condition evaluates to `false`, and;
+    #
+    #   * `If-Modified-Since` condition evaluates to `true`;
+    #
+    #   Then Amazon S3 returns the `304 Not Modified` response code.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
     # @option options [Time,DateTime,Date,Integer,String] :if_unmodified_since
     #   Return the object only if it has not been modified since the specified
     #   time; otherwise, return a 412 (precondition failed) error.
+    #
+    #   If both of the `If-Match` and `If-Unmodified-Since` headers are
+    #   present in the request as follows:
+    #
+    #   * `If-Match` condition evaluates to `true`, and;
+    #
+    #   * `If-Unmodified-Since` condition evaluates to `false`;
+    #
+    #   Then Amazon S3 returns `200 OK` and the data requested.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
     # @option options [String] :range
     #   HeadObject returns only the metadata for an object. If the Range is
     #   satisfiable, only the `ContentLength` is affected in the response. If
     #   the Range is not satisfiable, S3 returns a `416 - Requested Range Not
     #   Satisfiable` error.
     # @option options [String] :sse_customer_algorithm
-    #   Specifies the algorithm to use to when encrypting the object (for
+    #   Specifies the algorithm to use when encrypting the object (for
     #   example, AES256).
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
     # @option options [String] :sse_customer_key
     #   Specifies the customer-provided encryption key for Amazon S3 to use in
     #   encrypting data. This value is used to store the object and then it is
     #   discarded; Amazon S3 does not store the encryption key. The key must
     #   be appropriate for use with the algorithm specified in the
     #   `x-amz-server-side-encryption-customer-algorithm` header.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
     # @option options [String] :sse_customer_key_md5
     #   Specifies the 128-bit MD5 digest of the encryption key according to
     #   RFC 1321. Amazon S3 uses this header for a message integrity check to
     #   ensure that the encryption key was transmitted without error.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
     # @option options [String] :request_payer
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
-    #   requests. For information about downloading objects from Requester
+    #   requests. If either the source or destination S3 bucket has Requester
+    #   Pays enabled, the requester will pay for corresponding charges to copy
+    #   the object. For information about downloading objects from Requester
     #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
     #   in the *Amazon S3 User Guide*.
     #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
+    #
     #
     #
     #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
@@ -465,9 +677,9 @@ module Aws::S3
     #   for the part specified. Useful querying about the size of the part and
     #   the number of parts in this object.
     # @option options [String] :expected_bucket_owner
-    #   The account ID of the expected bucket owner. If the bucket is owned by
-    #   a different account, the request fails with the HTTP status code `403
-    #   Forbidden` (access denied).
+    #   The account ID of the expected bucket owner. If the account ID that
+    #   you provide does not match the actual owner of the bucket, the request
+    #   fails with the HTTP status code `403 Forbidden` (access denied).
     # @option options [String] :checksum_mode
     #   To retrieve the checksum, this parameter must be enabled.
     #
@@ -564,13 +776,36 @@ module Aws::S3
       #   space, and the value that is displayed on your authentication device.
       #   Required to permanently delete a versioned object if versioning is
       #   configured with MFA delete enabled.
+      #
+      #   When performing the `DeleteObjects` operation on an MFA delete enabled
+      #   bucket, which attempts to delete the specified versioned objects, you
+      #   must include an MFA token. If you don't provide an MFA token, the
+      #   entire request will fail, even if there are non-versioned objects that
+      #   you are trying to delete. If you provide an invalid token, whether
+      #   there are versioned object keys in the request or not, the entire
+      #   Multi-Object Delete request will fail. For information about MFA
+      #   Delete, see [ MFA Delete][1] in the *Amazon S3 User Guide*.
+      #
+      #   <note markdown="1"> This functionality is not supported for directory buckets.
+      #
+      #    </note>
+      #
+      #
+      #
+      #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete
       # @option options [String] :request_payer
       #   Confirms that the requester knows that they will be charged for the
       #   request. Bucket owners need not specify this parameter in their
-      #   requests. For information about downloading objects from Requester
+      #   requests. If either the source or destination S3 bucket has Requester
+      #   Pays enabled, the requester will pay for corresponding charges to copy
+      #   the object. For information about downloading objects from Requester
       #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
       #   in the *Amazon S3 User Guide*.
       #
+      #   <note markdown="1"> This functionality is not supported for directory buckets.
+      #
+      #    </note>
+      #
       #
       #
       #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
@@ -578,25 +813,45 @@ module Aws::S3
       #   Specifies whether you want to delete this object even if it has a
       #   Governance-type Object Lock in place. To use this header, you must
       #   have the `s3:BypassGovernanceRetention` permission.
+      #
+      #   <note markdown="1"> This functionality is not supported for directory buckets.
+      #
+      #    </note>
       # @option options [String] :expected_bucket_owner
-      #   The account ID of the expected bucket owner. If the bucket is owned by
-      #   a different account, the request fails with the HTTP status code `403
-      #   Forbidden` (access denied).
+      #   The account ID of the expected bucket owner. If the account ID that
+      #   you provide does not match the actual owner of the bucket, the request
+      #   fails with the HTTP status code `403 Forbidden` (access denied).
       # @option options [String] :checksum_algorithm
       #   Indicates the algorithm used to create the checksum for the object
-      #   when using the SDK. This header will not provide any additional
-      #   functionality if not using the SDK. When sending this header, there
-      #   must be a corresponding `x-amz-checksum` or `x-amz-trailer` header
-      #   sent. Otherwise, Amazon S3 fails the request with the HTTP status code
-      #   `400 Bad Request`. For more information, see [Checking object
-      #   integrity][1] in the *Amazon S3 User Guide*.
+      #   when you use the SDK. This header will not provide any additional
+      #   functionality if you don't use the SDK. When you send this header,
+      #   there must be a corresponding `x-amz-checksum-algorithm ` or
+      #   `x-amz-trailer` header sent. Otherwise, Amazon S3 fails the request
+      #   with the HTTP status code `400 Bad Request`.
+      #
+      #   For the `x-amz-checksum-algorithm ` header, replace ` algorithm ` with
+      #   the supported algorithm from the following list:
+      #
+      #   * CRC32
+      #
+      #   * CRC32C
+      #
+      #   * SHA1
+      #
+      #   * SHA256
+      #
+      #   For more information, see [Checking object integrity][1] in the
+      #   *Amazon S3 User Guide*.
+      #
+      #   If the individual checksum value you provide through
+      #   `x-amz-checksum-algorithm ` doesn't match the checksum algorithm you
+      #   set through `x-amz-sdk-checksum-algorithm`, Amazon S3 ignores any
+      #   provided `ChecksumAlgorithm` parameter and uses the checksum algorithm
+      #   that matches the provided value in `x-amz-checksum-algorithm `.
       #
       #   If you provide an individual checksum, Amazon S3 ignores any provided
       #   `ChecksumAlgorithm` parameter.
       #
-      #   This checksum algorithm must be the same for all parts and it match
-      #   the checksum value supplied in the `CreateMultipartUpload` request.
-      #
       #
       #
       #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html

data/lib/aws-sdk-s3/plugins/endpoints.rb

@@ -22,19 +22,26 @@ module Aws::S3
         Aws::S3::EndpointProvider.new
       end
 
+      option(
+        :disable_s3_express_session_auth,
+        doc_type: 'Boolean',
+        default: nil,
+        docstring: "Parameter to indicate whether S3Express session auth should be disabled")
+
       # @api private
       class Handler < Seahorse::Client::Handler
         def call(context)
-          # If endpoint was discovered, do not resolve or apply the endpoint.
           unless context[:discovered_endpoint]
             params = parameters_for_operation(context)
             endpoint = context.config.endpoint_provider.resolve_endpoint(params)
 
             context.http_request.endpoint = endpoint.url
             apply_endpoint_headers(context, endpoint.headers)
+
+            context[:endpoint_params] = params
+            context[:endpoint_properties] = endpoint.properties
           end
 
-          context[:endpoint_params] = params
           context[:auth_scheme] =
             Aws::Endpoints.resolve_auth_scheme(context, endpoint)
 
@@ -66,6 +73,8 @@ module Aws::S3
             Aws::S3::Endpoints::CreateBucket.build(context)
           when :create_multipart_upload
             Aws::S3::Endpoints::CreateMultipartUpload.build(context)
+          when :create_session
+            Aws::S3::Endpoints::CreateSession.build(context)
           when :delete_bucket
             Aws::S3::Endpoints::DeleteBucket.build(context)
           when :delete_bucket_analytics_configuration
@@ -176,6 +185,8 @@ module Aws::S3
             Aws::S3::Endpoints::ListBucketMetricsConfigurations.build(context)
           when :list_buckets
             Aws::S3::Endpoints::ListBuckets.build(context)
+          when :list_directory_buckets
+            Aws::S3::Endpoints::ListDirectoryBuckets.build(context)
           when :list_multipart_uploads
             Aws::S3::Endpoints::ListMultipartUploads.build(context)
           when :list_object_versions

data/lib/aws-sdk-s3/plugins/express_session_auth.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module Plugins
+      # @api private
+      class ExpressSessionAuth < Seahorse::Client::Plugin
+        # This should be s3_disable_express_auth instead
+        # But this is not a built in. We're overwriting the generated value
+        option(:disable_s3_express_session_auth,
+          default: false,
+          doc_type: 'Boolean',
+          docstring: <<-DOCS) do |cfg|
+When `true`, S3 Express session authentication is disabled.
+          DOCS
+          resolve_disable_s3_express_session_auth(cfg)
+        end
+
+        option(:express_credentials_provider,
+          doc_type: 'Aws::S3::ExpressCredentialsProvider',
+          docstring: <<-DOCS) do |_cfg|
+Credential Provider for S3 Express endpoints. Manages credentials
+for different buckets.
+          DOCS
+          Aws::S3::ExpressCredentialsProvider.new
+        end
+
+        # @api private
+        class Handler < Seahorse::Client::Handler
+          def call(context)
+            if (props = context[:endpoint_properties])
+              # S3 Express endpoint - turn off md5 and enable crc32 default
+              if (backend = props['backend']) && backend == 'S3Express'
+                if context.operation_name == :put_object || checksum_required?(context)
+                  context[:default_request_checksum_algorithm] = 'CRC32'
+                end
+                context[:s3_express_endpoint] = true
+              end
+
+              # if s3 express auth, use new credentials and sign additional header
+              if context[:auth_scheme]['name'] == 'sigv4-s3express' &&
+                 !context.config.disable_s3_express_session_auth
+                bucket = context.params[:bucket]
+                credentials_provider = context.config.express_credentials_provider
+                credentials = credentials_provider.express_credentials_for(bucket)
+                context[:sigv4_credentials] = credentials # Sign will use this
+              end
+            end
+            @handler.call(context)
+          end
+
+          private
+
+          def checksum_required?(context)
+            context.operation.http_checksum_required ||
+              (context.operation.http_checksum &&
+                context.operation.http_checksum['requestChecksumRequired'])
+          end
+        end
+
+        handler(Handler)
+
+        # Optimization - sets this client as the client to create sessions.
+        def after_initialize(client)
+          provider = client.config.express_credentials_provider
+          provider.client = client unless provider.client
+        end
+
+        class << self
+          private
+
+          def resolve_disable_s3_express_session_auth(cfg)
+            value = ENV['AWS_S3_DISABLE_EXPRESS_SESSION_AUTH'] ||
+                    Aws.shared_config.s3_disable_express_session_auth(profile: cfg.profile) ||
+                    'false'
+            value = Aws::Util.str_2_bool(value)
+            # Raise if provided value is not true or false
+            if value.nil?
+              raise ArgumentError,
+                    'Must provide either `true` or `false` for the '\
+                    '`s3_disable_express_session_auth` profile option or for '\
+                    "ENV['AWS_S3_DISABLE_EXPRESS_SESSION_AUTH']."
+            end
+            value
+          end
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/plugins/location_constraint.rb

@@ -22,7 +22,9 @@ module Aws
 
           def populate_location_constraint(params, region)
             params[:create_bucket_configuration] ||= {}
-            params[:create_bucket_configuration][:location_constraint] ||= region
+            unless params[:create_bucket_configuration][:location]
+              params[:create_bucket_configuration][:location_constraint] ||= region
+            end
           end
 
         end

data/lib/aws-sdk-s3/plugins/md5s.rb

@@ -22,7 +22,8 @@ module Aws
           CHUNK_SIZE = 1 * 1024 * 1024 # one MB
 
           def call(context)
-            if !context[:checksum_algorithms] # skip in favor of flexible checksum
+            if !context[:checksum_algorithms] && # skip in favor of flexible checksum
+               !context[:s3_express_endpoint] # s3 express endpoints do not support md5
               body = context.http_request.body
               if body.respond_to?(:size) && body.size > 0
                 context.http_request.headers['Content-Md5'] ||= md5(body)

data/lib/aws-sdk-s3/presigner.rb

@@ -232,8 +232,8 @@ module Aws
                    end
           signer = Aws::Sigv4::Signer.new(
             service: auth_scheme['signingName'] || 's3',
-            region: region || context.config.region,
-            credentials_provider: context.config.credentials,
+            region: context[:sigv4_region] || region || context.config.region,
+            credentials_provider: context[:sigv4_credentials] || context.config.credentials,
             signing_algorithm: scheme_name.to_sym,
             uri_escape_path: !!!auth_scheme['disableDoubleEncoding'],
             unsigned_headers: unsigned_headers,