aws-sdk-s3 1.235.0 → 1.237.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 222ecc56a1d529e21a3539d72a6065fa8b03a30f2a76cefe2b656464c003b094
-  data.tar.gz: bdb9c728982988008448f8fac5b571277b16896fc36521c678a8ddd48fe89053
+  metadata.gz: 6cdd31f47b92588f46be828683224bb7380c4ecebf34c6bbc9e0051f9d2e0729
+  data.tar.gz: e8837c0351c4de8de01aa383285c96ac6421dede30b83010c0c6301df30ce559
 SHA512:
-  metadata.gz: 7cfb285fdbcbb3fc493209736b5432a034b45fa4b0ce2f0ba14a16f18815e7519a04ade3c04072eb7218781974f323acf0ea5ee4e4a0df298f4e3c61a514240b
-  data.tar.gz: f385fab3dd0f2eb170755d3d8696db98d054dfbd346d56c3a940ee0fd366a802cbbd30a78dca6e9b9b179d13937831d8eb5fb645124a57738c067fbcbc3dcd76
+  metadata.gz: 401fa005d45d910023dfeea7114e95fb990bfbd4c11a5bcc47c0b38703b6f6033c4e3d202fa2955f1a24fd81903f468c58aef9ac62927638ba21e99e4ccad62a
+  data.tar.gz: 0e5b729646a07de3aa80b923fd3a6e7af20c6634fbeda6387351844e9f479a5aa550d627f357c7a7ee27a454ff9f00a245a7be45d490d7764b767a5904bc6b63

data/CHANGELOG.md

@@ -1,6 +1,22 @@
 Unreleased Changes
 ------------------
 
+1.237.0 (2026-10-29)
+------------------
+
+* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
+
+* Feature - Add `tagging` to `Aws::S3::PresignedPost`, accepting the same tagging structure as `put_object_tagging` and serializing it to XML in the signed POST form.
+
+* Feature - Reduce object allocation overhead when generating S3 presigned URLs.
+
+1.236.0 (2026-10-28)
+------------------
+
+* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
+
+* Issue - Create and cache S3 Express sessions using the credentials of the requesting client.
+
 1.235.0 (2026-10-20)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.235.0
+1.237.0

data/lib/aws-sdk-s3/client.rb

@@ -24216,7 +24216,7 @@ module Aws::S3
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-s3'
-      context[:gem_version] = '1.235.0'
+      context[:gem_version] = '1.237.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-s3/express_credentials.rb

@@ -14,6 +14,7 @@ module Aws
 
       def initialize(options = {})
         @client = options[:client]
+        @base_credentials = options[:base_credentials]
         @create_session_params = {}
         options.each_pair do |key, value|
           if self.class.create_session_options.include?(key)
@@ -30,7 +31,9 @@ module Aws
       private
 
       def refresh
-        c = @client.create_session(@create_session_params).credentials
+        request = @client.build_request(:create_session, @create_session_params)
+        request.context[:sigv4_credentials] = @base_credentials if @base_credentials
+        c = request.send_request.credentials
         @credentials = Credentials.new(
           c.access_key_id,
           c.secret_access_key,

data/lib/aws-sdk-s3/express_credentials_provider.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'securerandom'
+
 module Aws
   module S3
     # @api private
@@ -10,9 +12,12 @@ module Aws
     # Returns Credentials class for S3 Express. Accepts CreateSession
     # params as options. See {Client#create_session} for details.
     class ExpressCredentialsProvider
+      CACHE_KEY_SECRET = SecureRandom.random_bytes(64)
+      private_constant :CACHE_KEY_SECRET
+
       # @param [Hash] options
       # @option options [Client] :client The S3 client used to create the
-      #  session.
+      #  session when one is not given to {#express_credentials_for}.
       # @option options [String] :session_mode (see: {Client#create_session})
       # @option options [Boolean] :caching (true) When true, credentials will
       #  be cached.
@@ -27,11 +32,12 @@ module Aws
         @cache = Aws::S3.express_credentials_cache
       end
 
-      def express_credentials_for(bucket)
+      def express_credentials_for(bucket, client = @client)
+        credentials = client.config.credentials&.credentials
         if @caching
-          cached_credentials_for(bucket)
+          cached_credentials_for(bucket, client, credentials)
         else
-          new_credentials_for(bucket)
+          new_credentials_for(bucket, client, credentials)
         end
       end
 
@@ -39,18 +45,23 @@ module Aws
 
       private
 
-      def cached_credentials_for(bucket)
-        if @cache.key?(bucket)
-          @cache[bucket]
-        else
-          @cache[bucket] = new_credentials_for(bucket)
-        end
+      def cached_credentials_for(bucket, client, credentials)
+        @cache[cache_key(bucket, credentials)] ||= new_credentials_for(bucket, client, credentials)
+      end
+
+      def cache_key(bucket, credentials)
+        identity = "#{credentials&.access_key_id}#{credentials&.secret_access_key}"
+        "#{OpenSSL::HMAC.hexdigest('SHA256', CACHE_KEY_SECRET, identity)}#{bucket}"
       end
 
-      def new_credentials_for(bucket)
+      def new_credentials_for(bucket, client, credentials)
+        # Sign with this snapshot, but report the provider's UserAgent metrics.
+        credentials = credentials&.dup
+        credentials&.metrics = client.config.credentials.metrics
         ExpressCredentials.new(
           bucket: bucket,
-          client: @client,
+          client: client,
+          base_credentials: credentials,
           **@options
         )
       end

data/lib/aws-sdk-s3/plugins/express_session_auth.rb

@@ -35,8 +35,7 @@ for different buckets.
             if context[:auth_scheme]['name'] == 'sigv4-s3express' &&
                !context.config.disable_s3_express_session_auth
               bucket = context.params[:bucket]
-              credentials_provider = context.config.express_credentials_provider
-              credentials = credentials_provider.express_credentials_for(bucket)
+              credentials = express_credentials_for(context, bucket)
               context[:sigv4_credentials] = credentials # Sign will use this
             end
 
@@ -45,6 +44,15 @@ for different buckets.
 
           private
 
+          def express_credentials_for(context, bucket)
+            provider = context.config.express_credentials_provider
+            if provider.is_a?(ExpressCredentialsProvider)
+              provider.express_credentials_for(bucket, context.client)
+            else
+              provider.express_credentials_for(bucket)
+            end
+          end
+
           def with_metric(credentials, &block)
             return block.call unless credentials
 

data/lib/aws-sdk-s3/presigned_post.rb

@@ -155,7 +155,7 @@ module Aws
     #
     # The string `${filename}` is automatically replaced with the name of the
     # file provided by the user and is recognized by all form fields. It is
-    # not supported with `starts_with` conditions.
+    # not supported with `starts_with` conditions or {#tagging}.
     #
     # If the browser or client provides a full or partial path to the file,
     # only the text following the last slash (/) or backslash (\) will be used
@@ -175,6 +175,28 @@ module Aws
     # })
     # ```
     #
+    # ### Object Tags
+    #
+    # Use `:tagging` or {#tagging} to add tags to the uploaded object. Pass
+    # the same structure as the `:tagging` parameter of
+    # {Client#put_object_tagging}. The SDK serializes it to XML and adds
+    # an exact-match condition to the POST policy.
+    #
+    # ```ruby
+    # post = bucket.presigned_post(
+    #   key: 'object-key',
+    #   tagging: { tag_set: [{ key: 'project', value: 'example' }] }
+    # )
+    #
+    # # Or set tags on an existing presigned post:
+    # post = bucket.presigned_post(key: 'object-key')
+    # post.tagging(tag_set: [{ key: 'project', value: 'example' }])
+    # ```
+    #
+    # Include `post.fields['tagging']` unchanged in the submitted form.
+    # When rendering it as an HTML input value, HTML-escape it just like
+    # the other form fields.
+    #
     class PresignedPost
       @@allowed_fields = []
 
@@ -240,6 +262,8 @@ module Aws
       #   See {PresignedPost#server_side_encryption_customer_key}.
       # @option options [String] :server_side_encryption_customer_key_starts_with
       #   See {PresignedPost#server_side_encryption_customer_key_starts_with}.
+      # @option options [Hash, Types::Tagging] :tagging
+      #   See {PresignedPost#tagging}.
       def initialize(credentials, bucket_region, bucket_name, options = {})
         @credentials = credentials.credentials
         @bucket_region = bucket_region
@@ -605,6 +629,31 @@ module Aws
 
       # @!endgroup
 
+      # @!group Object Tagging
+
+      # @!method tagging(value)
+      #   Tags to store with the uploaded object. Accepts the same structure
+      #   as the `:tagging` parameter of {Client#put_object_tagging}, containing
+      #   a required `:tag_set` array of tags with `:key` and `:value` strings.
+      #   Serializes the tags to XML and requires an exact match in the POST
+      #   policy. The `${filename}` variable is not supported in tags.
+      #
+      #   @example
+      #     post.tagging(tag_set: [{ key: 'project', value: 'example' }])
+      #
+      #   @param [Hash, Types::Tagging] value
+      #   @raise [ArgumentError] If the tagging parameters are invalid.
+      #   @see Client#put_object_tagging
+      #   @return [self]
+      define_field(:tagging) do |value|
+        rules = Client.api.operation(:put_object_tagging).input.shape.member(:tagging)
+        value = Aws::ParamConverter.convert(rules, value)
+        Aws::ParamValidator.validate!(rules, value)
+        with('tagging', Aws::Xml::Builder.new(rules).serialize(value))
+      end
+
+      # @!endgroup
+
       private
 
       def with(field_name, value)

data/lib/aws-sdk-s3/presigner.rb

@@ -251,7 +251,7 @@ module Aws
             time: time
           ).to_s
 
-          Seahorse::Client::Response.new(context: context, data: url)
+          Aws::Response.new(context: context, data: url)
         end
         # Return the headers
         x_amz_headers

data/lib/aws-sdk-s3.rb

@@ -75,7 +75,7 @@ module Aws::S3
   autoload :ObjectVersion, 'aws-sdk-s3/object_version'
   autoload :EventStreams, 'aws-sdk-s3/event_streams'
 
-  GEM_VERSION = '1.235.0'
+  GEM_VERSION = '1.237.0'
 
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-s3
 version: !ruby/object:Gem::Version
-  version: 1.235.0
+  version: 1.237.0
 platform: ruby
 authors:
 - Amazon Web Services
@@ -46,7 +46,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.258.0
+        version: 3.263.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -56,7 +56,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.258.0
+        version: 3.263.0
 description: Official AWS Ruby gem for Amazon Simple Storage Service (Amazon S3).
   This gem is part of the AWS SDK for Ruby.
 email: