aws-sdk-s3 1.211.0 → 1.217.0

data/lib/aws-sdk-s3/client.rb

@@ -721,10 +721,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -1079,10 +1079,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -1392,10 +1392,13 @@ module Aws::S3
     #     * If the source object that you want to copy is in a directory
     #       bucket, you must have the <b>
     #       <code>s3express:CreateSession</code> </b> permission in the
-    #       `Action` element of a policy to read the object. By default, the
-    #       session is in the `ReadWrite` mode. If you want to restrict the
-    #       access, you can explicitly set the `s3express:SessionMode`
-    #       condition key to `ReadOnly` on the copy source bucket.
+    #       `Action` element of a policy to read the object. If no session
+    #       mode is specified, the session will be created with the maximum
+    #       allowable privilege, attempting `ReadWrite` first, then
+    #       `ReadOnly` if `ReadWrite` is not permitted. If you want to
+    #       explicitly restrict the access to be read-only, you can set the
+    #       `s3express:SessionMode` condition key to `ReadOnly` on the copy
+    #       source bucket.
     #
     #     * If the copy destination is a directory bucket, you must have the
     #       <b> <code>s3express:CreateSession</code> </b> permission in the
@@ -2209,10 +2212,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -2435,6 +2438,20 @@ module Aws::S3
     # configuring, and working with Amazon S3 buckets][2] in the *Amazon S3
     # User Guide*.
     #
+    # General purpose buckets exist in a global namespace, which means that
+    # each bucket name must be unique across all Amazon Web Services
+    # accounts in all the Amazon Web Services Regions within a partition. A
+    # partition is a grouping of Regions. Amazon Web Services currently has
+    # four partitions: `aws` (Standard Regions), `aws-cn` (China Regions),
+    # `aws-us-gov` (Amazon Web Services GovCloud (US)), and `aws-eusc`
+    # (European Sovereign Cloud). When you create a general purpose bucket,
+    # you can choose to create a bucket in the shared global namespace or
+    # you can choose to create a bucket in your account regional namespace.
+    # Your account regional namespace is a subdivision of the global
+    # namespace that only your account can create buckets in. For more
+    # information on account regional namespaces, see [Namespaces for
+    # general purpose buckets][3].
+    #
     # <note markdown="1"> * **General purpose buckets** - If you send your `CreateBucket`
     #   request to the `s3.amazonaws.com` global endpoint, the request goes
     #   to the `us-east-1` Region. So the signature calculations in
@@ -2443,7 +2460,7 @@ module Aws::S3
     #   the bucket is to be created. If you create a bucket in a Region
     #   other than US East (N. Virginia), your application must be able to
     #   handle 307 redirect. For more information, see [Virtual hosting of
-    #   buckets][3] in the *Amazon S3 User Guide*.
+    #   buckets][4] in the *Amazon S3 User Guide*.
     #
     # * <b>Directory buckets </b> - For directory buckets, you must make
     #   requests for this API operation to the Regional endpoint. These
@@ -2451,9 +2468,9 @@ module Aws::S3
     #   `https://s3express-control.region-code.amazonaws.com/bucket-name `.
     #   Virtual-hosted-style requests aren't supported. For more
     #   information about endpoints in Availability Zones, see [Regional and
-    #   Zonal endpoints for directory buckets in Availability Zones][4] in
+    #   Zonal endpoints for directory buckets in Availability Zones][5] in
     #   the *Amazon S3 User Guide*. For more information about endpoints in
-    #   Local Zones, see [Concepts for directory buckets in Local Zones][5]
+    #   Local Zones, see [Concepts for directory buckets in Local Zones][6]
     #   in the *Amazon S3 User Guide*.
     #
     #  </note>
@@ -2496,17 +2513,17 @@ module Aws::S3
     #       disabled. If you would like to share data with users outside of
     #       your account, you can use bucket policies as needed. For more
     #       information, see [Controlling ownership of objects and disabling
-    #       ACLs for your bucket ][6] and [Blocking public access to your
-    #       Amazon S3 storage ][7] in the *Amazon S3 User Guide*.
+    #       ACLs for your bucket ][7] and [Blocking public access to your
+    #       Amazon S3 storage ][8] in the *Amazon S3 User Guide*.
     #
     #     * **S3 Block Public Access** - If your specific use case requires
     #       granting public access to your S3 resources, you can disable
     #       Block Public Access. Specifically, you can create a new bucket
     #       with Block Public Access enabled, then separately call the [
-    #       `DeletePublicAccessBlock` ][8] API. To use this operation, you
+    #       `DeletePublicAccessBlock` ][9] API. To use this operation, you
     #       must have the `s3:PutBucketPublicAccessBlock` permission. For
     #       more information about S3 Block Public Access, see [Blocking
-    #       public access to your Amazon S3 storage ][7] in the *Amazon S3
+    #       public access to your Amazon S3 storage ][8] in the *Amazon S3
     #       User Guide*.
     #   * **Directory bucket permissions** - You must have the
     #     `s3express:CreateBucket` permission in an IAM identity-based
@@ -2515,7 +2532,7 @@ module Aws::S3
     #     performed by the Amazon Web Services account that owns the
     #     resource. For more information about directory bucket policies and
     #     permissions, see [Amazon Web Services Identity and Access
-    #     Management (IAM) for S3 Express One Zone][9] in the *Amazon S3
+    #     Management (IAM) for S3 Express One Zone][10] in the *Amazon S3
     #     User Guide*.
     #
     #     The permissions for ACLs, Object Lock, S3 Object Ownership, and S3
@@ -2525,9 +2542,9 @@ module Aws::S3
     #     enforced (ACLs disabled). These settings can't be modified.
     #
     #      For more information about permissions for creating and working
-    #     with directory buckets, see [Directory buckets][10] in the *Amazon
+    #     with directory buckets, see [Directory buckets][11] in the *Amazon
     #     S3 User Guide*. For more information about supported S3 features
-    #     for directory buckets, see [Features of S3 Express One Zone][11]
+    #     for directory buckets, see [Features of S3 Express One Zone][12]
     #     in the *Amazon S3 User Guide*.
     #
     # HTTP Host header syntax
@@ -2537,9 +2554,9 @@ module Aws::S3
     #
     # The following operations are related to `CreateBucket`:
     #
-    # * [PutObject][12]
+    # * [PutObject][13]
     #
-    # * [DeleteBucket][13]
+    # * [DeleteBucket][14]
     #
     # You must URL encode any signed header values that contain spaces. For
     # example, if your header value is `my file.txt`, containing two spaces
@@ -2549,17 +2566,18 @@ module Aws::S3
     #
     # [1]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateBucket.html
     # [2]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-buckets-s3.html
-    # [3]: https://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html
-    # [4]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/endpoint-directory-buckets-AZ.html
-    # [5]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-lzs-for-directory-buckets.html
-    # [6]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html
-    # [7]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
-    # [8]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeletePublicAccessBlock.html
-    # [9]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html
-    # [10]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-overview.html
-    # [11]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-one-zone.html#s3-express-features
-    # [12]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html
-    # [13]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
+    # [3]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html
+    # [4]: https://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html
+    # [5]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/endpoint-directory-buckets-AZ.html
+    # [6]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-lzs-for-directory-buckets.html
+    # [7]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html
+    # [8]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
+    # [9]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeletePublicAccessBlock.html
+    # [10]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html
+    # [11]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-overview.html
+    # [12]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-one-zone.html#s3-express-features
+    # [13]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html
+    # [14]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
     #
     # @option params [String] :acl
     #   The canned ACL to apply to the bucket.
@@ -2676,6 +2694,34 @@ module Aws::S3
     #
     #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html
     #
+    # @option params [String] :bucket_namespace
+    #   Specifies the namespace where you want to create your general purpose
+    #   bucket. When you create a general purpose bucket, you can choose to
+    #   create a bucket in the shared global namespace or you can choose to
+    #   create a bucket in your account regional namespace. Your account
+    #   regional namespace is a subdivision of the global namespace that only
+    #   your account can create buckets in. For more information on bucket
+    #   namespaces, see [Namespaces for general purpose buckets][1].
+    #
+    #   General purpose buckets in your account regional namespace must follow
+    #   a specific naming convention. These buckets consist of a bucket name
+    #   prefix that you create, and a suffix that contains your 12-digit
+    #   Amazon Web Services Account ID, the Amazon Web Services Region code,
+    #   and ends with `-an`. Bucket names must follow the format
+    #   `bucket-name-prefix-accountId-region-an` (for example,
+    #   `amzn-s3-demo-bucket-111122223333-us-west-2-an`). For information
+    #   about bucket naming restrictions, see [Account regional namespace
+    #   naming rules][2] in the *Amazon S3 User Guide*.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html
+    #   [2]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html#account-regional-naming-rules
+    #
     # @return [Types::CreateBucketOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreateBucketOutput#location #location} => String
@@ -2740,6 +2786,7 @@ module Aws::S3
     #     grant_write_acp: "GrantWriteACP",
     #     object_lock_enabled_for_bucket: false,
     #     object_ownership: "BucketOwnerPreferred", # accepts BucketOwnerPreferred, ObjectWriter, BucketOwnerEnforced
+    #     bucket_namespace: "account-regional", # accepts account-regional, global
     #   })
     #
     # @example Response structure
@@ -3810,10 +3857,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -4146,12 +4193,17 @@ module Aws::S3
     #
     # @option params [String] :session_mode
     #   Specifies the mode of the session that will be created, either
-    #   `ReadWrite` or `ReadOnly`. By default, a `ReadWrite` session is
-    #   created. A `ReadWrite` session is capable of executing all the Zonal
-    #   endpoint API operations on a directory bucket. A `ReadOnly` session is
-    #   constrained to execute the following Zonal endpoint API operations:
-    #   `GetObject`, `HeadObject`, `ListObjectsV2`, `GetObjectAttributes`,
-    #   `ListParts`, and `ListMultipartUploads`.
+    #   `ReadWrite` or `ReadOnly`. If no session mode is specified, the
+    #   default behavior attempts to create a session with the maximum
+    #   allowable privilege. It will first attempt to create a `ReadWrite`
+    #   session, and if that is not allowed by permissions, it will attempt to
+    #   create a `ReadOnly` session. If neither session type is allowed, the
+    #   request will return an Access Denied error. A `ReadWrite` session is
+    #   capable of executing all the Zonal endpoint API operations on a
+    #   directory bucket. A `ReadOnly` session is constrained to execute the
+    #   following Zonal endpoint API operations: `GetObject`, `HeadObject`,
+    #   `ListObjectsV2`, `GetObjectAttributes`, `ListParts`, and
+    #   `ListMultipartUploads`.
     #
     # @option params [required, String] :bucket
     #   The name of the bucket that you create a session for.
@@ -5398,10 +5450,6 @@ module Aws::S3
     # for a general purpose bucket][1], you can no longer use this operation
     # for that bucket and must use [UntagResource][2] instead.
     #
-    # if ABAC is not enabled for the bucket. When you [enable ABAC for a
-    # general purpose bucket][1], you can no longer use this operation for
-    # that bucket and must use [UntagResource][2] instead.
-    #
     # To use this operation, you must have permission to perform the
     # `s3:PutBucketTagging` action. By default, the bucket owner has this
     # permission and can grant this permission to others.
@@ -5734,10 +5782,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -6196,10 +6244,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -6548,10 +6596,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -8738,10 +8786,6 @@ module Aws::S3
     #
     # Returns the tag set associated with the general purpose bucket.
     #
-    # if ABAC is not enabled for the bucket. When you [enable ABAC for a
-    # general purpose bucket][1], you can no longer use this operation for
-    # that bucket and must use [ListTagsForResource][2] instead.
-    #
     # To use this operation, you must have permission to perform the
     # `s3:GetBucketTagging` action. By default, the bucket owner has this
     # permission and can grant this permission to others.
@@ -8756,9 +8800,9 @@ module Aws::S3
     #
     # The following operations are related to `GetBucketTagging`:
     #
-    # * [PutBucketTagging][3]
+    # * [PutBucketTagging][1]
     #
-    # * [DeleteBucketTagging][4]
+    # * [DeleteBucketTagging][2]
     #
     # You must URL encode any signed header values that contain spaces. For
     # example, if your header value is `my file.txt`, containing two spaces
@@ -8766,10 +8810,8 @@ module Aws::S3
     #
     #
     #
-    # [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/buckets-tagging-enable-abac.html
-    # [2]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListTagsForResource.html
-    # [3]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketTagging.html
-    # [4]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketTagging.html
+    # [1]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketTagging.html
+    # [2]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketTagging.html
     #
     # @option params [required, String] :bucket
     #   The name of the bucket for which to get the tagging information.
@@ -9454,10 +9496,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -9759,10 +9801,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -10170,10 +10212,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -10315,10 +10357,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -10493,10 +10535,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -10624,10 +10666,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -10759,10 +10801,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -10950,10 +10992,12 @@ module Aws::S3
     #
     #   * **Directory bucket permissions** - You must have the <b>
     #     <code>s3express:CreateSession</code> </b> permission in the
-    #     `Action` element of a policy. By default, the session is in the
-    #     `ReadWrite` mode. If you want to restrict the access, you can
-    #     explicitly set the `s3express:SessionMode` condition key to
-    #     `ReadOnly` on the bucket.
+    #     `Action` element of a policy. If no session mode is specified, the
+    #     session will be created with the maximum allowable privilege,
+    #     attempting `ReadWrite` first, then `ReadOnly` if `ReadWrite` is
+    #     not permitted. If you want to explicitly restrict the access to be
+    #     read-only, you can set the `s3express:SessionMode` condition key
+    #     to `ReadOnly` on the bucket.
     #
     #     For more information about example bucket policies, see [Example
     #     bucket policies for S3 Express One Zone][3] and [Amazon Web
@@ -11446,10 +11490,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -12567,10 +12611,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -12851,10 +12895,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -13748,10 +13792,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -15448,8 +15492,6 @@ module Aws::S3
     #  </note>
     #
     # Rules
-    # Permissions
-    # HTTP Host header syntax
     #
     # : You specify the lifecycle configuration in your request body. The
     #   lifecycle configuration is specified as XML consisting of one or
@@ -15488,6 +15530,8 @@ module Aws::S3
     #
     #   For more information, see [Object Lifecycle Management][3] and
     #   [Lifecycle Configuration Elements][4].
+    #
+    # Permissions
     # : * **General purpose bucket permissions** - By default, all Amazon S3
     #     resources are private, including buckets, objects, and related
     #     subresources (for example, lifecycle configuration and website
@@ -15537,6 +15581,8 @@ module Aws::S3
     #
     #      </note>
     #
+    # HTTP Host header syntax
+    #
     # : <b>Directory buckets </b> - The HTTP Host header syntax is
     #   `s3express-control.region.amazonaws.com`.
     #
@@ -17597,6 +17643,20 @@ module Aws::S3
     #
     # : <b>Directory buckets </b> - The HTTP Host header syntax is `
     #   Bucket-name.s3express-zone-id.region-code.amazonaws.com`.
+    # ^
+    #
+    # Errors
+    # : * You might receive an `InvalidRequest` error for several reasons.
+    #     Depending on the reason for the error, you might receive one of
+    #     the following messages:
+    #
+    #     * Cannot specify both a write offset value and user-defined object
+    #       metadata for existing objects.
+    #
+    #     * Checksum Type mismatch occurred, expected checksum Type: sha1,
+    #       actual checksum Type: crc32c.
+    #
+    #     * Request body cannot be empty when 'write offset' is specified.
     #
     # For more information about related Amazon S3 APIs, see the following:
     #
@@ -18220,10 +18280,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -18802,10 +18862,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -18948,10 +19008,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -19065,10 +19125,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -19199,10 +19259,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -19988,10 +20048,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -20762,6 +20822,260 @@ module Aws::S3
       req.send_request(options)
     end
 
+    # <note markdown="1"> This operation is not supported for directory buckets or Amazon S3 on
+    # Outposts buckets.
+    #
+    #  </note>
+    #
+    # Updates the server-side encryption type of an existing encrypted
+    # object in a general purpose bucket. You can use the
+    # `UpdateObjectEncryption` operation to change encrypted objects from
+    # server-side encryption with Amazon S3 managed keys (SSE-S3) to
+    # server-side encryption with Key Management Service (KMS) keys
+    # (SSE-KMS), or to apply S3 Bucket Keys. You can also use the
+    # `UpdateObjectEncryption` operation to change the customer-managed KMS
+    # key used to encrypt your data so that you can comply with custom
+    # key-rotation standards.
+    #
+    # Using the `UpdateObjectEncryption` operation, you can atomically
+    # update the server-side encryption type of an existing object in a
+    # general purpose bucket without any data movement. The
+    # `UpdateObjectEncryption` operation uses envelope encryption to
+    # re-encrypt the data key used to encrypt and decrypt your object with
+    # your newly specified server-side encryption type. In other words, when
+    # you use the `UpdateObjectEncryption` operation, your data isn't
+    # copied, archived objects in the S3 Glacier Flexible Retrieval and S3
+    # Glacier Deep Archive storage classes aren't restored, and objects in
+    # the S3 Intelligent-Tiering storage class aren't moved between tiers.
+    # Additionally, the `UpdateObjectEncryption` operation preserves all
+    # object metadata properties, including the storage class, creation
+    # date, last modified date, ETag, and checksum properties. For more
+    # information, see [ Updating server-side encryption for existing
+    # objects][1] in the *Amazon S3 User Guide*.
+    #
+    # By default, all `UpdateObjectEncryption` requests that specify a
+    # customer-managed KMS key are restricted to KMS keys that are owned by
+    # the bucket owner's Amazon Web Services account. If you're using
+    # Organizations, you can request the ability to use KMS keys owned by
+    # other member accounts within your organization by contacting Amazon
+    # Web Services Support.
+    #
+    # <note markdown="1"> Source objects that are unencrypted, or encrypted with either
+    # dual-layer server-side encryption with KMS keys (DSSE-KMS) or
+    # server-side encryption with customer-provided keys (SSE-C) aren't
+    # supported by this operation. Additionally, you cannot specify SSE-S3
+    # encryption as the requested new encryption type
+    # `UpdateObjectEncryption` request.
+    #
+    #  </note>
+    #
+    # Permissions
+    # : * To use the `UpdateObjectEncryption` operation, you must have the
+    #     following permissions:
+    #
+    #     * `s3:PutObject`
+    #
+    #     * `s3:UpdateObjectEncryption`
+    #
+    #     * `kms:Encrypt`
+    #
+    #     * `kms:Decrypt`
+    #
+    #     * `kms:GenerateDataKey`
+    #
+    #     * `kms:ReEncrypt*`
+    #   * If you're using Organizations, to use this operation with
+    #     customer-managed KMS keys from other Amazon Web Services accounts
+    #     within your organization, you must have the
+    #     `organizations:DescribeAccount` permission.
+    # ^
+    #
+    # Errors
+    # : * You might receive an `InvalidRequest` error for several reasons.
+    #     Depending on the reason for the error, you might receive one of
+    #     the following messages:
+    #
+    #     * The `UpdateObjectEncryption` operation doesn't supported
+    #       unencrypted source objects. Only source objects encrypted with
+    #       SSE-S3 or SSE-KMS are supported.
+    #
+    #     * The `UpdateObjectEncryption` operation doesn't support source
+    #       objects with the encryption type DSSE-KMS or SSE-C. Only source
+    #       objects encrypted with SSE-S3 or SSE-KMS are supported.
+    #
+    #     * The `UpdateObjectEncryption` operation doesn't support updating
+    #       the encryption type to DSSE-KMS or SSE-C. Modify the request to
+    #       specify SSE-KMS for the updated encryption type, and then try
+    #       again.
+    #
+    #     * Requests that modify an object encryption configuration require
+    #       Amazon Web Services Signature Version 4. Modify the request to
+    #       use Amazon Web Services Signature Version 4, and then try again.
+    #
+    #     * Requests that modify an object encryption configuration require
+    #       a valid new encryption type. Valid values are `SSEKMS`. Modify
+    #       the request to specify SSE-KMS for the updated encryption type,
+    #       and then try again.
+    #
+    #     * Requests that modify an object's encryption type to SSE-KMS
+    #       require an Amazon Web Services KMS key Amazon Resource Name
+    #       (ARN). Modify the request to specify a KMS key ARN, and then try
+    #       again.
+    #
+    #     * Requests that modify an object's encryption type to SSE-KMS
+    #       require a valid Amazon Web Services KMS key Amazon Resource Name
+    #       (ARN). Confirm that you have a correctly formatted KMS key ARN
+    #       in your request, and then try again.
+    #
+    #     * The `BucketKeyEnabled` value isn't valid. Valid values are
+    #       `true` or `false`. Modify the request to specify a valid value,
+    #       and then try again.
+    #   * You might receive an `AccessDenied` error for several reasons.
+    #     Depending on the reason for the error, you might receive one of
+    #     the following messages:
+    #
+    #     * The Amazon Web Services KMS key in the request must be owned by
+    #       the same account as the bucket. Modify the request to specify a
+    #       KMS key from the same account, and then try again.
+    #
+    #     * The bucket owner's account was approved to make
+    #       `UpdateObjectEncryption` requests that use any Amazon Web
+    #       Services KMS key in their organization, but the bucket owner's
+    #       account isn't part of an organization in Organizations. Make
+    #       sure that the bucket owner's account and the specified KMS key
+    #       belong to the same organization, and then try again.
+    #
+    #     * The specified Amazon Web Services KMS key must be from the same
+    #       organization in Organizations as the bucket. Specify a KMS key
+    #       that belongs to the same organization as the bucket, and then
+    #       try again.
+    #
+    #     * The encryption type for the specified object can’t be updated
+    #       because that object is protected by S3 Object Lock. If the
+    #       object has a governance-mode retention period or a legal hold,
+    #       you must first remove the Object Lock status on the object
+    #       before you issue your `UpdateObjectEncryption` request. You
+    #       can't use the `UpdateObjectEncryption` operation with objects
+    #       that have an Object Lock compliance mode retention period
+    #       applied to them.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/update-sse-encryption.html
+    #
+    # @option params [required, String] :bucket
+    #   The name of the general purpose bucket that contains the specified
+    #   object key name.
+    #
+    #   When you use this operation with an access point attached to a general
+    #   purpose bucket, you must either provide the alias of the access point
+    #   in place of the bucket name or you must specify the access point
+    #   Amazon Resource Name (ARN). When using the access point ARN, you must
+    #   direct requests to the access point hostname. The access point
+    #   hostname takes the form `
+    #   AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com`. When
+    #   using this operation with an access point through the Amazon Web
+    #   Services SDKs, you provide the access point ARN in place of the bucket
+    #   name. For more information about access point ARNs, see [ Referencing
+    #   access points][1] in the *Amazon S3 User Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points-naming.html
+    #
+    # @option params [required, String] :key
+    #   The key name of the object that you want to update the server-side
+    #   encryption type for.
+    #
+    # @option params [String] :version_id
+    #   The version ID of the object that you want to update the server-side
+    #   encryption type for.
+    #
+    # @option params [required, Types::ObjectEncryption] :object_encryption
+    #   The updated server-side encryption type for this object. The
+    #   `UpdateObjectEncryption` operation supports the SSE-S3 and SSE-KMS
+    #   encryption types.
+    #
+    #   Valid Values: `SSES3` \| `SSEKMS`
+    #
+    # @option params [String] :request_payer
+    #   Confirms that the requester knows that they will be charged for the
+    #   request. Bucket owners need not specify this parameter in their
+    #   requests. If either the source or destination S3 bucket has Requester
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
+    #
+    #   <note markdown="1"> This functionality is not supported for directory buckets.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
+    #
+    # @option params [String] :expected_bucket_owner
+    #   The account ID of the expected bucket owner. If the account ID that
+    #   you provide doesn't match the actual owner of the bucket, the request
+    #   fails with the HTTP status code `403 Forbidden` (access denied).
+    #
+    # @option params [String] :content_md5
+    #   The MD5 hash for the request body. For requests made using the Amazon
+    #   Web Services Command Line Interface (CLI) or Amazon Web Services SDKs,
+    #   this field is calculated automatically.
+    #
+    # @option params [String] :checksum_algorithm
+    #   Indicates the algorithm used to create the checksum for the object
+    #   when you use an Amazon Web Services SDK. This header doesn't provide
+    #   any additional functionality if you don't use the SDK. When you send
+    #   this header, there must be a corresponding `x-amz-checksum` or
+    #   `x-amz-trailer` header sent. Otherwise, Amazon S3 fails the request
+    #   with the HTTP status code `400 Bad Request`. For more information, see
+    #   [ Checking object integrity ][1] in the *Amazon S3 User Guide*.
+    #
+    #   If you provide an individual checksum, Amazon S3 ignores any provided
+    #   `ChecksumAlgorithm` parameter.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html
+    #
+    # @return [Types::UpdateObjectEncryptionResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::UpdateObjectEncryptionResponse#request_charged #request_charged} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.update_object_encryption({
+    #     bucket: "BucketName", # required
+    #     key: "ObjectKey", # required
+    #     version_id: "ObjectVersionId",
+    #     object_encryption: { # required
+    #       ssekms: {
+    #         kms_key_arn: "NonEmptyKmsKeyArnString", # required
+    #         bucket_key_enabled: false,
+    #       },
+    #     },
+    #     request_payer: "requester", # accepts requester
+    #     expected_bucket_owner: "AccountId",
+    #     content_md5: "ContentMD5",
+    #     checksum_algorithm: "CRC32", # accepts CRC32, CRC32C, SHA1, SHA256, CRC64NVME
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.request_charged #=> String, one of "requester"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/UpdateObjectEncryption AWS API Documentation
+    #
+    # @overload update_object_encryption(params = {})
+    # @param [Hash] params ({})
+    def update_object_encryption(params = {}, options = {})
+      req = build_request(:update_object_encryption, params)
+      req.send_request(options)
+    end
+
     # Uploads a part in a multipart upload.
     #
     # <note markdown="1"> In this operation, you provide new data as a part of an object in your
@@ -21148,10 +21462,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -21340,10 +21654,13 @@ module Aws::S3
     #     * If the source object that you want to copy is in a directory
     #       bucket, you must have the <b>
     #       <code>s3express:CreateSession</code> </b> permission in the
-    #       `Action` element of a policy to read the object. By default, the
-    #       session is in the `ReadWrite` mode. If you want to restrict the
-    #       access, you can explicitly set the `s3express:SessionMode`
-    #       condition key to `ReadOnly` on the copy source bucket.
+    #       `Action` element of a policy to read the object. If no session
+    #       mode is specified, the session will be created with the maximum
+    #       allowable privilege, attempting `ReadWrite` first, then
+    #       `ReadOnly` if `ReadWrite` is not permitted. If you want to
+    #       explicitly restrict the access to be read-only, you can set the
+    #       `s3express:SessionMode` condition key to `ReadOnly` on the copy
+    #       source bucket.
     #
     #     * If the copy destination is a directory bucket, you must have the
     #       <b> <code>s3express:CreateSession</code> </b> permission in the
@@ -21713,10 +22030,10 @@ module Aws::S3
     #   Confirms that the requester knows that they will be charged for the
     #   request. Bucket owners need not specify this parameter in their
     #   requests. If either the source or destination S3 bucket has Requester
-    #   Pays enabled, the requester will pay for corresponding charges to copy
-    #   the object. For information about downloading objects from Requester
-    #   Pays buckets, see [Downloading Objects in Requester Pays Buckets][1]
-    #   in the *Amazon S3 User Guide*.
+    #   Pays enabled, the requester will pay for the corresponding charges.
+    #   For information about downloading objects from Requester Pays buckets,
+    #   see [Downloading Objects in Requester Pays Buckets][1] in the *Amazon
+    #   S3 User Guide*.
     #
     #   <note markdown="1"> This functionality is not supported for directory buckets.
     #
@@ -22283,7 +22600,7 @@ module Aws::S3
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-s3'
-      context[:gem_version] = '1.211.0'
+      context[:gem_version] = '1.217.0'
       Seahorse::Client::Request.new(handlers, context)
     end