aws-sdk-s3 1.99.0 → 1.103.0

data/lib/aws-sdk-s3/client_api.rb

@@ -22,6 +22,7 @@ module Aws::S3
     AcceptRanges = Shapes::StringShape.new(name: 'AcceptRanges')
     AccessControlPolicy = Shapes::StructureShape.new(name: 'AccessControlPolicy')
     AccessControlTranslation = Shapes::StructureShape.new(name: 'AccessControlTranslation')
+    AccessPointArn = Shapes::StringShape.new(name: 'AccessPointArn')
     AccountId = Shapes::StringShape.new(name: 'AccountId')
     AllowQuotedRecordDelimiter = Shapes::BooleanShape.new(name: 'AllowQuotedRecordDelimiter')
     AllowedHeader = Shapes::StringShape.new(name: 'AllowedHeader')
@@ -1686,6 +1687,7 @@ module Aws::S3
 
     MetricsAndOperator.add_member(:prefix, Shapes::ShapeRef.new(shape: Prefix, location_name: "Prefix"))
     MetricsAndOperator.add_member(:tags, Shapes::ShapeRef.new(shape: TagSet, location_name: "Tag", metadata: {"flattened"=>true}))
+    MetricsAndOperator.add_member(:access_point_arn, Shapes::ShapeRef.new(shape: AccessPointArn, location_name: "AccessPointArn"))
     MetricsAndOperator.struct_class = Types::MetricsAndOperator
 
     MetricsConfiguration.add_member(:id, Shapes::ShapeRef.new(shape: MetricsId, required: true, location_name: "Id"))
@@ -1696,6 +1698,7 @@ module Aws::S3
 
     MetricsFilter.add_member(:prefix, Shapes::ShapeRef.new(shape: Prefix, location_name: "Prefix"))
     MetricsFilter.add_member(:tag, Shapes::ShapeRef.new(shape: Tag, location_name: "Tag"))
+    MetricsFilter.add_member(:access_point_arn, Shapes::ShapeRef.new(shape: AccessPointArn, location_name: "AccessPointArn"))
     MetricsFilter.add_member(:and, Shapes::ShapeRef.new(shape: MetricsAndOperator, location_name: "And"))
     MetricsFilter.struct_class = Types::MetricsFilter
 

data/lib/aws-sdk-s3/encryption/client.rb

@@ -120,7 +120,7 @@ module Aws
     #       attr_reader :encryption_materials
     #
     #       def key_for(matdesc)
-    #         key_name = JSON.load(matdesc)['key']
+    #         key_name = JSON.parse(matdesc)['key']
     #         if key = @keys[key_name]
     #           key
     #         else

data/lib/aws-sdk-s3/encryption/decrypt_handler.rb

@@ -165,10 +165,6 @@ module Aws
         # to initialize the cipher, and the decrypter truncates the
         # auth tag from the body when writing the final bytes.
         def authenticated_decrypter(context, cipher, envelope)
-          if RUBY_VERSION.match(/^1.9/)
-            msg = 'authenticated decryption not supported by OpenSSL in Ruby version ~> 1.9'
-            raise Aws::Errors::NonSupportedRubyVersionError, msg
-          end
           http_resp = context.http_response
           content_length = http_resp.headers['content-length'].to_i
           auth_tag_length = auth_tag_length(envelope)

data/lib/aws-sdk-s3/encryptionV2/client.rb

@@ -157,7 +157,7 @@ module Aws
     #       attr_reader :encryption_materials
     #
     #       def key_for(matdesc)
-    #         key_name = JSON.load(matdesc)['key']
+    #         key_name = JSON.parse(matdesc)['key']
     #         if key = @keys[key_name]
     #           key
     #         else

data/lib/aws-sdk-s3/encryptionV2/decrypt_handler.rb

@@ -166,10 +166,6 @@ module Aws
         # to initialize the cipher, and the decrypter truncates the
         # auth tag from the body when writing the final bytes.
         def authenticated_decrypter(context, cipher, envelope)
-          if RUBY_VERSION.match(/^1.9/)
-            msg = 'authenticated decryption not supported by OpenSSL in Ruby version ~> 1.9'
-            raise Aws::Errors::NonSupportedRubyVersionError, msg
-          end
           http_resp = context.http_response
           content_length = http_resp.headers['content-length'].to_i
           auth_tag_length = auth_tag_length(envelope)

data/lib/aws-sdk-s3/encryptionV2/encrypt_handler.rb

@@ -9,10 +9,6 @@ module Aws
       class EncryptHandler < Seahorse::Client::Handler
 
         def call(context)
-          if RUBY_VERSION.match(/^1.9/)
-            raise "authenticated encryption not supported by OpenSSL in Ruby version ~> 1.9"
-            raise Aws::Errors::NonSupportedRubyVersionError, msg
-          end
           envelope, cipher = context[:encryption][:cipher_provider]
            .encryption_cipher(
              kms_encryption_context: context[:encryption][:kms_encryption_context]

data/lib/aws-sdk-s3/object.rb

@@ -184,10 +184,10 @@ module Aws::S3
     end
 
     # If the object is stored using server-side encryption either with an
-    # Amazon Web Services KMS customer master key (CMK) or an Amazon
-    # S3-managed encryption key, the response includes this header with the
-    # value of the server-side encryption algorithm used when storing this
-    # object in Amazon S3 (for example, AES256, aws:kms).
+    # Amazon Web Services KMS key or an Amazon S3-managed encryption key,
+    # the response includes this header with the value of the server-side
+    # encryption algorithm used when storing this object in Amazon S3 (for
+    # example, AES256, aws:kms).
     # @return [String]
     def server_side_encryption
       data[:server_side_encryption]
@@ -217,8 +217,8 @@ module Aws::S3
     end
 
     # If present, specifies the ID of the Amazon Web Services Key Management
-    # Service (Amazon Web Services KMS) symmetric customer managed customer
-    # master key (CMK) that was used for the object.
+    # Service (Amazon Web Services KMS) symmetric customer managed key that
+    # was used for the object.
     # @return [String]
     def ssekms_key_id
       data[:ssekms_key_id]
@@ -805,7 +805,8 @@ module Aws::S3
     #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
     # @option options [Boolean] :bypass_governance_retention
     #   Indicates whether S3 Object Lock should bypass Governance-mode
-    #   restrictions to process this operation.
+    #   restrictions to process this operation. To use this header, you must
+    #   have the `s3:PutBucketPublicAccessBlock` permission.
     # @option options [String] :expected_bucket_owner
     #   The account ID of the expected bucket owner. If the bucket is owned by
     #   a different account, the request will fail with an HTTP `403 (Access
@@ -1027,13 +1028,13 @@ module Aws::S3
     #   RFC 1321. Amazon S3 uses this header for a message integrity check to
     #   ensure that the encryption key was transmitted without error.
     # @option options [String] :ssekms_key_id
-    #   Specifies the ID of the symmetric customer managed Amazon Web Services
-    #   KMS CMK to use for object encryption. All GET and PUT requests for an
-    #   object protected by Amazon Web Services KMS will fail if not made via
-    #   SSL or using SigV4. For information about configuring using any of the
-    #   officially supported Amazon Web Services SDKs and Amazon Web Services
-    #   CLI, see [Specifying the Signature Version in Request
-    #   Authentication][1] in the *Amazon S3 User Guide*.
+    #   Specifies the ID of the symmetric customer managed key to use for
+    #   object encryption. All GET and PUT requests for an object protected by
+    #   Amazon Web Services KMS will fail if not made via SSL or using SigV4.
+    #   For information about configuring using any of the officially
+    #   supported Amazon Web Services SDKs and Amazon Web Services CLI, see
+    #   [Specifying the Signature Version in Request Authentication][1] in the
+    #   *Amazon S3 User Guide*.
     #
     #
     #
@@ -1276,12 +1277,12 @@ module Aws::S3
     #   If `x-amz-server-side-encryption` is present and has the value of
     #   `aws:kms`, this header specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetrical customer
-    #   managed customer master key (CMK) that was used for the object. If you
-    #   specify `x-amz-server-side-encryption:aws:kms`, but do not provide`
+    #   managed key that was used for the object. If you specify
+    #   `x-amz-server-side-encryption:aws:kms`, but do not provide`
     #   x-amz-server-side-encryption-aws-kms-key-id`, Amazon S3 uses the
-    #   Amazon Web Services managed CMK in Amazon Web Services to protect the
-    #   data. If the KMS key does not exist in the same account issuing the
-    #   command, you must use the full ARN and not just the ID.
+    #   Amazon Web Services managed key to protect the data. If the KMS key
+    #   does not exist in the same account issuing the command, you must use
+    #   the full ARN and not just the ID.
     # @option options [String] :ssekms_encryption_context
     #   Specifies the Amazon Web Services KMS Encryption Context to use for
     #   object encryption. The value of this header is a base64-encoded UTF-8
@@ -1668,8 +1669,8 @@ module Aws::S3
       #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
       # @option options [Boolean] :bypass_governance_retention
       #   Specifies whether you want to delete this object even if it has a
-      #   Governance-type Object Lock in place. You must have sufficient
-      #   permissions to perform this operation.
+      #   Governance-type Object Lock in place. To use this header, you must
+      #   have the `s3:PutBucketPublicAccessBlock` permission.
       # @option options [String] :expected_bucket_owner
       #   The account ID of the expected bucket owner. If the bucket is owned by
       #   a different account, the request will fail with an HTTP `403 (Access

data/lib/aws-sdk-s3/object_summary.rb

@@ -549,7 +549,8 @@ module Aws::S3
     #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
     # @option options [Boolean] :bypass_governance_retention
     #   Indicates whether S3 Object Lock should bypass Governance-mode
-    #   restrictions to process this operation.
+    #   restrictions to process this operation. To use this header, you must
+    #   have the `s3:PutBucketPublicAccessBlock` permission.
     # @option options [String] :expected_bucket_owner
     #   The account ID of the expected bucket owner. If the bucket is owned by
     #   a different account, the request will fail with an HTTP `403 (Access
@@ -771,13 +772,13 @@ module Aws::S3
     #   RFC 1321. Amazon S3 uses this header for a message integrity check to
     #   ensure that the encryption key was transmitted without error.
     # @option options [String] :ssekms_key_id
-    #   Specifies the ID of the symmetric customer managed Amazon Web Services
-    #   KMS CMK to use for object encryption. All GET and PUT requests for an
-    #   object protected by Amazon Web Services KMS will fail if not made via
-    #   SSL or using SigV4. For information about configuring using any of the
-    #   officially supported Amazon Web Services SDKs and Amazon Web Services
-    #   CLI, see [Specifying the Signature Version in Request
-    #   Authentication][1] in the *Amazon S3 User Guide*.
+    #   Specifies the ID of the symmetric customer managed key to use for
+    #   object encryption. All GET and PUT requests for an object protected by
+    #   Amazon Web Services KMS will fail if not made via SSL or using SigV4.
+    #   For information about configuring using any of the officially
+    #   supported Amazon Web Services SDKs and Amazon Web Services CLI, see
+    #   [Specifying the Signature Version in Request Authentication][1] in the
+    #   *Amazon S3 User Guide*.
     #
     #
     #
@@ -1020,12 +1021,12 @@ module Aws::S3
     #   If `x-amz-server-side-encryption` is present and has the value of
     #   `aws:kms`, this header specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetrical customer
-    #   managed customer master key (CMK) that was used for the object. If you
-    #   specify `x-amz-server-side-encryption:aws:kms`, but do not provide`
+    #   managed key that was used for the object. If you specify
+    #   `x-amz-server-side-encryption:aws:kms`, but do not provide`
     #   x-amz-server-side-encryption-aws-kms-key-id`, Amazon S3 uses the
-    #   Amazon Web Services managed CMK in Amazon Web Services to protect the
-    #   data. If the KMS key does not exist in the same account issuing the
-    #   command, you must use the full ARN and not just the ID.
+    #   Amazon Web Services managed key to protect the data. If the KMS key
+    #   does not exist in the same account issuing the command, you must use
+    #   the full ARN and not just the ID.
     # @option options [String] :ssekms_encryption_context
     #   Specifies the Amazon Web Services KMS Encryption Context to use for
     #   object encryption. The value of this header is a base64-encoded UTF-8
@@ -1335,8 +1336,8 @@ module Aws::S3
       #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
       # @option options [Boolean] :bypass_governance_retention
       #   Specifies whether you want to delete this object even if it has a
-      #   Governance-type Object Lock in place. You must have sufficient
-      #   permissions to perform this operation.
+      #   Governance-type Object Lock in place. To use this header, you must
+      #   have the `s3:PutBucketPublicAccessBlock` permission.
       # @option options [String] :expected_bucket_owner
       #   The account ID of the expected bucket owner. If the bucket is owned by
       #   a different account, the request will fail with an HTTP `403 (Access

data/lib/aws-sdk-s3/object_version.rb

@@ -254,7 +254,8 @@ module Aws::S3
     #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
     # @option options [Boolean] :bypass_governance_retention
     #   Indicates whether S3 Object Lock should bypass Governance-mode
-    #   restrictions to process this operation.
+    #   restrictions to process this operation. To use this header, you must
+    #   have the `s3:PutBucketPublicAccessBlock` permission.
     # @option options [String] :expected_bucket_owner
     #   The account ID of the expected bucket owner. If the bucket is owned by
     #   a different account, the request will fail with an HTTP `403 (Access
@@ -543,8 +544,8 @@ module Aws::S3
       #   [1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
       # @option options [Boolean] :bypass_governance_retention
       #   Specifies whether you want to delete this object even if it has a
-      #   Governance-type Object Lock in place. You must have sufficient
-      #   permissions to perform this operation.
+      #   Governance-type Object Lock in place. To use this header, you must
+      #   have the `s3:PutBucketPublicAccessBlock` permission.
       # @option options [String] :expected_bucket_owner
       #   The account ID of the expected bucket owner. If the bucket is owned by
       #   a different account, the request will fail with an HTTP `403 (Access

data/lib/aws-sdk-s3/plugins/arn.rb

@@ -3,6 +3,7 @@
 require_relative '../arn/access_point_arn'
 require_relative '../arn/object_lambda_arn'
 require_relative '../arn/outpost_access_point_arn'
+require_relative '../arn/multi_region_access_point_arn'
 
 module Aws
   module S3
@@ -23,6 +24,18 @@ be made. Set to `false` to use the client's region instead.
           resolve_s3_use_arn_region(cfg)
         end
 
+        option(
+          :s3_disable_multiregion_access_points,
+          default: false,
+          doc_type: 'Boolean',
+          docstring: <<-DOCS) do |cfg|
+When set to `false` this will option will raise errors when multi-region
+access point ARNs are used.  Multi-region access points can potentially
+result in cross region requests.
+        DOCS
+          resolve_s3_disable_multiregion_access_points(cfg)
+        end
+
         # param validator is validate:50
         # endpoint is build:90 (populates the URI for the first time)
         # endpoint pattern is build:10
@@ -113,8 +126,14 @@ be made. Set to `false` to use the client's region instead.
 
             if !arn.support_dualstack? && context[:use_dualstack_endpoint]
               raise ArgumentError,
-                    'Cannot provide an Outpost Access Point ARN when '\
-                    '`:use_dualstack_endpoint` is set to true.'
+                    'Cannot provide an Outpost Access Point or Multi-region Access Point ARN'\
+                    ' when `:use_dualstack_endpoint` is set to true.'
+            end
+
+            if arn.region.empty? && context.config.s3_disable_multiregion_access_points
+              raise ArgumentError,
+                    'Cannot provide a Multi-region Access Point ARN with '\
+                    '`:s3_disable_multiregion_access_points` set to true'
             end
           end
         end
@@ -147,7 +166,9 @@ be made. Set to `false` to use the client's region instead.
           def resolve_arn_type!(arn)
             case arn.service
             when 's3'
-              Aws::S3::AccessPointARN.new(arn.to_h)
+              arn.region.empty? ?
+                Aws::S3::MultiRegionAccessPointARN.new(arn.to_h) :
+                Aws::S3::AccessPointARN.new(arn.to_h)
             when 's3-outposts'
               Aws::S3::OutpostAccessPointARN.new(arn.to_h)
             when 's3-object-lambda'
@@ -174,6 +195,21 @@ be made. Set to `false` to use the client's region instead.
             value
           end
 
+          def resolve_s3_disable_multiregion_access_points(cfg)
+            value = ENV['AWS_S3_DISABLE_MULTIREGION_ACCESS_POINTS'] ||
+              Aws.shared_config.s3_disable_multiregion_access_points(profile: cfg.profile) ||
+              'false'
+            value = Aws::Util.str_2_bool(value)
+            # Raise if provided value is not true or false
+            if value.nil?
+              raise ArgumentError,
+                    'Must provide either `true` or `false` for '\
+                    's3_use_arn_region profile option or for '\
+                    "ENV['AWS_S3_USE_ARN_REGION']"
+            end
+            value
+          end
+
           # Remove ARN from the path because we've already set the new host
           def url_path(path, arn)
             path = path.sub("/#{Seahorse::Util.uri_escape(arn.to_s)}", '')
@@ -208,16 +244,19 @@ be made. Set to `false` to use the client's region instead.
                 region = region.gsub('fips-', '').gsub('-fips', '')
               end
 
-              # Raise if the ARN and client regions are in different partitions
-              if use_arn_region &&
-                 !Aws::Partitions.partition(arn.partition).region?(region)
-                raise Aws::Errors::InvalidARNPartitionError
-              end
+              # use_arn_region does not apply to MRAP (global) arns
+              unless arn.region.empty?
+                # Raise if the ARN and client regions are in different partitions
+                if use_arn_region &&
+                   !Aws::Partitions.partition(arn.partition).region?(region)
+                  raise Aws::Errors::InvalidARNPartitionError
+                end
 
-              # Raise if regions mismatch
-              # Either when it's a fips client or not using the ARN region
-              if (!use_arn_region || fips) && region != arn.region
-                raise Aws::Errors::InvalidARNRegionError
+                # Raise if regions mismatch
+                # Either when it's a fips client or not using the ARN region
+                if (!use_arn_region || fips) && region != arn.region
+                  raise Aws::Errors::InvalidARNRegionError
+                end
               end
             end
           end

data/lib/aws-sdk-s3/plugins/s3_signer.rb

@@ -74,9 +74,17 @@ module Aws
                 credentials: context.config.credentials
               )
             elsif (arn = context.metadata[:s3_arn])
+              if arn[:arn].is_a?(MultiRegionAccessPointARN)
+                signing_region = '*'
+                signing_algorithm = :sigv4a
+              else
+                signing_region = arn[:resolved_region]
+                signing_algorithm = :sigv4
+              end
               S3Signer.build_v4_signer(
                 service: arn[:arn].service,
-                region: arn[:resolved_region],
+                signing_algorithm: signing_algorithm,
+                region: signing_region,
                 credentials: context.config.credentials
               )
             elsif context.operation.name == 'WriteGetObjectResponse'
@@ -216,6 +224,7 @@ module Aws
               service: options[:service],
               region: options[:region],
               credentials_provider: options[:credentials],
+              signing_algorithm: options.fetch(:signing_algorithm, :sigv4),
               uri_escape_path: false,
               unsigned_headers: ['content-length', 'x-amzn-trace-id']
             )

data/lib/aws-sdk-s3/presigner.rb

@@ -231,17 +231,23 @@ module Aws
           end
           http_req.endpoint.query = query.join('&') unless query.empty?
 
+          signing_algorithm = :sigv4
+
           # If it's an ARN, get the resolved region and service
           if (arn = context.metadata[:s3_arn])
             region = arn[:resolved_region]
             service = arn[:arn].service
+            region = arn[:arn].is_a?(MultiRegionAccessPointARN) ? '*': arn[:resolved_region]
+            signing_algorithm = arn[:arn].is_a?(MultiRegionAccessPointARN) ? :sigv4a : :sigv4
           end
 
           signer = Aws::Sigv4::Signer.new(
             service: service || 's3',
             region: region || context.config.region,
+            signing_algorithm: signing_algorithm,
             credentials_provider: context.config.credentials,
             unsigned_headers: unsigned_headers,
+            apply_checksum_header: false,
             uri_escape_path: false
           )
 

data/lib/aws-sdk-s3/types.rb

@@ -964,10 +964,10 @@ module Aws::S3
     #
     # @!attribute [rw] server_side_encryption
     #   If you specified server-side encryption either with an Amazon
-    #   S3-managed encryption key or an Amazon Web Services KMS customer
-    #   master key (CMK) in your initiate multipart upload request, the
-    #   response includes this header. It confirms the encryption algorithm
-    #   that Amazon S3 used to encrypt the object.
+    #   S3-managed encryption key or an Amazon Web Services KMS key in your
+    #   initiate multipart upload request, the response includes this
+    #   header. It confirms the encryption algorithm that Amazon S3 used to
+    #   encrypt the object.
     #   @return [String]
     #
     # @!attribute [rw] version_id
@@ -978,7 +978,7 @@ module Aws::S3
     # @!attribute [rw] ssekms_key_id
     #   If present, specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) that was used for the object.
+    #   managed key that was used for the object.
     #   @return [String]
     #
     # @!attribute [rw] bucket_key_enabled
@@ -1248,7 +1248,7 @@ module Aws::S3
     # @!attribute [rw] ssekms_key_id
     #   If present, specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) that was used for the object.
+    #   managed key that was used for the object.
     #   @return [String]
     #
     # @!attribute [rw] ssekms_encryption_context
@@ -1917,7 +1917,7 @@ module Aws::S3
     # @!attribute [rw] ssekms_key_id
     #   If present, specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) that was used for the object.
+    #   managed key that was used for the object.
     #   @return [String]
     #
     # @!attribute [rw] ssekms_encryption_context
@@ -2130,14 +2130,13 @@ module Aws::S3
     #   @return [String]
     #
     # @!attribute [rw] ssekms_key_id
-    #   Specifies the ID of the symmetric customer managed Amazon Web
-    #   Services KMS CMK to use for object encryption. All GET and PUT
-    #   requests for an object protected by Amazon Web Services KMS will
-    #   fail if not made via SSL or using SigV4. For information about
-    #   configuring using any of the officially supported Amazon Web
-    #   Services SDKs and Amazon Web Services CLI, see [Specifying the
-    #   Signature Version in Request Authentication][1] in the *Amazon S3
-    #   User Guide*.
+    #   Specifies the ID of the symmetric customer managed key to use for
+    #   object encryption. All GET and PUT requests for an object protected
+    #   by Amazon Web Services KMS will fail if not made via SSL or using
+    #   SigV4. For information about configuring using any of the officially
+    #   supported Amazon Web Services SDKs and Amazon Web Services CLI, see
+    #   [Specifying the Signature Version in Request Authentication][1] in
+    #   the *Amazon S3 User Guide*.
     #
     #
     #
@@ -2861,7 +2860,8 @@ module Aws::S3
     #
     # @!attribute [rw] bypass_governance_retention
     #   Indicates whether S3 Object Lock should bypass Governance-mode
-    #   restrictions to process this operation.
+    #   restrictions to process this operation. To use this header, you must
+    #   have the `s3:PutBucketPublicAccessBlock` permission.
     #   @return [Boolean]
     #
     # @!attribute [rw] expected_bucket_owner
@@ -3057,8 +3057,8 @@ module Aws::S3
     #
     # @!attribute [rw] bypass_governance_retention
     #   Specifies whether you want to delete this object even if it has a
-    #   Governance-type Object Lock in place. You must have sufficient
-    #   permissions to perform this operation.
+    #   Governance-type Object Lock in place. To use this header, you must
+    #   have the `s3:PutBucketPublicAccessBlock` permission.
     #   @return [Boolean]
     #
     # @!attribute [rw] expected_bucket_owner
@@ -3265,11 +3265,10 @@ module Aws::S3
     #
     # @!attribute [rw] kms_key_id
     #   If the encryption type is `aws:kms`, this optional value specifies
-    #   the ID of the symmetric customer managed Amazon Web Services KMS CMK
-    #   to use for encryption of job results. Amazon S3 only supports
-    #   symmetric CMKs. For more information, see [Using symmetric and
-    #   asymmetric keys][1] in the *Amazon Web Services Key Management
-    #   Service Developer Guide*.
+    #   the ID of the symmetric customer managed key to use for encryption
+    #   of job results. Amazon S3 only supports symmetric keys. For more
+    #   information, see [Using symmetric and asymmetric keys][1] in the
+    #   *Amazon Web Services Key Management Service Developer Guide*.
     #
     #
     #
@@ -5482,7 +5481,7 @@ module Aws::S3
     # @!attribute [rw] ssekms_key_id
     #   If present, specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) that was used for the object.
+    #   managed key that was used for the object.
     #   @return [String]
     #
     # @!attribute [rw] bucket_key_enabled
@@ -5606,6 +5605,9 @@ module Aws::S3
     #   bucket name. For more information about access point ARNs, see
     #   [Using access points][1] in the *Amazon S3 User Guide*.
     #
+    #   When using an Object Lambda access point the hostname takes the form
+    #   *AccessPointName*-*AccountId*.s3-object-lambda.*Region*.amazonaws.com.
+    #
     #   When using this action with Amazon S3 on Outposts, you must direct
     #   requests to the S3 on Outposts hostname. The S3 on Outposts hostname
     #   takes the form
@@ -6329,10 +6331,10 @@ module Aws::S3
     #
     # @!attribute [rw] server_side_encryption
     #   If the object is stored using server-side encryption either with an
-    #   Amazon Web Services KMS customer master key (CMK) or an Amazon
-    #   S3-managed encryption key, the response includes this header with
-    #   the value of the server-side encryption algorithm used when storing
-    #   this object in Amazon S3 (for example, AES256, aws:kms).
+    #   Amazon Web Services KMS key or an Amazon S3-managed encryption key,
+    #   the response includes this header with the value of the server-side
+    #   encryption algorithm used when storing this object in Amazon S3 (for
+    #   example, AES256, aws:kms).
     #   @return [String]
     #
     # @!attribute [rw] metadata
@@ -6355,7 +6357,7 @@ module Aws::S3
     # @!attribute [rw] ssekms_key_id
     #   If present, specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) that was used for the object.
+    #   managed key that was used for the object.
     #   @return [String]
     #
     # @!attribute [rw] bucket_key_enabled
@@ -9047,6 +9049,7 @@ module Aws::S3
     #             value: "Value", # required
     #           },
     #         ],
+    #         access_point_arn: "AccessPointArn",
     #       }
     #
     # @!attribute [rw] prefix
@@ -9057,11 +9060,16 @@ module Aws::S3
     #   The list of tags used when evaluating an AND predicate.
     #   @return [Array<Types::Tag>]
     #
+    # @!attribute [rw] access_point_arn
+    #   The access point ARN used when evaluating an AND predicate.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/MetricsAndOperator AWS API Documentation
     #
     class MetricsAndOperator < Struct.new(
       :prefix,
-      :tags)
+      :tags,
+      :access_point_arn)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -9071,8 +9079,7 @@ module Aws::S3
     # If you're updating an existing metrics configuration, note that this
     # is a full replacement of the existing metrics configuration. If you
     # don't include the elements you want to keep, they are erased. For
-    # more information, see [ PUT Bucket metrics][1] in the *Amazon S3 API
-    # Reference*.
+    # more information, see [PutBucketMetricsConfiguration][1].
     #
     #
     #
@@ -9089,6 +9096,7 @@ module Aws::S3
     #             key: "ObjectKey", # required
     #             value: "Value", # required
     #           },
+    #           access_point_arn: "AccessPointArn",
     #           and: {
     #             prefix: "Prefix",
     #             tags: [
@@ -9097,6 +9105,7 @@ module Aws::S3
     #                 value: "Value", # required
     #               },
     #             ],
+    #             access_point_arn: "AccessPointArn",
     #           },
     #         },
     #       }
@@ -9108,7 +9117,8 @@ module Aws::S3
     # @!attribute [rw] filter
     #   Specifies a metrics configuration filter. The metrics configuration
     #   will only include objects that meet the filter's criteria. A filter
-    #   must be a prefix, a tag, or a conjunction (MetricsAndOperator).
+    #   must be a prefix, an object tag, an access point ARN, or a
+    #   conjunction (MetricsAndOperator).
     #   @return [Types::MetricsFilter]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/MetricsConfiguration AWS API Documentation
@@ -9122,7 +9132,13 @@ module Aws::S3
 
     # Specifies a metrics configuration filter. The metrics configuration
     # only includes objects that meet the filter's criteria. A filter must
-    # be a prefix, a tag, or a conjunction (MetricsAndOperator).
+    # be a prefix, an object tag, an access point ARN, or a conjunction
+    # (MetricsAndOperator). For more information, see
+    # [PutBucketMetricsConfiguration][1].
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketMetricsConfiguration.html
     #
     # @note When making an API call, you may pass MetricsFilter
     #   data as a hash:
@@ -9133,6 +9149,7 @@ module Aws::S3
     #           key: "ObjectKey", # required
     #           value: "Value", # required
     #         },
+    #         access_point_arn: "AccessPointArn",
     #         and: {
     #           prefix: "Prefix",
     #           tags: [
@@ -9141,6 +9158,7 @@ module Aws::S3
     #               value: "Value", # required
     #             },
     #           ],
+    #           access_point_arn: "AccessPointArn",
     #         },
     #       }
     #
@@ -9152,6 +9170,10 @@ module Aws::S3
     #   The tag used when evaluating a metrics filter.
     #   @return [Types::Tag]
     #
+    # @!attribute [rw] access_point_arn
+    #   The access point ARN used when evaluating a metrics filter.
+    #   @return [String]
+    #
     # @!attribute [rw] and
     #   A conjunction (logical AND) of predicates, which is used in
     #   evaluating a metrics filter. The operator must have at least two
@@ -9164,6 +9186,7 @@ module Aws::S3
     class MetricsFilter < Struct.new(
       :prefix,
       :tag,
+      :access_point_arn,
       :and)
       SENSITIVE = []
       include Aws::Structure
@@ -10392,10 +10415,10 @@ module Aws::S3
     #
     # @!attribute [rw] bucket
     #   Specifies default encryption for a bucket using server-side
-    #   encryption with Amazon S3-managed keys (SSE-S3) or customer master
-    #   keys stored in Amazon Web Services KMS (SSE-KMS). For information
-    #   about the Amazon S3 default encryption feature, see [Amazon S3
-    #   Default Bucket Encryption][1] in the *Amazon S3 User Guide*.
+    #   encryption with Amazon S3-managed keys (SSE-S3) or customer managed
+    #   keys (SSE-KMS). For information about the Amazon S3 default
+    #   encryption feature, see [Amazon S3 Default Bucket Encryption][1] in
+    #   the *Amazon S3 User Guide*.
     #
     #
     #
@@ -10777,6 +10800,7 @@ module Aws::S3
     #               key: "ObjectKey", # required
     #               value: "Value", # required
     #             },
+    #             access_point_arn: "AccessPointArn",
     #             and: {
     #               prefix: "Prefix",
     #               tags: [
@@ -10785,6 +10809,7 @@ module Aws::S3
     #                   value: "Value", # required
     #                 },
     #               ],
+    #               access_point_arn: "AccessPointArn",
     #             },
     #           },
     #         },
@@ -11838,10 +11863,9 @@ module Aws::S3
     #
     # @!attribute [rw] server_side_encryption
     #   If you specified server-side encryption either with an Amazon Web
-    #   Services KMS customer master key (CMK) or Amazon S3-managed
-    #   encryption key in your PUT request, the response includes this
-    #   header. It confirms the encryption algorithm that Amazon S3 used to
-    #   encrypt the object.
+    #   Services KMS key or Amazon S3-managed encryption key in your PUT
+    #   request, the response includes this header. It confirms the
+    #   encryption algorithm that Amazon S3 used to encrypt the object.
     #   @return [String]
     #
     # @!attribute [rw] version_id
@@ -11865,7 +11889,7 @@ module Aws::S3
     #   If `x-amz-server-side-encryption` is present and has the value of
     #   `aws:kms`, this header specifies the ID of the Amazon Web Services
     #   Key Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) that was used for the object.
+    #   managed key that was used for the object.
     #   @return [String]
     #
     # @!attribute [rw] ssekms_encryption_context
@@ -12167,13 +12191,12 @@ module Aws::S3
     #   If `x-amz-server-side-encryption` is present and has the value of
     #   `aws:kms`, this header specifies the ID of the Amazon Web Services
     #   Key Management Service (Amazon Web Services KMS) symmetrical
-    #   customer managed customer master key (CMK) that was used for the
-    #   object. If you specify `x-amz-server-side-encryption:aws:kms`, but
-    #   do not provide` x-amz-server-side-encryption-aws-kms-key-id`, Amazon
-    #   S3 uses the Amazon Web Services managed CMK in Amazon Web Services
-    #   to protect the data. If the KMS key does not exist in the same
-    #   account issuing the command, you must use the full ARN and not just
-    #   the ID.
+    #   customer managed key that was used for the object. If you specify
+    #   `x-amz-server-side-encryption:aws:kms`, but do not provide`
+    #   x-amz-server-side-encryption-aws-kms-key-id`, Amazon S3 uses the
+    #   Amazon Web Services managed key to protect the data. If the KMS key
+    #   does not exist in the same account issuing the command, you must use
+    #   the full ARN and not just the ID.
     #   @return [String]
     #
     # @!attribute [rw] ssekms_encryption_context
@@ -13021,8 +13044,8 @@ module Aws::S3
     #   source objects that you want to replicate. You can choose to enable
     #   or disable the replication of these objects. Currently, Amazon S3
     #   supports only the filter that you can specify for objects created
-    #   with server-side encryption using a customer master key (CMK) stored
-    #   in Amazon Web Services Key Management Service (SSE-KMS).
+    #   with server-side encryption using a customer managed key stored in
+    #   Amazon Web Services Key Management Service (SSE-KMS).
     #   @return [Types::SourceSelectionCriteria]
     #
     # @!attribute [rw] existing_object_replication
@@ -13901,8 +13924,8 @@ module Aws::S3
     #
     # @!attribute [rw] key_id
     #   Specifies the ID of the Amazon Web Services Key Management Service
-    #   (Amazon Web Services KMS) symmetric customer managed customer master
-    #   key (CMK) to use for encrypting inventory reports.
+    #   (Amazon Web Services KMS) symmetric customer managed key to use for
+    #   encrypting inventory reports.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/SSEKMS AWS API Documentation
@@ -14343,8 +14366,8 @@ module Aws::S3
     # source objects that you want to replicate. You can choose to enable or
     # disable the replication of these objects. Currently, Amazon S3
     # supports only the filter that you can specify for objects created with
-    # server-side encryption using a customer master key (CMK) stored in
-    # Amazon Web Services Key Management Service (SSE-KMS).
+    # server-side encryption using a customer managed key stored in Amazon
+    # Web Services Key Management Service (SSE-KMS).
     #
     # @note When making an API call, you may pass SourceSelectionCriteria
     #   data as a hash:
@@ -14836,7 +14859,7 @@ module Aws::S3
     # @!attribute [rw] ssekms_key_id
     #   If present, specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) that was used for the object.
+    #   managed key that was used for the object.
     #   @return [String]
     #
     # @!attribute [rw] bucket_key_enabled
@@ -15118,7 +15141,7 @@ module Aws::S3
     # @!attribute [rw] ssekms_key_id
     #   If present, specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) was used for the object.
+    #   managed key was used for the object.
     #   @return [String]
     #
     # @!attribute [rw] bucket_key_enabled
@@ -15614,8 +15637,7 @@ module Aws::S3
     # @!attribute [rw] ssekms_key_id
     #   If present, specifies the ID of the Amazon Web Services Key
     #   Management Service (Amazon Web Services KMS) symmetric customer
-    #   managed customer master key (CMK) that was used for stored in Amazon
-    #   S3 object.
+    #   managed key that was used for stored in Amazon S3 object.
     #   @return [String]
     #
     # @!attribute [rw] sse_customer_key_md5