aws-sdk-s3control 1.144.0 → 1.145.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5da73f8d3445be45b303dde558029aa4a4227fcb84d33aa9faef5b7e6d002c5
-  data.tar.gz: fea940fcfd2b16215ac98240e791ef3c64cd1046d5c8e475505969201beac6a9
+  metadata.gz: bab644be7acce196d83b17e69194207142691378dbb8ebd2903da042ceb769f5
+  data.tar.gz: 1c5c35b0b05eb84c8715b75d25e9f9d836c7cf6fbcfba48d1b27fa8e68b35e48
 SHA512:
-  metadata.gz: 0317af0ca3d3653ad31d495d439e319940543b7f18610c3070d7d189c516dff3941d8869004cbb567885fc17daabaae1a1eae68aae6d880c0ff0eacefcb45e0e
-  data.tar.gz: eb9de7dee10608dbb9a46ba7af27fb4f2632009315782c3dd4130e6066125e7bd79690693cc170de3075108323ad29b1563add658c7a524fc65ac27c4b869463
+  metadata.gz: '09a9f5c0257b375993c5f986c8a197836774aebecb0f895b388774ff0cb5bcc06cf3f58f9b9e86324fda44fc59afcdb766405e44e96192462b484afa6b6250be'
+  data.tar.gz: 3f4deb8a66313e592b8bf0b9788f6220b7b4b9dde1aed0a4fdb5782574e1187f0c0c355a5b4b81b1c348a77c1846cc26d31a265c1b02a69a0a793c457eb93f8b

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.145.0 (2026-11-09)
+------------------
+
+* Feature - Adds support for cross-account access grants with InstanceScope parameter for GetDataAccess and ListCallerAccessGrants operations in S3 Access Grants.
+
 1.144.0 (2026-11-06)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.144.0
+1.145.0

data/lib/aws-sdk-s3control/client.rb

@@ -4511,6 +4511,11 @@ module Aws::S3Control
     # Returns a temporary access credential from S3 Access Grants to the
     # grantee or client application. The [temporary credential][1] is an
     # Amazon Web Services STS token that grants them access to the S3 data.
+    # By default, S3 Access Grants searches for a matching grant in the
+    # instance of the Amazon Web Services account ID in the request. To also
+    # search instances shared with the caller through Amazon Web Services
+    # Resource Access Manager (RAM), set the `InstanceScope` parameter to
+    # `ALL`.
     #
     # Permissions
     #
@@ -4577,11 +4582,23 @@ module Aws::S3Control
     #   credential request. This information will be displayed in CloudTrail
     #   log in your account.
     #
+    # @option params [String] :instance_scope
+    #   The scope of S3 Access Grants instances to search for a grant matching
+    #   the requested S3 URI path.
+    #
+    #   * `SELF` – Searches only the instance of the Amazon Web Services
+    #     account ID in the request.
+    #
+    #   * `ALL` – Searches the instance of the Amazon Web Services account ID
+    #     in the request and all instances shared with the caller's account
+    #     through Amazon Web Services Resource Access Manager (RAM).
+    #
     # @return [Types::GetDataAccessResult] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::GetDataAccessResult#credentials #credentials} => Types::Credentials
     #   * {Types::GetDataAccessResult#matched_grant_target #matched_grant_target} => String
     #   * {Types::GetDataAccessResult#grantee #grantee} => Types::Grantee
+    #   * {Types::GetDataAccessResult#matched_instance_arn #matched_instance_arn} => String
     #
     # @example Request syntax with placeholder values
     #
@@ -4593,6 +4610,7 @@ module Aws::S3Control
     #     privilege: "Minimal", # accepts Minimal, Default
     #     target_type: "Object", # accepts Object
     #     audit_context: "AuditContext",
+    #     instance_scope: "SELF", # accepts SELF, ALL
     #   })
     #
     # @example Response structure
@@ -4604,6 +4622,7 @@ module Aws::S3Control
     #   resp.matched_grant_target #=> String
     #   resp.grantee.grantee_type #=> String, one of "DIRECTORY_USER", "DIRECTORY_GROUP", "IAM"
     #   resp.grantee.grantee_identifier #=> String
+    #   resp.matched_instance_arn #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3control-2018-08-20/GetDataAccess AWS API Documentation
     #
@@ -5736,14 +5755,18 @@ module Aws::S3Control
     # an Identity and Access Management (IAM) identity or Amazon Web
     # Services Identity Center corporate directory identity. You must pass
     # the Amazon Web Services account of the S3 data owner (grantor) in the
-    # request. You can, optionally, narrow the results by `GrantScope`,
-    # using a fragment of the data's S3 path, and S3 Access Grants will
-    # return only the grants with a path that contains the path fragment.
-    # You can also pass the `AllowedByApplication` filter in the request,
-    # which returns only the grants authorized for applications, whether the
-    # application is the caller's Identity Center application or any other
-    # application (`ALL`). For more information, see [List the caller's
-    # access grants][1] in the *Amazon S3 User Guide*.
+    # request. By default, S3 Access Grants returns grants from the instance
+    # of the Amazon Web Services account ID in the request. To return grants
+    # from all instances shared with the caller's account through Amazon
+    # Web Services Resource Access Manager (RAM), set the `InstanceScope`
+    # parameter to `ALL`. You can, optionally, narrow the results by
+    # `GrantScope`, using a fragment of the data's S3 path, and S3 Access
+    # Grants will return only the grants with a path that contains the path
+    # fragment. You can also pass the `AllowedByApplication` filter in the
+    # request, which returns only the grants authorized for applications,
+    # whether the application is the caller's Identity Center application
+    # or any other application (`ALL`). For more information, see [List the
+    # caller's access grants][1] in the *Amazon S3 User Guide*.
     #
     # Permissions
     #
@@ -5780,6 +5803,17 @@ module Aws::S3Control
     #   grants for the caller's Identity Center application or for any other
     #   applications (`ALL`).
     #
+    # @option params [String] :instance_scope
+    #   The scope of S3 Access Grants instances to list grants from.
+    #
+    #   * `SELF` – Lists grants from the instance of the Amazon Web Services
+    #     account ID in the request.
+    #
+    #   * `ALL` – Lists grants from the instance of the Amazon Web Services
+    #     account ID in the request and all instances shared with the
+    #     caller's account through Amazon Web Services Resource Access
+    #     Manager (RAM).
+    #
     # @return [Types::ListCallerAccessGrantsResult] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListCallerAccessGrantsResult#next_token #next_token} => String
@@ -5795,6 +5829,7 @@ module Aws::S3Control
     #     next_token: "ContinuationToken",
     #     max_results: 1,
     #     allowed_by_application: false,
+    #     instance_scope: "SELF", # accepts SELF, ALL
     #   })
     #
     # @example Response structure
@@ -5804,6 +5839,7 @@ module Aws::S3Control
     #   resp.caller_access_grants_list[0].permission #=> String, one of "READ", "WRITE", "READWRITE"
     #   resp.caller_access_grants_list[0].grant_scope #=> String
     #   resp.caller_access_grants_list[0].application_arn #=> String
+    #   resp.caller_access_grants_list[0].access_grants_instance_arn #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3control-2018-08-20/ListCallerAccessGrants AWS API Documentation
     #
@@ -8243,7 +8279,7 @@ module Aws::S3Control
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-s3control'
-      context[:gem_version] = '1.144.0'
+      context[:gem_version] = '1.145.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-s3control/client_api.rb

@@ -218,6 +218,7 @@ module Aws::S3Control
     IdentityCenterApplicationArn = Shapes::StringShape.new(name: 'IdentityCenterApplicationArn')
     IdentityCenterArn = Shapes::StringShape.new(name: 'IdentityCenterArn')
     Include = Shapes::StructureShape.new(name: 'Include')
+    InstanceScope = Shapes::StringShape.new(name: 'InstanceScope')
     InternalServiceException = Shapes::StructureShape.new(name: 'InternalServiceException')
     InvalidNextTokenException = Shapes::StructureShape.new(name: 'InvalidNextTokenException')
     InvalidRequestException = Shapes::StructureShape.new(name: 'InvalidRequestException')
@@ -1118,11 +1119,13 @@ module Aws::S3Control
     GetDataAccessRequest.add_member(:privilege, Shapes::ShapeRef.new(shape: Privilege, location: "querystring", location_name: "privilege"))
     GetDataAccessRequest.add_member(:target_type, Shapes::ShapeRef.new(shape: S3PrefixType, location: "querystring", location_name: "targetType"))
     GetDataAccessRequest.add_member(:audit_context, Shapes::ShapeRef.new(shape: AuditContext, location: "querystring", location_name: "auditContext"))
+    GetDataAccessRequest.add_member(:instance_scope, Shapes::ShapeRef.new(shape: InstanceScope, location: "querystring", location_name: "instanceScope"))
     GetDataAccessRequest.struct_class = Types::GetDataAccessRequest
 
     GetDataAccessResult.add_member(:credentials, Shapes::ShapeRef.new(shape: Credentials, location_name: "Credentials"))
     GetDataAccessResult.add_member(:matched_grant_target, Shapes::ShapeRef.new(shape: S3Prefix, location_name: "MatchedGrantTarget"))
     GetDataAccessResult.add_member(:grantee, Shapes::ShapeRef.new(shape: Grantee, location_name: "Grantee"))
+    GetDataAccessResult.add_member(:matched_instance_arn, Shapes::ShapeRef.new(shape: AccessGrantsInstanceArn, location_name: "MatchedInstanceArn"))
     GetDataAccessResult.struct_class = Types::GetDataAccessResult
 
     GetJobTaggingRequest.add_member(:account_id, Shapes::ShapeRef.new(shape: AccountId, location: "header", location_name: "x-amz-account-id", metadata: {"contextParam" => {"name" => "AccountId"}}))
@@ -1456,6 +1459,7 @@ module Aws::S3Control
     ListCallerAccessGrantsEntry.add_member(:permission, Shapes::ShapeRef.new(shape: Permission, location_name: "Permission"))
     ListCallerAccessGrantsEntry.add_member(:grant_scope, Shapes::ShapeRef.new(shape: S3Prefix, location_name: "GrantScope"))
     ListCallerAccessGrantsEntry.add_member(:application_arn, Shapes::ShapeRef.new(shape: IdentityCenterApplicationArn, location_name: "ApplicationArn"))
+    ListCallerAccessGrantsEntry.add_member(:access_grants_instance_arn, Shapes::ShapeRef.new(shape: AccessGrantsInstanceArn, location_name: "AccessGrantsInstanceArn"))
     ListCallerAccessGrantsEntry.struct_class = Types::ListCallerAccessGrantsEntry
 
     ListCallerAccessGrantsRequest.add_member(:account_id, Shapes::ShapeRef.new(shape: AccountId, location: "header", location_name: "x-amz-account-id", metadata: {"contextParam" => {"name" => "AccountId"}}))
@@ -1463,6 +1467,7 @@ module Aws::S3Control
     ListCallerAccessGrantsRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: ContinuationToken, location: "querystring", location_name: "nextToken"))
     ListCallerAccessGrantsRequest.add_member(:max_results, Shapes::ShapeRef.new(shape: MaxResults, location: "querystring", location_name: "maxResults"))
     ListCallerAccessGrantsRequest.add_member(:allowed_by_application, Shapes::ShapeRef.new(shape: Boolean, location: "querystring", location_name: "allowedByApplication"))
+    ListCallerAccessGrantsRequest.add_member(:instance_scope, Shapes::ShapeRef.new(shape: InstanceScope, location: "querystring", location_name: "instanceScope"))
     ListCallerAccessGrantsRequest.struct_class = Types::ListCallerAccessGrantsRequest
 
     ListCallerAccessGrantsResult.add_member(:next_token, Shapes::ShapeRef.new(shape: ContinuationToken, location_name: "NextToken"))

data/lib/aws-sdk-s3control/types.rb

@@ -3316,6 +3316,18 @@ module Aws::S3Control
     #   log in your account.
     #   @return [String]
     #
+    # @!attribute [rw] instance_scope
+    #   The scope of S3 Access Grants instances to search for a grant
+    #   matching the requested S3 URI path.
+    #
+    #   * `SELF` – Searches only the instance of the Amazon Web Services
+    #     account ID in the request.
+    #
+    #   * `ALL` – Searches the instance of the Amazon Web Services account
+    #     ID in the request and all instances shared with the caller's
+    #     account through Amazon Web Services Resource Access Manager (RAM).
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3control-2018-08-20/GetDataAccessRequest AWS API Documentation
     #
     class GetDataAccessRequest < Struct.new(
@@ -3325,7 +3337,8 @@ module Aws::S3Control
       :duration_seconds,
       :privilege,
       :target_type,
-      :audit_context)
+      :audit_context,
+      :instance_scope)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -3351,12 +3364,18 @@ module Aws::S3Control
     #   [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_sts-setcontext.html
     #   @return [Types::Grantee]
     #
+    # @!attribute [rw] matched_instance_arn
+    #   The Amazon Resource Name (ARN) of the S3 Access Grants instance
+    #   containing the grant that matched the requested S3 URI path.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3control-2018-08-20/GetDataAccessResult AWS API Documentation
     #
     class GetDataAccessResult < Struct.new(
       :credentials,
       :matched_grant_target,
-      :grantee)
+      :grantee,
+      :matched_instance_arn)
       SENSITIVE = [:credentials]
       include Aws::Structure
     end
@@ -5255,8 +5274,10 @@ module Aws::S3Control
 
     # Part of `ListCallerAccessGrantsResult`. Each entry includes the
     # permission level (READ, WRITE, or READWRITE) and the grant scope of
-    # the access grant. If the grant also includes an application ARN, the
-    # grantee can only access the S3 data through this application.
+    # the access grant. Each entry also includes the ARN of the S3 Access
+    # Grants instance in which the grant was created. If the grant also
+    # includes an application ARN, the grantee can only access the S3 data
+    # through this application.
     #
     # @!attribute [rw] permission
     #   The type of permission granted, which can be one of the following
@@ -5280,12 +5301,18 @@ module Aws::S3Control
     #   only access the S3 data through this application.
     #   @return [String]
     #
+    # @!attribute [rw] access_grants_instance_arn
+    #   The Amazon Resource Name (ARN) of the S3 Access Grants instance in
+    #   which the grant was created.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3control-2018-08-20/ListCallerAccessGrantsEntry AWS API Documentation
     #
     class ListCallerAccessGrantsEntry < Struct.new(
       :permission,
       :grant_scope,
-      :application_arn)
+      :application_arn,
+      :access_grants_instance_arn)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -5321,6 +5348,18 @@ module Aws::S3Control
     #   other applications (`ALL`).
     #   @return [Boolean]
     #
+    # @!attribute [rw] instance_scope
+    #   The scope of S3 Access Grants instances to list grants from.
+    #
+    #   * `SELF` – Lists grants from the instance of the Amazon Web Services
+    #     account ID in the request.
+    #
+    #   * `ALL` – Lists grants from the instance of the Amazon Web Services
+    #     account ID in the request and all instances shared with the
+    #     caller's account through Amazon Web Services Resource Access
+    #     Manager (RAM).
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/s3control-2018-08-20/ListCallerAccessGrantsRequest AWS API Documentation
     #
     class ListCallerAccessGrantsRequest < Struct.new(
@@ -5328,7 +5367,8 @@ module Aws::S3Control
       :grant_scope,
       :next_token,
       :max_results,
-      :allowed_by_application)
+      :allowed_by_application,
+      :instance_scope)
       SENSITIVE = []
       include Aws::Structure
     end

data/lib/aws-sdk-s3control.rb

@@ -54,7 +54,7 @@ module Aws::S3Control
   autoload :EndpointProvider, 'aws-sdk-s3control/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-s3control/endpoints'
 
-  GEM_VERSION = '1.144.0'
+  GEM_VERSION = '1.145.0'
 
 end
 

data/sig/client.rbs

@@ -902,6 +902,7 @@ module Aws
         def credentials: () -> Types::Credentials
         def matched_grant_target: () -> ::String
         def grantee: () -> Types::Grantee
+        def matched_instance_arn: () -> ::String
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/S3Control/Client.html#get_data_access-instance_method
       def get_data_access: (
@@ -911,7 +912,8 @@ module Aws
                              ?duration_seconds: ::Integer,
                              ?privilege: ("Minimal" | "Default"),
                              ?target_type: ("Object"),
-                             ?audit_context: ::String
+                             ?audit_context: ::String,
+                             ?instance_scope: ("SELF" | "ALL")
                            ) -> _GetDataAccessResponseSuccess
                          | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _GetDataAccessResponseSuccess
 
@@ -1113,7 +1115,8 @@ module Aws
                                        ?grant_scope: ::String,
                                        ?next_token: ::String,
                                        ?max_results: ::Integer,
-                                       ?allowed_by_application: bool
+                                       ?allowed_by_application: bool,
+                                       ?instance_scope: ("SELF" | "ALL")
                                      ) -> _ListCallerAccessGrantsResponseSuccess
                                    | (?Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _ListCallerAccessGrantsResponseSuccess
 

data/sig/types.rbs

@@ -771,6 +771,7 @@ module Aws::S3Control
       attr_accessor privilege: ("Minimal" | "Default")
       attr_accessor target_type: ("Object")
       attr_accessor audit_context: ::String
+      attr_accessor instance_scope: ("SELF" | "ALL")
       SENSITIVE: []
     end
 
@@ -778,6 +779,7 @@ module Aws::S3Control
       attr_accessor credentials: Types::Credentials
       attr_accessor matched_grant_target: ::String
       attr_accessor grantee: Types::Grantee
+      attr_accessor matched_instance_arn: ::String
       SENSITIVE: [:credentials]
     end
 
@@ -1218,6 +1220,7 @@ module Aws::S3Control
       attr_accessor permission: ("READ" | "WRITE" | "READWRITE")
       attr_accessor grant_scope: ::String
       attr_accessor application_arn: ::String
+      attr_accessor access_grants_instance_arn: ::String
       SENSITIVE: []
     end
 
@@ -1227,6 +1230,7 @@ module Aws::S3Control
       attr_accessor next_token: ::String
       attr_accessor max_results: ::Integer
       attr_accessor allowed_by_application: bool
+      attr_accessor instance_scope: ("SELF" | "ALL")
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-s3control
 version: !ruby/object:Gem::Version
-  version: 1.144.0
+  version: 1.145.0
 platform: ruby
 authors:
 - Amazon Web Services
@@ -18,7 +18,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.265.0
+        version: 3.266.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.265.0
+        version: 3.266.0
 - !ruby/object:Gem::Dependency
   name: aws-sigv4
   requirement: !ruby/object:Gem::Requirement