aws-sdk-s3 1.220.0 → 1.232.2

data/lib/aws-sdk-s3/customizations/object.rb

@@ -54,6 +54,27 @@ module Aws
       #   and any checksums will not change. This is especially useful if the
       #   source object has parts with varied sizes.
       #
+      # @option options [String] :tags_directive Only used when
+      #   `:multipart_copy` is `true`. When set to `'COPY'`, source object
+      #   tags are fetched and applied to the destination via PutObjectTagging.
+      #   When set to `'REPLACE'`, the provided `:tagging` value is parsed and
+      #   applied via PutObjectTagging. When not set, `:tagging` (if provided)
+      #   is passed to CreateMultipartUpload directly. Works with or without
+      #   `:content_length` — tags are fetched from source regardless of
+      #   whether HeadObject is skipped.
+      #
+      # @option options [String] :annotations_directive Only used when
+      #   `:multipart_copy` is `true`. When set to `'COPY'`, source object
+      #   annotations are fetched and applied to the destination after the
+      #   multipart upload completes. Works with or without `:content_length`.
+      #
+      # @option options [String] :metadata_directive Only used when
+      #   `:multipart_copy` is `true`. When set to `'REPLACE'`, source metadata
+      #   from HeadObject is not merged into CreateMultipartUpload — only
+      #   caller-supplied values (e.g. `:metadata`, `:content_type`) are used.
+      #   Has no effect when `:content_length` is provided since HeadObject
+      #   is already skipped.
+      #
       # @example Basic object copy
       #
       #   bucket = Aws::S3::Bucket.new('target-bucket')
@@ -385,17 +406,20 @@ module Aws
       def upload_stream(options = {}, &block)
         upload_opts = options.merge(bucket: bucket_name, key: key)
         executor = DefaultExecutor.new(max_threads: upload_opts.delete(:thread_count))
-        uploader = MultipartStreamUploader.new(
-          client: client,
-          executor: executor,
-          tempfile: upload_opts.delete(:tempfile),
-          part_size: upload_opts.delete(:part_size)
-        )
-        Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
-          uploader.upload(upload_opts, &block)
+        begin
+          uploader = MultipartStreamUploader.new(
+            client: client,
+            executor: executor,
+            tempfile: upload_opts.delete(:tempfile),
+            part_size: upload_opts.delete(:part_size)
+          )
+          Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
+            uploader.upload(upload_opts, &block)
+          end
+          true
+        ensure
+          executor.shutdown
         end
-        executor.shutdown
-        true
       end
       deprecated(:upload_stream, use: 'Aws::S3::TransferManager#upload_stream', version: 'next major version')
 
@@ -459,17 +483,20 @@ module Aws
       def upload_file(source, options = {})
         upload_opts = options.merge(bucket: bucket_name, key: key)
         executor = DefaultExecutor.new(max_threads: upload_opts.delete(:thread_count))
-        uploader = FileUploader.new(
-          client: client,
-          executor: executor,
-          multipart_threshold: upload_opts.delete(:multipart_threshold)
-        )
-        response = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
-          uploader.upload(source, upload_opts)
+        begin
+          uploader = FileUploader.new(
+            client: client,
+            executor: executor,
+            multipart_threshold: upload_opts.delete(:multipart_threshold)
+          )
+          response = Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
+            uploader.upload(source, upload_opts)
+          end
+          yield response if block_given?
+          true
+        ensure
+          executor.shutdown
         end
-        yield response if block_given?
-        executor.shutdown
-        true
       end
       deprecated(:upload_file, use: 'Aws::S3::TransferManager#upload_file', version: 'next major version')
 
@@ -541,12 +568,15 @@ module Aws
       def download_file(destination, options = {})
         download_opts = options.merge(bucket: bucket_name, key: key)
         executor = DefaultExecutor.new(max_threads: download_opts.delete([:thread_count]))
-        downloader = FileDownloader.new(client: client, executor: executor)
-        Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
-          downloader.download(destination, download_opts)
+        begin
+          downloader = FileDownloader.new(client: client, executor: executor)
+          Aws::Plugins::UserAgent.metric('RESOURCE_MODEL') do
+            downloader.download(destination, download_opts)
+          end
+          true
+        ensure
+          executor.shutdown
         end
-        executor.shutdown
-        true
       end
       deprecated(:download_file, use: 'Aws::S3::TransferManager#download_file', version: 'next major version')
 

data/lib/aws-sdk-s3/encryptionV2/kms_cipher_provider.rb

@@ -50,7 +50,7 @@ module Aws
         # @return [Cipher] Given an encryption envelope, returns a
         #   decryption cipher.
         def decryption_cipher(envelope, options = {})
-          encryption_context = Json.load(envelope['x-amz-matdesc'])
+          encryption_context = extract_encryption_context(envelope['x-amz-matdesc'])
           cek_alg = envelope['x-amz-cek-alg']
 
           case envelope['x-amz-wrap-alg']
@@ -115,6 +115,19 @@ module Aws
 
         private
 
+        # Raise a decryption error for a malformed material description. A
+        # material description must be a JSON object.
+        def extract_encryption_context(matdesc)
+          context = Json.load(matdesc) if matdesc.is_a?(String)
+          unless context.is_a?(Hash)
+            raise Errors::DecryptionError, 'Malformed material description'
+          end
+
+          context
+        rescue Aws::Json::ParseError, EncodingError
+          raise Errors::DecryptionError, 'Malformed material description'
+        end
+
         def validate_key_wrap(key_wrap_schema)
           case key_wrap_schema
           when :kms_context then 'kms+context'

data/lib/aws-sdk-s3/encryptionV3/kms_cipher_provider.rb

@@ -54,7 +54,7 @@ module Aws
             cek_alg = envelope['x-amz-c']
             encryption_context =
               if !envelope['x-amz-t'].nil?
-                Json.load(envelope['x-amz-t'])
+                extract_encryption_context(envelope['x-amz-t'])
               else
                 ##= ../specification/s3-encryption/data-format/content-metadata.md#v3-only
                 ##% If the mapkey x-amz-t is not present, the default Material Description value MUST be set to an empty map (`{}`).
@@ -102,6 +102,18 @@ module Aws
 
         private
 
+        # Raise a decryption error for a malformed material description.
+        def extract_encryption_context(matdesc)
+          context = Json.load(matdesc) if matdesc.is_a?(String)
+          unless context.is_a?(Hash)
+            raise Errors::DecryptionError, 'Malformed material description'
+          end
+
+          context
+        rescue Aws::Json::ParseError, EncodingError
+          raise Errors::DecryptionError, 'Malformed material description'
+        end
+
         def validate_key_wrap(key_wrap_schema)
           case key_wrap_schema
           when :kms_context then '12'

data/lib/aws-sdk-s3/endpoint_provider.rb

@@ -710,10 +710,13 @@ module Aws::S3
                               if (outpost_type = Aws::Endpoints::Matchers.attr(bucket_arn, "resourceId[2]"))
                                 if (access_point_name = Aws::Endpoints::Matchers.attr(bucket_arn, "resourceId[3]"))
                                   if Aws::Endpoints::Matchers.string_equals?(outpost_type, "accesspoint")
-                                    if Aws::Endpoints::Matchers.set?(parameters.endpoint) && (url = Aws::Endpoints::Matchers.parse_url(parameters.endpoint))
-                                      return Aws::Endpoints::Endpoint.new(url: "https://#{access_point_name}-#{bucket_arn['accountId']}.#{outpost_id}.#{url['authority']}", headers: {}, properties: {"authSchemes" => [{"disableDoubleEncoding" => true, "name" => "sigv4a", "signingName" => "s3-outposts", "signingRegionSet" => ["*"]}, {"disableDoubleEncoding" => true, "name" => "sigv4", "signingName" => "s3-outposts", "signingRegion" => "#{bucket_arn['region']}"}]})
+                                    if Aws::Endpoints::Matchers.valid_host_label?(access_point_name, false)
+                                      if Aws::Endpoints::Matchers.set?(parameters.endpoint) && (url = Aws::Endpoints::Matchers.parse_url(parameters.endpoint))
+                                        return Aws::Endpoints::Endpoint.new(url: "https://#{access_point_name}-#{bucket_arn['accountId']}.#{outpost_id}.#{url['authority']}", headers: {}, properties: {"authSchemes" => [{"disableDoubleEncoding" => true, "name" => "sigv4a", "signingName" => "s3-outposts", "signingRegionSet" => ["*"]}, {"disableDoubleEncoding" => true, "name" => "sigv4", "signingName" => "s3-outposts", "signingRegion" => "#{bucket_arn['region']}"}]})
+                                      end
+                                      return Aws::Endpoints::Endpoint.new(url: "https://#{access_point_name}-#{bucket_arn['accountId']}.#{outpost_id}.s3-outposts.#{bucket_arn['region']}.#{bucket_partition['dnsSuffix']}", headers: {}, properties: {"authSchemes" => [{"disableDoubleEncoding" => true, "name" => "sigv4a", "signingName" => "s3-outposts", "signingRegionSet" => ["*"]}, {"disableDoubleEncoding" => true, "name" => "sigv4", "signingName" => "s3-outposts", "signingRegion" => "#{bucket_arn['region']}"}]})
                                     end
-                                    return Aws::Endpoints::Endpoint.new(url: "https://#{access_point_name}-#{bucket_arn['accountId']}.#{outpost_id}.s3-outposts.#{bucket_arn['region']}.#{bucket_partition['dnsSuffix']}", headers: {}, properties: {"authSchemes" => [{"disableDoubleEncoding" => true, "name" => "sigv4a", "signingName" => "s3-outposts", "signingRegionSet" => ["*"]}, {"disableDoubleEncoding" => true, "name" => "sigv4", "signingName" => "s3-outposts", "signingRegion" => "#{bucket_arn['region']}"}]})
+                                    raise ArgumentError, "Invalid ARN: The access point name may only contain a-z, A-Z, 0-9 and `-`. Found: `#{access_point_name}`"
                                   end
                                   raise ArgumentError, "Expected an outpost type `accesspoint`, found #{outpost_type}"
                                 end

data/lib/aws-sdk-s3/endpoints.rb

@@ -303,6 +303,17 @@ module Aws::S3
       end
     end
 
+    class DeleteObjectAnnotation
+      def self.build(context)
+        Aws::S3::EndpointParameters.create(
+          context.config,
+          bucket: context.params[:bucket],
+          use_dual_stack: context[:use_dualstack_endpoint],
+          accelerate: context[:use_accelerate_endpoint],
+        )
+      end
+    end
+
     class DeleteObjectTagging
       def self.build(context)
         Aws::S3::EndpointParameters.create(
@@ -660,6 +671,18 @@ module Aws::S3
       end
     end
 
+    class GetObjectAnnotation
+      def self.build(context)
+        Aws::S3::EndpointParameters.create(
+          context.config,
+          bucket: context.params[:bucket],
+          use_dual_stack: context[:use_dualstack_endpoint],
+          accelerate: context[:use_accelerate_endpoint],
+          key: context.params[:key],
+        )
+      end
+    end
+
     class GetObjectAttributes
       def self.build(context)
         Aws::S3::EndpointParameters.create(
@@ -842,6 +865,17 @@ module Aws::S3
       end
     end
 
+    class ListObjectAnnotations
+      def self.build(context)
+        Aws::S3::EndpointParameters.create(
+          context.config,
+          bucket: context.params[:bucket],
+          use_dual_stack: context[:use_dualstack_endpoint],
+          accelerate: context[:use_accelerate_endpoint],
+        )
+      end
+    end
+
     class ListObjectVersions
       def self.build(context)
         Aws::S3::EndpointParameters.create(
@@ -1165,6 +1199,18 @@ module Aws::S3
       end
     end
 
+    class PutObjectAnnotation
+      def self.build(context)
+        Aws::S3::EndpointParameters.create(
+          context.config,
+          bucket: context.params[:bucket],
+          use_dual_stack: context[:use_dualstack_endpoint],
+          accelerate: context[:use_accelerate_endpoint],
+          key: context.params[:key],
+        )
+      end
+    end
+
     class PutObjectLegalHold
       def self.build(context)
         Aws::S3::EndpointParameters.create(
@@ -1255,6 +1301,18 @@ module Aws::S3
       end
     end
 
+    class UpdateBucketMetadataAnnotationTableConfiguration
+      def self.build(context)
+        Aws::S3::EndpointParameters.create(
+          context.config,
+          bucket: context.params[:bucket],
+          use_dual_stack: context[:use_dualstack_endpoint],
+          accelerate: context[:use_accelerate_endpoint],
+          use_s3_express_control_endpoint: true,
+        )
+      end
+    end
+
     class UpdateBucketMetadataInventoryTableConfiguration
       def self.build(context)
         Aws::S3::EndpointParameters.create(
@@ -1376,6 +1434,8 @@ module Aws::S3
         DeleteBucketWebsite.build(context)
       when :delete_object
         DeleteObject.build(context)
+      when :delete_object_annotation
+        DeleteObjectAnnotation.build(context)
       when :delete_object_tagging
         DeleteObjectTagging.build(context)
       when :delete_objects
@@ -1436,6 +1496,8 @@ module Aws::S3
         GetObject.build(context)
       when :get_object_acl
         GetObjectAcl.build(context)
+      when :get_object_annotation
+        GetObjectAnnotation.build(context)
       when :get_object_attributes
         GetObjectAttributes.build(context)
       when :get_object_legal_hold
@@ -1468,6 +1530,8 @@ module Aws::S3
         ListDirectoryBuckets.build(context)
       when :list_multipart_uploads
         ListMultipartUploads.build(context)
+      when :list_object_annotations
+        ListObjectAnnotations.build(context)
       when :list_object_versions
         ListObjectVersions.build(context)
       when :list_objects
@@ -1522,6 +1586,8 @@ module Aws::S3
         PutObject.build(context)
       when :put_object_acl
         PutObjectAcl.build(context)
+      when :put_object_annotation
+        PutObjectAnnotation.build(context)
       when :put_object_legal_hold
         PutObjectLegalHold.build(context)
       when :put_object_lock_configuration
@@ -1538,6 +1604,8 @@ module Aws::S3
         RestoreObject.build(context)
       when :select_object_content
         SelectObjectContent.build(context)
+      when :update_bucket_metadata_annotation_table_configuration
+        UpdateBucketMetadataAnnotationTableConfiguration.build(context)
       when :update_bucket_metadata_inventory_table_configuration
         UpdateBucketMetadataInventoryTableConfiguration.build(context)
       when :update_bucket_metadata_journal_table_configuration

data/lib/aws-sdk-s3/errors.rb

@@ -28,19 +28,25 @@ module Aws::S3
   #
   # ## Error Classes
   # * {AccessDenied}
+  # * {AnnotationLimitExceeded}
+  # * {AnnotationNameTooLong}
   # * {BucketAlreadyExists}
   # * {BucketAlreadyOwnedByYou}
   # * {EncryptionTypeMismatch}
   # * {IdempotencyParameterMismatch}
+  # * {InvalidAnnotationName}
   # * {InvalidObjectState}
+  # * {InvalidPrefix}
   # * {InvalidRequest}
   # * {InvalidWriteOffset}
+  # * {NoSuchAnnotation}
   # * {NoSuchBucket}
   # * {NoSuchKey}
   # * {NoSuchUpload}
   # * {ObjectAlreadyInActiveTierError}
   # * {ObjectNotInActiveTierError}
   # * {TooManyParts}
+  # * {UnsupportedMediaType}
   #
   # Additionally, error classes are dynamically generated for service errors based on the error code
   # if they are not defined above.
@@ -58,6 +64,26 @@ module Aws::S3
       end
     end
 
+    class AnnotationLimitExceeded < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::S3::Types::AnnotationLimitExceeded] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+    end
+
+    class AnnotationNameTooLong < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::S3::Types::AnnotationNameTooLong] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+    end
+
     class BucketAlreadyExists < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context
@@ -98,6 +124,16 @@ module Aws::S3
       end
     end
 
+    class InvalidAnnotationName < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::S3::Types::InvalidAnnotationName] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+    end
+
     class InvalidObjectState < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context
@@ -118,6 +154,16 @@ module Aws::S3
       end
     end
 
+    class InvalidPrefix < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::S3::Types::InvalidPrefix] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+    end
+
     class InvalidRequest < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context
@@ -138,6 +184,16 @@ module Aws::S3
       end
     end
 
+    class NoSuchAnnotation < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::S3::Types::NoSuchAnnotation] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+    end
+
     class NoSuchBucket < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context
@@ -198,6 +254,16 @@ module Aws::S3
       end
     end
 
+    class UnsupportedMediaType < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::S3::Types::UnsupportedMediaType] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+    end
+
   end
 end
 

data/lib/aws-sdk-s3/file_downloader.rb

@@ -196,7 +196,9 @@ module Aws
       end
 
       def single_request(opts)
-        params = get_opts(opts[:params]).merge(response_target: opts[:destination])
+        resolve_temp_path(opts)
+        target = opts[:temp_path] || opts[:destination]
+        params = get_opts(opts[:params]).merge(response_target: target)
         params[:on_chunk_received] = single_part_progress(opts) if opts[:progress_callback]
         resp = @client.get_object(params)
         return resp unless opts[:on_checksum_validated]

data/lib/aws-sdk-s3/multipart_file_uploader.rb

@@ -154,7 +154,6 @@ module Aws
             Thread.current[:net_http_override_body_stream_chunk] = @http_chunk_size if @http_chunk_size
             update_progress(progress, p)
             resp = @client.upload_part(p)
-            p[:body].close
             completed_part = { etag: resp.etag, part_number: p[:part_number] }
             apply_part_checksum(resp, completed_part)
             completed.push(completed_part)
@@ -162,6 +161,7 @@ module Aws
             abort_upload = true
             errors << e
           ensure
+            p[:body].close
             Thread.current[:net_http_override_body_stream_chunk] = nil if @http_chunk_size
             completion_queue << :done
           end