aws-sdk-s3 1.156.0 → 1.157.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 444d8fbcdc8d19b75228bdec52d8e1651f4d35459866847055b0d7e16d56371a
-  data.tar.gz: 785d49ecff3a7441d4f3c196ed64d7cfbe79330627c585fc7108a4a7b11d6d2b
+  metadata.gz: 39a77f1b089e257fe94bc26a0ca7309479a61cff7f46326243f2d1b002ce2bac
+  data.tar.gz: e2dbcc9f6ea92e1097d84130a2cd1c3e1caae305bdeb8b450056872edd2b4f74
 SHA512:
-  metadata.gz: e60cb04b18ce10ec62f4b63f28cf8ed7adf206a22910c7251ed9d1c2040a3466cb2d09a0987d6fc8d2361b4c15dfa0b764877b5c7bdedd03146383b5a11a79ae
-  data.tar.gz: 2e5654d95f462359aebeae89f2b855211b95acbe1820ad354a7a8c0e8261ff1188715e469637aea8c647124a7672f102a08e5fa78d73ed27253fcb886cfa13b8
+  metadata.gz: e34240198a44e4e678e0be7ef836318ff899ec61edc29bc2866d432eb6af834a7f81b801ea85ec35e26deec1e59705c1829b22e66093e6591d84dbc966f76e0e
+  data.tar.gz: 362065ca01c2d4a9e33cc9beb43afce43fbcb8c593db5785a32c623bbc99fe63471a41d767a1ae91343b94aba7df0e80360c0310c1f07aa052c76d63d07fda09

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.157.0 (2024-08-01)
+------------------
+
+* Feature - Support `head_bucket`, `get_object_attributes`, `delete_objects`, and `copy_object` for Access Grants.
+
 1.156.0 (2024-07-02)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.156.0
+1.157.0

data/lib/aws-sdk-s3/access_grants_credentials_provider.rb

@@ -47,6 +47,8 @@ module Aws
         @caching = options.delete(:caching) != false
         @s3_control_clients = {}
         @bucket_region_cache = Aws::S3.bucket_region_cache
+        @head_bucket_mutex = Mutex.new
+        @head_bucket_call = false
         return unless @caching
 
         @credentials_cache = Aws::S3.access_grants_credentials_cache
@@ -195,9 +197,16 @@ module Aws
       end
 
       def new_bucket_region_for(bucket)
-        @s3_client.head_bucket(bucket: bucket).bucket_region
-      rescue Aws::S3::Errors::Http301Error => e
-        e.data.region
+        @head_bucket_mutex.synchronize do
+          begin
+            @head_bucket_call = true
+            @s3_client.head_bucket(bucket: bucket).bucket_region
+          rescue Aws::S3::Errors::Http301Error => e
+            e.data.region
+          ensure
+            @head_bucket_call = false
+          end
+        end
       end
 
       # returns the account id for the configured credentials

data/lib/aws-sdk-s3/client.rb

@@ -18863,7 +18863,7 @@ module Aws::S3
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-s3'
-      context[:gem_version] = '1.156.0'
+      context[:gem_version] = '1.157.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-s3/plugins/access_grants.rb

@@ -44,25 +44,47 @@ setting, caching, and fallback behavior.
             list_objects_v2: 'READ',
             list_object_versions: 'READ',
             list_parts: 'READ',
+            head_bucket: 'READ',
+            get_object_attributes: 'READ',
             put_object: 'WRITE',
             put_object_acl: 'WRITE',
             delete_object: 'WRITE',
             abort_multipart_upload: 'WRITE',
             create_multipart_upload: 'WRITE',
             upload_part: 'WRITE',
-            complete_multipart_upload: 'WRITE'
+            complete_multipart_upload: 'WRITE',
+            delete_objects: 'WRITE',
+            copy_object: 'READWRITE'
           }.freeze
 
           def call(context)
+            provider = context.config.access_grants_credentials_provider
+
             if access_grants_operation?(context) &&
-               !s3_express_endpoint?(context)
+               !s3_express_endpoint?(context) &&
+               !credentials_head_bucket_call?(provider)
               params = context[:endpoint_params]
               permission = PERMISSION_MAP[context.operation_name]
 
-              provider = context.config.access_grants_credentials_provider
+              key =
+                case context.operation_name
+                when :delete_objects
+                  delete_params = context.params[:delete]
+                  common_prefixes(delete_params[:objects].map { |o| o[:key] })
+                when :copy_object
+                  source_bucket, source_key = params[:copy_source].split('/', 2)
+                  if params[:bucket] != source_bucket
+                    raise ArgumentError,
+                          'source and destination bucket must be the same'
+                  end
+                  common_prefixes([params[:key], source_key])
+                else
+                  params[:key]
+                end
+
               credentials = provider.access_grants_credentials_for(
                 bucket: params[:bucket],
-                key: params[:key],
+                key: key,
                 prefix: params[:prefix],
                 permission: permission
               )
@@ -80,6 +102,12 @@ setting, caching, and fallback behavior.
             Aws::Plugins::UserAgent.metric('S3_ACCESS_GRANTS', &block)
           end
 
+          # HeadBucket is a supported call. When fetching credentials,
+          # this plugin is executed again, and becomes recursive.
+          def credentials_head_bucket_call?(provider)
+            provider.instance_variable_get(:@head_bucket_call)
+          end
+
           def access_grants_operation?(context)
             params = context[:endpoint_params]
             params[:bucket] && PERMISSION_MAP[context.operation_name]
@@ -88,6 +116,42 @@ setting, caching, and fallback behavior.
           def s3_express_endpoint?(context)
             context[:endpoint_properties]['backend'] == 'S3Express'
           end
+
+          # Return the common prefix of the keys, regardless of the delimiter.
+          # For example, given keys ['foo/bar', 'foo/baz'], the common prefix
+          # is 'foo/ba'.
+          def common_prefixes(keys)
+            return '' if keys.empty?
+
+            first_key = keys[0]
+            common_ancestor = first_key
+            last_prefix = ''
+            keys.each do |k|
+              until common_ancestor.empty?
+                break if k.start_with?(common_ancestor)
+
+                last_index = common_ancestor.rindex('/')
+                return '' if last_index.nil?
+
+                last_prefix = common_ancestor[(last_index + 1)..-1]
+                common_ancestor = common_ancestor[0...last_index]
+              end
+            end
+            new_common_ancestor = "#{common_ancestor}/#{last_prefix}"
+            keys.each do |k|
+              until last_prefix.empty?
+                break if k.start_with?(new_common_ancestor)
+
+                last_prefix = last_prefix[0...-1]
+                new_common_ancestor = "#{common_ancestor}/#{last_prefix}"
+              end
+            end
+            if new_common_ancestor == "#{first_key}/"
+              first_key
+            else
+              new_common_ancestor
+            end
+          end
         end
 
         def add_handlers(handlers, config)

data/lib/aws-sdk-s3.rb

@@ -73,6 +73,6 @@ require_relative 'aws-sdk-s3/event_streams'
 # @!group service
 module Aws::S3
 
-  GEM_VERSION = '1.156.0'
+  GEM_VERSION = '1.157.0'
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-s3
 version: !ruby/object:Gem::Version
-  version: 1.156.0
+  version: 1.157.0
 platform: ruby
 authors:
 - Amazon Web Services
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-07-02 00:00:00.000000000 Z
+date: 2024-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-kms