aws-sdk-s3 1.147.0 → 1.152.3

data/lib/aws-sdk-s3/express_credentials_provider.rb

@@ -2,30 +2,53 @@
 
 module Aws
   module S3
+    # @api private
+    def self.express_credentials_cache
+      @express_credentials_cache ||= LRUCache.new(max_entries: 100)
+    end
+
     # Returns Credentials class for S3 Express. Accepts CreateSession
     # params as options. See {Client#create_session} for details.
     class ExpressCredentialsProvider
       # @param [Hash] options
-      # @option options [Client] :client The S3 client used to create the session.
+      # @option options [Client] :client The S3 client used to create the
+      #  session.
       # @option options [String] :session_mode (see: {Client#create_session})
+      # @option options [Boolean] :caching (true) When true, credentials will
+      #  be cached.
       # @option options [Callable] :before_refresh Proc called before
       #   credentials are refreshed.
       def initialize(options = {})
         @client = options.delete(:client)
+        @caching = options.delete(:caching) != false
         @options = options
-        @cache = EXPRESS_CREDENTIALS_CACHE
+        return unless @caching
+
+        @cache = Aws::S3.express_credentials_cache
       end
 
       def express_credentials_for(bucket)
-        @cache[bucket] || new_credentials_for(bucket)
+        if @caching
+          cached_credentials_for(bucket)
+        else
+          new_credentials_for(bucket)
+        end
       end
 
       attr_accessor :client
 
       private
 
+      def cached_credentials_for(bucket)
+        if @cache.key?(bucket)
+          @cache[bucket]
+        else
+          @cache[bucket] = new_credentials_for(bucket)
+        end
+      end
+
       def new_credentials_for(bucket)
-        @cache[bucket] = ExpressCredentials.new(
+        ExpressCredentials.new(
           bucket: bucket,
           client: @client,
           **@options

data/lib/aws-sdk-s3/file_downloader.rb

@@ -44,7 +44,7 @@ module Aws
 
         validate!
 
-        Aws::Plugins::UserAgent.feature('s3-transfer') do
+        Aws::Plugins::UserAgent.metric('S3_TRANSFER') do
           case @mode
           when 'auto' then multipart_download
           when 'single_request' then single_request

data/lib/aws-sdk-s3/file_uploader.rb

@@ -37,7 +37,7 @@ module Aws
       #   objects smaller than the multipart threshold.
       # @return [void]
       def upload(source, options = {})
-        Aws::Plugins::UserAgent.feature('s3-transfer') do
+        Aws::Plugins::UserAgent.metric('S3_TRANSFER') do
           if File.size(source) >= multipart_threshold
             MultipartFileUploader.new(@options).upload(source, options)
           else

data/lib/aws-sdk-s3/multipart_stream_uploader.rb

@@ -46,7 +46,7 @@ module Aws
       # @option options [Integer] :thread_count (THREAD_COUNT)
       # @return [Seahorse::Client::Response] - the CompleteMultipartUploadResponse
       def upload(options = {}, &block)
-        Aws::Plugins::UserAgent.feature('s3-transfer') do
+        Aws::Plugins::UserAgent.metric('S3_TRANSFER') do
           upload_id = initiate_upload(options)
           parts = upload_parts(upload_id, options, &block)
           complete_upload(upload_id, parts, options)

data/lib/aws-sdk-s3/multipart_upload.rb

@@ -227,7 +227,7 @@ module Aws::S3
           :retry
         end
       end
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         Aws::Waiters::Waiter.new(options).wait({})
       end
     end
@@ -268,7 +268,7 @@ module Aws::S3
         key: @object_key,
         upload_id: @id
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.abort_multipart_upload(options)
       end
       resp.data
@@ -409,7 +409,7 @@ module Aws::S3
         key: @object_key,
         upload_id: @id
       )
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.complete_multipart_upload(options)
       end
       Object.new(
@@ -519,7 +519,7 @@ module Aws::S3
           key: @object_key,
           upload_id: @id
         )
-        resp = Aws::Plugins::UserAgent.feature('resource') do
+        resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
           @client.list_parts(options)
         end
         resp.each_page do |page|

data/lib/aws-sdk-s3/multipart_upload_part.rb

@@ -262,7 +262,7 @@ module Aws::S3
           :retry
         end
       end
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         Aws::Waiters::Waiter.new(options).wait({})
       end
     end
@@ -500,7 +500,7 @@ module Aws::S3
         upload_id: @multipart_upload_id,
         part_number: @part_number
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.upload_part_copy(options)
       end
       resp.data
@@ -650,7 +650,7 @@ module Aws::S3
         upload_id: @multipart_upload_id,
         part_number: @part_number
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.upload_part(options)
       end
       resp.data

data/lib/aws-sdk-s3/object.rb

@@ -500,7 +500,7 @@ module Aws::S3
     #
     # @return [self]
     def load
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.head_object(
         bucket: @bucket_name,
         key: @key
@@ -550,7 +550,7 @@ module Aws::S3
       options, params = separate_params_and_options(options)
       waiter = Waiters::ObjectExists.new(options)
       yield_waiter_and_warn(waiter, &block) if block_given?
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         waiter.wait(params.merge(bucket: @bucket_name,
         key: @key))
       end
@@ -571,7 +571,7 @@ module Aws::S3
       options, params = separate_params_and_options(options)
       waiter = Waiters::ObjectNotExists.new(options)
       yield_waiter_and_warn(waiter, &block) if block_given?
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         waiter.wait(params.merge(bucket: @bucket_name,
         key: @key))
       end
@@ -676,7 +676,7 @@ module Aws::S3
           :retry
         end
       end
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         Aws::Waiters::Waiter.new(options).wait({})
       end
     end
@@ -1346,7 +1346,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.copy_object(options)
       end
       resp.data
@@ -1412,7 +1412,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.delete_object(options)
       end
       resp.data
@@ -1668,7 +1668,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.get_object(options, &block)
       end
       resp.data
@@ -2153,7 +2153,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.create_multipart_upload(options)
       end
       MultipartUpload.new(
@@ -2624,7 +2624,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.put_object(options)
       end
       resp.data
@@ -2765,7 +2765,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.restore_object(options)
       end
       resp.data
@@ -2936,7 +2936,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.head_object(options)
       end
       resp.data
@@ -3154,7 +3154,7 @@ module Aws::S3
               key: item.key
             }
           end
-          Aws::Plugins::UserAgent.feature('resource') do
+          Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
             batch[0].client.delete_objects(params)
           end
         end

data/lib/aws-sdk-s3/object_acl.rb

@@ -79,7 +79,7 @@ module Aws::S3
     #
     # @return [self]
     def load
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.get_object_acl(
         bucket: @bucket_name,
         key: @object_key
@@ -199,7 +199,7 @@ module Aws::S3
           :retry
         end
       end
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         Aws::Waiters::Waiter.new(options).wait({})
       end
     end
@@ -332,7 +332,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @object_key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.put_object_acl(options)
       end
       resp.data

data/lib/aws-sdk-s3/object_copier.rb

@@ -28,7 +28,7 @@ module Aws
         options[:bucket] = target_bucket
         options[:key] = target_key
         options[:copy_source] = copy_source(source)
-        Aws::Plugins::UserAgent.feature('s3-transfer') do
+        Aws::Plugins::UserAgent.metric('S3_TRANSFER') do
           if options.delete(:multipart_copy)
             apply_source_client(source, options)
             ObjectMultipartCopier.new(@options).copy(options)

data/lib/aws-sdk-s3/object_multipart_copier.rb

@@ -138,9 +138,7 @@ module Aws
       end
 
       def source_metadata(options)
-        if options[:content_length]
-          return { content_length: options.delete(:content_length) }
-        end
+        return options.slice(:content_length) if options[:content_length]
 
         client = options[:copy_source_client] || @client
 
@@ -150,11 +148,15 @@ module Aws
           bucket, key = options[:copy_source].match(/([^\/]+?)\/(.+)/)[1,2]
         end
 
-        key = CGI.unescape(key)
-        opts = { bucket: bucket, key: key }
-        opts[:version_id] = version_id if version_id
-        opts[:part_number] = options[:part_number] if options[:part_number]
-        client.head_object(opts).to_h
+        head_opts = { bucket: bucket, key: CGI.unescape(key) }.tap { |opts|
+          opts[:version_id]  = version_id if version_id
+          opts[:part_number] = options[:part_number] if options[:part_number]
+        }
+
+        client.head_object(head_opts).to_h.tap { |head|
+          head.delete(:server_side_encryption)
+          head.delete(:ssekms_key_id)
+        }
       end
 
       def default_part_size(source_size)

data/lib/aws-sdk-s3/object_summary.rb

@@ -186,7 +186,7 @@ module Aws::S3
       options, params = separate_params_and_options(options)
       waiter = Waiters::ObjectExists.new(options)
       yield_waiter_and_warn(waiter, &block) if block_given?
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         waiter.wait(params.merge(bucket: @bucket_name,
         key: @key))
       end
@@ -207,7 +207,7 @@ module Aws::S3
       options, params = separate_params_and_options(options)
       waiter = Waiters::ObjectNotExists.new(options)
       yield_waiter_and_warn(waiter, &block) if block_given?
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         waiter.wait(params.merge(bucket: @bucket_name,
         key: @key))
       end
@@ -312,7 +312,7 @@ module Aws::S3
           :retry
         end
       end
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         Aws::Waiters::Waiter.new(options).wait({})
       end
     end
@@ -982,7 +982,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.copy_object(options)
       end
       resp.data
@@ -1048,7 +1048,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.delete_object(options)
       end
       resp.data
@@ -1304,7 +1304,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.get_object(options, &block)
       end
       resp.data
@@ -1789,7 +1789,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.create_multipart_upload(options)
       end
       MultipartUpload.new(
@@ -2260,7 +2260,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.put_object(options)
       end
       resp.data
@@ -2401,7 +2401,7 @@ module Aws::S3
         bucket: @bucket_name,
         key: @key
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.restore_object(options)
       end
       resp.data
@@ -2628,7 +2628,7 @@ module Aws::S3
               key: item.key
             }
           end
-          Aws::Plugins::UserAgent.feature('resource') do
+          Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
             batch[0].client.delete_objects(params)
           end
         end

data/lib/aws-sdk-s3/object_version.rb

@@ -243,7 +243,7 @@ module Aws::S3
           :retry
         end
       end
-      Aws::Plugins::UserAgent.feature('resource') do
+      Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         Aws::Waiters::Waiter.new(options).wait({})
       end
     end
@@ -303,7 +303,7 @@ module Aws::S3
         key: @object_key,
         version_id: @id
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.delete_object(options)
       end
       resp.data
@@ -530,7 +530,7 @@ module Aws::S3
         key: @object_key,
         version_id: @id
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.get_object(options, &block)
       end
       resp.data
@@ -694,7 +694,7 @@ module Aws::S3
         key: @object_key,
         version_id: @id
       )
-      resp = Aws::Plugins::UserAgent.feature('resource') do
+      resp = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
         @client.head_object(options)
       end
       resp.data
@@ -868,7 +868,7 @@ module Aws::S3
               version_id: item.id
             }
           end
-          Aws::Plugins::UserAgent.feature('resource') do
+          Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
             batch[0].client.delete_objects(params)
           end
         end

data/lib/aws-sdk-s3/plugins/access_grants.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module Plugins
+      # @api private
+      class AccessGrants < Seahorse::Client::Plugin
+        @s3control =
+          begin
+            require 'aws-sdk-s3control'
+            true
+          rescue LoadError
+            false
+          end
+
+        option(
+          :access_grants,
+          default: false,
+          doc_type: 'Boolean',
+          docstring: <<-DOCS)
+When `true`, the S3 client will use the S3 Access Grants feature to
+authenticate requests. Bucket credentials will be fetched from S3
+Control using the `get_data_access` API.
+          DOCS
+
+        option(:access_grants_credentials_provider,
+          doc_type: 'Aws::S3::AccessGrantsCredentialsProvider',
+          rbs_type: 'untyped',
+          docstring: <<-DOCS) do |_cfg|
+When `access_grants` is `true`, this option can be used to provide
+additional options to the credentials provider, including a privilege
+setting, caching, and fallback behavior.
+          DOCS
+          Aws::S3::AccessGrantsCredentialsProvider.new
+        end
+
+        # @api private
+        class Handler < Seahorse::Client::Handler
+          PERMISSION_MAP = {
+            head_object: 'READ',
+            get_object: 'READ',
+            get_object_acl: 'READ',
+            list_multipart_uploads: 'READ',
+            list_objects_v2: 'READ',
+            list_object_versions: 'READ',
+            list_parts: 'READ',
+            put_object: 'WRITE',
+            put_object_acl: 'WRITE',
+            delete_object: 'WRITE',
+            abort_multipart_upload: 'WRITE',
+            create_multipart_upload: 'WRITE',
+            upload_part: 'WRITE',
+            complete_multipart_upload: 'WRITE'
+          }.freeze
+
+          def call(context)
+            if access_grants_operation?(context) &&
+               !s3_express_endpoint?(context)
+              params = context[:endpoint_params]
+              permission = PERMISSION_MAP[context.operation_name]
+
+              provider = context.config.access_grants_credentials_provider
+              credentials = provider.access_grants_credentials_for(
+                bucket: params[:bucket],
+                key: params[:key],
+                prefix: params[:prefix],
+                permission: permission
+              )
+              context[:sigv4_credentials] = credentials # Sign will use this
+            end
+
+            with_metric(credentials) { @handler.call(context) }
+          end
+
+          private
+
+          def with_metric(credentials, &block)
+            return block.call unless credentials
+
+            Aws::Plugins::UserAgent.metric('S3_ACCESS_GRANTS', &block)
+          end
+
+          def access_grants_operation?(context)
+            params = context[:endpoint_params]
+            params[:bucket] && PERMISSION_MAP[context.operation_name]
+          end
+
+          def s3_express_endpoint?(context)
+            context[:endpoint_properties]['backend'] == 'S3Express'
+          end
+        end
+
+        def add_handlers(handlers, config)
+          return unless AccessGrants.s3control? && config.access_grants
+
+          handlers.add(Handler)
+        end
+
+        def after_initialize(client)
+          return unless AccessGrants.s3control? && client.config.access_grants
+
+          provider = client.config.access_grants_credentials_provider
+          provider.s3_client = client unless provider.s3_client
+        end
+
+        class << self
+          def s3control?
+            @s3control
+          end
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/plugins/express_session_auth.rb

@@ -31,7 +31,7 @@ for different buckets.
           def call(context)
             if (props = context[:endpoint_properties])
               # S3 Express endpoint - turn off md5 and enable crc32 default
-              if (backend = props['backend']) && backend == 'S3Express'
+              if props['backend'] == 'S3Express'
                 if context.operation_name == :put_object || checksum_required?(context)
                   context[:default_request_checksum_algorithm] = 'CRC32'
                 end
@@ -47,11 +47,17 @@ for different buckets.
                 context[:sigv4_credentials] = credentials # Sign will use this
               end
             end
-            @handler.call(context)
+            with_metric(credentials) { @handler.call(context) }
           end
 
           private
 
+          def with_metric(credentials, &block)
+            return block.call unless credentials
+
+            Aws::Plugins::UserAgent.metric('S3_EXPRESS_BUCKET', &block)
+          end
+
           def checksum_required?(context)
             context.operation.http_checksum_required ||
               (context.operation.http_checksum &&