aws-sdk-s3 1.156.0 → 1.190.0

data/lib/aws-sdk-s3/object_version.rb

@@ -62,6 +62,18 @@ module Aws::S3
       data[:checksum_algorithm]
     end
 
+    # The checksum type that is used to calculate the object’s checksum
+    # value. For more information, see [Checking object integrity][1] in the
+    # *Amazon S3 User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html
+    # @return [String]
+    def checksum_type
+      data[:checksum_type]
+    end
+
     # Size in bytes of the object.
     # @return [Integer]
     def size
@@ -257,6 +269,9 @@ module Aws::S3
     #     request_payer: "requester", # accepts requester
     #     bypass_governance_retention: false,
     #     expected_bucket_owner: "AccountId",
+    #     if_match: "IfMatch",
+    #     if_match_last_modified_time: Time.now,
+    #     if_match_size: 1,
     #   })
     # @param [Hash] options ({})
     # @option options [String] :mfa
@@ -296,6 +311,46 @@ module Aws::S3
     #   The account ID of the expected bucket owner. If the account ID that
     #   you provide does not match the actual owner of the bucket, the request
     #   fails with the HTTP status code `403 Forbidden` (access denied).
+    # @option options [String] :if_match
+    #   The `If-Match` header field makes the request method conditional on
+    #   ETags. If the ETag value does not match, the operation returns a `412
+    #   Precondition Failed` error. If the ETag matches or if the object
+    #   doesn't exist, the operation will return a `204 Success (No Content)
+    #   response`.
+    #
+    #   For more information about conditional requests, see [RFC 7232][1].
+    #
+    #   <note markdown="1"> This functionality is only supported for directory buckets.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc7232
+    # @option options [Time,DateTime,Date,Integer,String] :if_match_last_modified_time
+    #   If present, the object is deleted only if its modification times
+    #   matches the provided `Timestamp`. If the `Timestamp` values do not
+    #   match, the operation returns a `412 Precondition Failed` error. If the
+    #   `Timestamp` matches or if the object doesn’t exist, the operation
+    #   returns a `204 Success (No Content)` response.
+    #
+    #   <note markdown="1"> This functionality is only supported for directory buckets.
+    #
+    #    </note>
+    # @option options [Integer] :if_match_size
+    #   If present, the object is deleted only if its size matches the
+    #   provided size in bytes. If the `Size` value does not match, the
+    #   operation returns a `412 Precondition Failed` error. If the `Size`
+    #   matches or if the object doesn’t exist, the operation returns a `204
+    #   Success (No Content)` response.
+    #
+    #   <note markdown="1"> This functionality is only supported for directory buckets.
+    #
+    #    </note>
+    #
+    #   You can use the `If-Match`, `x-amz-if-match-last-modified-time` and
+    #   `x-amz-if-match-size` conditional headers in conjunction with
+    #   each-other or individually.
     # @return [Types::DeleteObjectOutput]
     def delete(options = {})
       options = options.merge(
@@ -701,10 +756,20 @@ module Aws::S3
     # @option options [String] :checksum_mode
     #   To retrieve the checksum, this parameter must be enabled.
     #
-    #   In addition, if you enable `ChecksumMode` and the object is encrypted
-    #   with Amazon Web Services Key Management Service (Amazon Web Services
-    #   KMS), you must have permission to use the `kms:Decrypt` action for the
-    #   request to succeed.
+    #   **General purpose buckets** - If you enable checksum mode and the
+    #   object is uploaded with a [checksum][1] and encrypted with an Key
+    #   Management Service (KMS) key, you must have permission to use the
+    #   `kms:Decrypt` action to retrieve the checksum.
+    #
+    #   **Directory buckets** - If you enable `ChecksumMode` and the object is
+    #   encrypted with Amazon Web Services Key Management Service (Amazon Web
+    #   Services KMS), you must also have the `kms:GenerateDataKey` and
+    #   `kms:Decrypt` permissions in IAM identity-based policies and KMS key
+    #   policies for the KMS key to retrieve the checksum of the object.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_Checksum.html
     # @return [Types::HeadObjectOutput]
     def head(options = {})
       options = options.merge(
@@ -786,7 +851,7 @@ module Aws::S3
       #     request_payer: "requester", # accepts requester
       #     bypass_governance_retention: false,
       #     expected_bucket_owner: "AccountId",
-      #     checksum_algorithm: "CRC32", # accepts CRC32, CRC32C, SHA1, SHA256
+      #     checksum_algorithm: "CRC32", # accepts CRC32, CRC32C, SHA1, SHA256, CRC64NVME
       #   })
       # @param options ({})
       # @option options [String] :mfa
@@ -850,22 +915,23 @@ module Aws::S3
       #   For the `x-amz-checksum-algorithm ` header, replace ` algorithm ` with
       #   the supported algorithm from the following list:
       #
-      #   * CRC32
+      #   * `CRC32`
+      #
+      #   * `CRC32C`
       #
-      #   * CRC32C
+      #   * `CRC64NVME`
       #
-      #   * SHA1
+      #   * `SHA1`
       #
-      #   * SHA256
+      #   * `SHA256`
       #
       #   For more information, see [Checking object integrity][1] in the
       #   *Amazon S3 User Guide*.
       #
       #   If the individual checksum value you provide through
       #   `x-amz-checksum-algorithm ` doesn't match the checksum algorithm you
-      #   set through `x-amz-sdk-checksum-algorithm`, Amazon S3 ignores any
-      #   provided `ChecksumAlgorithm` parameter and uses the checksum algorithm
-      #   that matches the provided value in `x-amz-checksum-algorithm `.
+      #   set through `x-amz-sdk-checksum-algorithm`, Amazon S3 fails the
+      #   request with a `BadDigest` error.
       #
       #   If you provide an individual checksum, Amazon S3 ignores any provided
       #   `ChecksumAlgorithm` parameter.
@@ -898,3 +964,6 @@ module Aws::S3
     end
   end
 end
+
+# Load customizations if they exist
+require 'aws-sdk-s3/customizations/object_version'

data/lib/aws-sdk-s3/plugins/access_grants.rb

@@ -44,25 +44,47 @@ setting, caching, and fallback behavior.
             list_objects_v2: 'READ',
             list_object_versions: 'READ',
             list_parts: 'READ',
+            head_bucket: 'READ',
+            get_object_attributes: 'READ',
             put_object: 'WRITE',
             put_object_acl: 'WRITE',
             delete_object: 'WRITE',
             abort_multipart_upload: 'WRITE',
             create_multipart_upload: 'WRITE',
             upload_part: 'WRITE',
-            complete_multipart_upload: 'WRITE'
+            complete_multipart_upload: 'WRITE',
+            delete_objects: 'WRITE',
+            copy_object: 'READWRITE'
           }.freeze
 
           def call(context)
+            provider = context.config.access_grants_credentials_provider
+
             if access_grants_operation?(context) &&
-               !s3_express_endpoint?(context)
+               !s3_express_endpoint?(context) &&
+               !credentials_head_bucket_call?(provider)
               params = context[:endpoint_params]
               permission = PERMISSION_MAP[context.operation_name]
 
-              provider = context.config.access_grants_credentials_provider
+              key =
+                case context.operation_name
+                when :delete_objects
+                  delete_params = context.params[:delete]
+                  common_prefixes(delete_params[:objects].map { |o| o[:key] })
+                when :copy_object
+                  source_bucket, source_key = params[:copy_source].split('/', 2)
+                  if params[:bucket] != source_bucket
+                    raise ArgumentError,
+                          'source and destination bucket must be the same'
+                  end
+                  common_prefixes([params[:key], source_key])
+                else
+                  params[:key]
+                end
+
               credentials = provider.access_grants_credentials_for(
                 bucket: params[:bucket],
-                key: params[:key],
+                key: key,
                 prefix: params[:prefix],
                 permission: permission
               )
@@ -80,6 +102,12 @@ setting, caching, and fallback behavior.
             Aws::Plugins::UserAgent.metric('S3_ACCESS_GRANTS', &block)
           end
 
+          # HeadBucket is a supported call. When fetching credentials,
+          # this plugin is executed again, and becomes recursive.
+          def credentials_head_bucket_call?(provider)
+            provider.instance_variable_get(:@head_bucket_call)
+          end
+
           def access_grants_operation?(context)
             params = context[:endpoint_params]
             params[:bucket] && PERMISSION_MAP[context.operation_name]
@@ -88,6 +116,42 @@ setting, caching, and fallback behavior.
           def s3_express_endpoint?(context)
             context[:endpoint_properties]['backend'] == 'S3Express'
           end
+
+          # Return the common prefix of the keys, regardless of the delimiter.
+          # For example, given keys ['foo/bar', 'foo/baz'], the common prefix
+          # is 'foo/ba'.
+          def common_prefixes(keys)
+            return '' if keys.empty?
+
+            first_key = keys[0]
+            common_ancestor = first_key
+            last_prefix = ''
+            keys.each do |k|
+              until common_ancestor.empty?
+                break if k.start_with?(common_ancestor)
+
+                last_index = common_ancestor.rindex('/')
+                return '' if last_index.nil?
+
+                last_prefix = common_ancestor[(last_index + 1)..-1]
+                common_ancestor = common_ancestor[0...last_index]
+              end
+            end
+            new_common_ancestor = "#{common_ancestor}/#{last_prefix}"
+            keys.each do |k|
+              until last_prefix.empty?
+                break if k.start_with?(new_common_ancestor)
+
+                last_prefix = last_prefix[0...-1]
+                new_common_ancestor = "#{common_ancestor}/#{last_prefix}"
+              end
+            end
+            if new_common_ancestor == "#{first_key}/"
+              first_key
+            else
+              new_common_ancestor
+            end
+          end
         end
 
         def add_handlers(handlers, config)

data/lib/aws-sdk-s3/plugins/checksum_algorithm.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module Plugins
+      # @api private
+      class ChecksumAlgorithm < Seahorse::Client::Plugin
+
+        # S3 GetObject results for whole Multipart Objects contain a checksum
+        # that cannot be validated. These should be skipped by the
+        # ChecksumAlgorithm plugin.
+        class SkipWholeMultipartGetChecksumsHandler < Seahorse::Client::Handler
+          def call(context)
+            context[:http_checksum] ||= {}
+            context[:http_checksum][:skip_on_suffix] = true
+
+            @handler.call(context)
+          end
+        end
+
+        def add_handlers(handlers, _config)
+          handlers.add(
+            SkipWholeMultipartGetChecksumsHandler,
+            step: :initialize,
+            operations: [:get_object]
+          )
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/plugins/endpoints.rb

@@ -15,25 +15,28 @@ module Aws::S3
         :endpoint_provider,
         doc_type: 'Aws::S3::EndpointProvider',
         rbs_type: 'untyped',
-        docstring: 'The endpoint provider used to resolve endpoints. Any '\
-                   'object that responds to `#resolve_endpoint(parameters)` '\
-                   'where `parameters` is a Struct similar to '\
-                   '`Aws::S3::EndpointParameters`'
-      ) do |cfg|
+        docstring: <<~DOCS) do |_cfg|
+The endpoint provider used to resolve endpoints. Any object that responds to
+`#resolve_endpoint(parameters)` where `parameters` is a Struct similar to
+`Aws::S3::EndpointParameters`.
+        DOCS
         Aws::S3::EndpointProvider.new
       end
 
       option(
         :disable_s3_express_session_auth,
         doc_type: 'Boolean',
-        default: nil,
-        docstring: "Parameter to indicate whether S3Express session auth should be disabled")
+        docstring: <<~DOCS) do |cfg|
+Parameter to indicate whether S3Express session auth should be disabled
+        DOCS
+        nil
+      end
 
       # @api private
       class Handler < Seahorse::Client::Handler
         def call(context)
           unless context[:discovered_endpoint]
-            params = parameters_for_operation(context)
+            params = Aws::S3::Endpoints.parameters_for_operation(context)
             endpoint = context.config.endpoint_provider.resolve_endpoint(params)
 
             context.http_request.endpoint = endpoint.url
@@ -46,11 +49,23 @@ module Aws::S3
           context[:auth_scheme] =
             Aws::Endpoints.resolve_auth_scheme(context, endpoint)
 
-          @handler.call(context)
+          with_metrics(context) { @handler.call(context) }
         end
 
         private
 
+        def with_metrics(context, &block)
+          metrics = []
+          metrics << 'ENDPOINT_OVERRIDE' unless context.config.regional_endpoint
+          if context[:auth_scheme] && context[:auth_scheme]['name'] == 'sigv4a'
+            metrics << 'SIGV4A_SIGNING'
+          end
+          if context.config.credentials&.credentials&.account_id
+            metrics << 'RESOLVED_ACCOUNT_ID'
+          end
+          Aws::Plugins::UserAgent.metric(*metrics, &block)
+        end
+
         def apply_endpoint_headers(context, headers)
           headers.each do |key, values|
             value = values
@@ -61,209 +76,6 @@ module Aws::S3
             context.http_request.headers[key] = value
           end
         end
-
-        def parameters_for_operation(context)
-          case context.operation_name
-          when :abort_multipart_upload
-            Aws::S3::Endpoints::AbortMultipartUpload.build(context)
-          when :complete_multipart_upload
-            Aws::S3::Endpoints::CompleteMultipartUpload.build(context)
-          when :copy_object
-            Aws::S3::Endpoints::CopyObject.build(context)
-          when :create_bucket
-            Aws::S3::Endpoints::CreateBucket.build(context)
-          when :create_multipart_upload
-            Aws::S3::Endpoints::CreateMultipartUpload.build(context)
-          when :create_session
-            Aws::S3::Endpoints::CreateSession.build(context)
-          when :delete_bucket
-            Aws::S3::Endpoints::DeleteBucket.build(context)
-          when :delete_bucket_analytics_configuration
-            Aws::S3::Endpoints::DeleteBucketAnalyticsConfiguration.build(context)
-          when :delete_bucket_cors
-            Aws::S3::Endpoints::DeleteBucketCors.build(context)
-          when :delete_bucket_encryption
-            Aws::S3::Endpoints::DeleteBucketEncryption.build(context)
-          when :delete_bucket_intelligent_tiering_configuration
-            Aws::S3::Endpoints::DeleteBucketIntelligentTieringConfiguration.build(context)
-          when :delete_bucket_inventory_configuration
-            Aws::S3::Endpoints::DeleteBucketInventoryConfiguration.build(context)
-          when :delete_bucket_lifecycle
-            Aws::S3::Endpoints::DeleteBucketLifecycle.build(context)
-          when :delete_bucket_metrics_configuration
-            Aws::S3::Endpoints::DeleteBucketMetricsConfiguration.build(context)
-          when :delete_bucket_ownership_controls
-            Aws::S3::Endpoints::DeleteBucketOwnershipControls.build(context)
-          when :delete_bucket_policy
-            Aws::S3::Endpoints::DeleteBucketPolicy.build(context)
-          when :delete_bucket_replication
-            Aws::S3::Endpoints::DeleteBucketReplication.build(context)
-          when :delete_bucket_tagging
-            Aws::S3::Endpoints::DeleteBucketTagging.build(context)
-          when :delete_bucket_website
-            Aws::S3::Endpoints::DeleteBucketWebsite.build(context)
-          when :delete_object
-            Aws::S3::Endpoints::DeleteObject.build(context)
-          when :delete_object_tagging
-            Aws::S3::Endpoints::DeleteObjectTagging.build(context)
-          when :delete_objects
-            Aws::S3::Endpoints::DeleteObjects.build(context)
-          when :delete_public_access_block
-            Aws::S3::Endpoints::DeletePublicAccessBlock.build(context)
-          when :get_bucket_accelerate_configuration
-            Aws::S3::Endpoints::GetBucketAccelerateConfiguration.build(context)
-          when :get_bucket_acl
-            Aws::S3::Endpoints::GetBucketAcl.build(context)
-          when :get_bucket_analytics_configuration
-            Aws::S3::Endpoints::GetBucketAnalyticsConfiguration.build(context)
-          when :get_bucket_cors
-            Aws::S3::Endpoints::GetBucketCors.build(context)
-          when :get_bucket_encryption
-            Aws::S3::Endpoints::GetBucketEncryption.build(context)
-          when :get_bucket_intelligent_tiering_configuration
-            Aws::S3::Endpoints::GetBucketIntelligentTieringConfiguration.build(context)
-          when :get_bucket_inventory_configuration
-            Aws::S3::Endpoints::GetBucketInventoryConfiguration.build(context)
-          when :get_bucket_lifecycle
-            Aws::S3::Endpoints::GetBucketLifecycle.build(context)
-          when :get_bucket_lifecycle_configuration
-            Aws::S3::Endpoints::GetBucketLifecycleConfiguration.build(context)
-          when :get_bucket_location
-            Aws::S3::Endpoints::GetBucketLocation.build(context)
-          when :get_bucket_logging
-            Aws::S3::Endpoints::GetBucketLogging.build(context)
-          when :get_bucket_metrics_configuration
-            Aws::S3::Endpoints::GetBucketMetricsConfiguration.build(context)
-          when :get_bucket_notification
-            Aws::S3::Endpoints::GetBucketNotification.build(context)
-          when :get_bucket_notification_configuration
-            Aws::S3::Endpoints::GetBucketNotificationConfiguration.build(context)
-          when :get_bucket_ownership_controls
-            Aws::S3::Endpoints::GetBucketOwnershipControls.build(context)
-          when :get_bucket_policy
-            Aws::S3::Endpoints::GetBucketPolicy.build(context)
-          when :get_bucket_policy_status
-            Aws::S3::Endpoints::GetBucketPolicyStatus.build(context)
-          when :get_bucket_replication
-            Aws::S3::Endpoints::GetBucketReplication.build(context)
-          when :get_bucket_request_payment
-            Aws::S3::Endpoints::GetBucketRequestPayment.build(context)
-          when :get_bucket_tagging
-            Aws::S3::Endpoints::GetBucketTagging.build(context)
-          when :get_bucket_versioning
-            Aws::S3::Endpoints::GetBucketVersioning.build(context)
-          when :get_bucket_website
-            Aws::S3::Endpoints::GetBucketWebsite.build(context)
-          when :get_object
-            Aws::S3::Endpoints::GetObject.build(context)
-          when :get_object_acl
-            Aws::S3::Endpoints::GetObjectAcl.build(context)
-          when :get_object_attributes
-            Aws::S3::Endpoints::GetObjectAttributes.build(context)
-          when :get_object_legal_hold
-            Aws::S3::Endpoints::GetObjectLegalHold.build(context)
-          when :get_object_lock_configuration
-            Aws::S3::Endpoints::GetObjectLockConfiguration.build(context)
-          when :get_object_retention
-            Aws::S3::Endpoints::GetObjectRetention.build(context)
-          when :get_object_tagging
-            Aws::S3::Endpoints::GetObjectTagging.build(context)
-          when :get_object_torrent
-            Aws::S3::Endpoints::GetObjectTorrent.build(context)
-          when :get_public_access_block
-            Aws::S3::Endpoints::GetPublicAccessBlock.build(context)
-          when :head_bucket
-            Aws::S3::Endpoints::HeadBucket.build(context)
-          when :head_object
-            Aws::S3::Endpoints::HeadObject.build(context)
-          when :list_bucket_analytics_configurations
-            Aws::S3::Endpoints::ListBucketAnalyticsConfigurations.build(context)
-          when :list_bucket_intelligent_tiering_configurations
-            Aws::S3::Endpoints::ListBucketIntelligentTieringConfigurations.build(context)
-          when :list_bucket_inventory_configurations
-            Aws::S3::Endpoints::ListBucketInventoryConfigurations.build(context)
-          when :list_bucket_metrics_configurations
-            Aws::S3::Endpoints::ListBucketMetricsConfigurations.build(context)
-          when :list_buckets
-            Aws::S3::Endpoints::ListBuckets.build(context)
-          when :list_directory_buckets
-            Aws::S3::Endpoints::ListDirectoryBuckets.build(context)
-          when :list_multipart_uploads
-            Aws::S3::Endpoints::ListMultipartUploads.build(context)
-          when :list_object_versions
-            Aws::S3::Endpoints::ListObjectVersions.build(context)
-          when :list_objects
-            Aws::S3::Endpoints::ListObjects.build(context)
-          when :list_objects_v2
-            Aws::S3::Endpoints::ListObjectsV2.build(context)
-          when :list_parts
-            Aws::S3::Endpoints::ListParts.build(context)
-          when :put_bucket_accelerate_configuration
-            Aws::S3::Endpoints::PutBucketAccelerateConfiguration.build(context)
-          when :put_bucket_acl
-            Aws::S3::Endpoints::PutBucketAcl.build(context)
-          when :put_bucket_analytics_configuration
-            Aws::S3::Endpoints::PutBucketAnalyticsConfiguration.build(context)
-          when :put_bucket_cors
-            Aws::S3::Endpoints::PutBucketCors.build(context)
-          when :put_bucket_encryption
-            Aws::S3::Endpoints::PutBucketEncryption.build(context)
-          when :put_bucket_intelligent_tiering_configuration
-            Aws::S3::Endpoints::PutBucketIntelligentTieringConfiguration.build(context)
-          when :put_bucket_inventory_configuration
-            Aws::S3::Endpoints::PutBucketInventoryConfiguration.build(context)
-          when :put_bucket_lifecycle
-            Aws::S3::Endpoints::PutBucketLifecycle.build(context)
-          when :put_bucket_lifecycle_configuration
-            Aws::S3::Endpoints::PutBucketLifecycleConfiguration.build(context)
-          when :put_bucket_logging
-            Aws::S3::Endpoints::PutBucketLogging.build(context)
-          when :put_bucket_metrics_configuration
-            Aws::S3::Endpoints::PutBucketMetricsConfiguration.build(context)
-          when :put_bucket_notification
-            Aws::S3::Endpoints::PutBucketNotification.build(context)
-          when :put_bucket_notification_configuration
-            Aws::S3::Endpoints::PutBucketNotificationConfiguration.build(context)
-          when :put_bucket_ownership_controls
-            Aws::S3::Endpoints::PutBucketOwnershipControls.build(context)
-          when :put_bucket_policy
-            Aws::S3::Endpoints::PutBucketPolicy.build(context)
-          when :put_bucket_replication
-            Aws::S3::Endpoints::PutBucketReplication.build(context)
-          when :put_bucket_request_payment
-            Aws::S3::Endpoints::PutBucketRequestPayment.build(context)
-          when :put_bucket_tagging
-            Aws::S3::Endpoints::PutBucketTagging.build(context)
-          when :put_bucket_versioning
-            Aws::S3::Endpoints::PutBucketVersioning.build(context)
-          when :put_bucket_website
-            Aws::S3::Endpoints::PutBucketWebsite.build(context)
-          when :put_object
-            Aws::S3::Endpoints::PutObject.build(context)
-          when :put_object_acl
-            Aws::S3::Endpoints::PutObjectAcl.build(context)
-          when :put_object_legal_hold
-            Aws::S3::Endpoints::PutObjectLegalHold.build(context)
-          when :put_object_lock_configuration
-            Aws::S3::Endpoints::PutObjectLockConfiguration.build(context)
-          when :put_object_retention
-            Aws::S3::Endpoints::PutObjectRetention.build(context)
-          when :put_object_tagging
-            Aws::S3::Endpoints::PutObjectTagging.build(context)
-          when :put_public_access_block
-            Aws::S3::Endpoints::PutPublicAccessBlock.build(context)
-          when :restore_object
-            Aws::S3::Endpoints::RestoreObject.build(context)
-          when :select_object_content
-            Aws::S3::Endpoints::SelectObjectContent.build(context)
-          when :upload_part
-            Aws::S3::Endpoints::UploadPart.build(context)
-          when :upload_part_copy
-            Aws::S3::Endpoints::UploadPartCopy.build(context)
-          when :write_get_object_response
-            Aws::S3::Endpoints::WriteGetObjectResponse.build(context)
-          end
-        end
       end
 
       def add_handlers(handlers, _config)

data/lib/aws-sdk-s3/plugins/express_session_auth.rb

@@ -29,24 +29,17 @@ for different buckets.
         # @api private
         class Handler < Seahorse::Client::Handler
           def call(context)
-            if (props = context[:endpoint_properties])
-              # S3 Express endpoint - turn off md5 and enable crc32 default
-              if props['backend'] == 'S3Express'
-                if context.operation_name == :put_object || checksum_required?(context)
-                  context[:default_request_checksum_algorithm] = 'CRC32'
-                end
-                context[:s3_express_endpoint] = true
-              end
+            context[:s3_express_endpoint] = true if s3_express_endpoint?(context)
 
-              # if s3 express auth, use new credentials and sign additional header
-              if context[:auth_scheme]['name'] == 'sigv4-s3express' &&
-                 !context.config.disable_s3_express_session_auth
-                bucket = context.params[:bucket]
-                credentials_provider = context.config.express_credentials_provider
-                credentials = credentials_provider.express_credentials_for(bucket)
-                context[:sigv4_credentials] = credentials # Sign will use this
-              end
+            # if s3 express auth, use new credentials and sign additional header
+            if context[:auth_scheme]['name'] == 'sigv4-s3express' &&
+               !context.config.disable_s3_express_session_auth
+              bucket = context.params[:bucket]
+              credentials_provider = context.config.express_credentials_provider
+              credentials = credentials_provider.express_credentials_for(bucket)
+              context[:sigv4_credentials] = credentials # Sign will use this
             end
+
             with_metric(credentials) { @handler.call(context) }
           end
 
@@ -58,10 +51,8 @@ for different buckets.
             Aws::Plugins::UserAgent.metric('S3_EXPRESS_BUCKET', &block)
           end
 
-          def checksum_required?(context)
-            context.operation.http_checksum_required ||
-              (context.operation.http_checksum &&
-                context.operation.http_checksum['requestChecksumRequired'])
+          def s3_express_endpoint?(context)
+            context[:endpoint_properties]['backend'] == 'S3Express'
           end
         end
 

data/lib/aws-sdk-s3/plugins/http_200_errors.rb

@@ -71,9 +71,9 @@ module Aws
 
           def check_for_error(context)
             xml = context.http_response.body_contents
-            if xml.match(/\?>\s*<Error>/)
-              error_code = xml.match(/<Code>(.+?)<\/Code>/)[1]
-              error_message = xml.match(/<Message>(.+?)<\/Message>/)[1]
+            if xml.match(/<\?xml\s[^>]*\?>\s*<Error>/)
+              error_code = xml.match(%r{<Code>(.+?)</Code>})[1]
+              error_message = xml.match(%r{<Message>(.+?)</Message>})[1]
               S3::Errors.error_class(error_code).new(context, error_message)
             elsif incomplete_xml_body?(xml, context.operation.output)
               Seahorse::Client::NetworkingError.new(