AllUploadPartCopy requests must be authenticated and signed by using IAM credentials (access key ID and secret access key for the IAM identities). All headers with thex-amz- prefix, includingx-amz-copy-source, must be signed. For more information, seeREST Authentication.

Directory buckets - You must use IAM credentials to authenticate and authorize your access to theUploadPartCopy API operation, instead of using the temporary security credentials through theCreateSession API operation.

AWS CLI or SDKs handles authentication and authorization on your behalf.

You must haveREAD access to the source object andWRITE access to the destination bucket.

Directory buckets - The HTTP Host header syntax isBucket-name.s3express-zone-id.region-code.amazonaws.com.

The bucket name.

Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the formatBucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the formatbucket-base-name--zone-id--x-s3 (for example,amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, seeDirectory bucket naming rules in theAmazon S3 User Guide.

Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the formAccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com. When using this action with an access point through the AWS SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, seeUsing access points in theAmazon S3 User Guide.

S3 on Outposts - When you use this action with S3 on Outposts, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the formAccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When you use this action with S3 on Outposts, the destination bucket must be the Outposts access point ARN or the access point alias. For more information about S3 on Outposts, seeWhat is S3 on Outposts? in theAmazon S3 User Guide.

Required: Yes

Object key for which the multipart upload was initiated.

Length Constraints: Minimum length of 1.

Required: Yes

Part number of part being copied. This is a positive integer between 1 and 10,000.

Required: Yes

Upload ID identifying the multipart upload whose part is being copied.

Required: Yes

Specifies the source object for the copy operation. You specify the value in one of two formats, depending on whether you want to access the source object through anaccess point:

If your bucket has versioning enabled, you could have multiple versions of the same object. By default,x-amz-copy-source identifies the current version of the source object to copy. To copy a specific version of the source object to copy, append?versionId=<version-id> to thex-amz-copy-source request header (for example,x-amz-copy-source: /awsexamplebucket/reports/january.pdf?versionId=QUpfdndhfd8438MNFDN93jdnJFkdmqnh893).

If the current version is a delete marker and you don't specify a versionId in thex-amz-copy-source request header, Amazon S3 returns a404 Not Found error, because the object does not exist. If you specify versionId in thex-amz-copy-source and the versionId is a delete marker, Amazon S3 returns an HTTP400 Bad Request error, because you are not allowed to specify a delete marker as a version for thex-amz-copy-source.

Pattern:\/?.+\/.+

Required: Yes

Copies the object if its entity tag (ETag) matches the specified tag.

If both of thex-amz-copy-source-if-match andx-amz-copy-source-if-unmodified-since headers are present in the request as follows:

x-amz-copy-source-if-match condition evaluates totrue, and;

x-amz-copy-source-if-unmodified-since condition evaluates tofalse;

Amazon S3 returns200 OK and copies the data.

Copies the object if it has been modified since the specified time.

If both of thex-amz-copy-source-if-none-match andx-amz-copy-source-if-modified-since headers are present in the request as follows:

x-amz-copy-source-if-none-match condition evaluates tofalse, and;

x-amz-copy-source-if-modified-since condition evaluates totrue;

Amazon S3 returns412 Precondition Failed response code.

Copies the object if its entity tag (ETag) is different than the specified ETag.

If both of thex-amz-copy-source-if-none-match andx-amz-copy-source-if-modified-since headers are present in the request as follows:

x-amz-copy-source-if-none-match condition evaluates tofalse, and;

x-amz-copy-source-if-modified-since condition evaluates totrue;

Amazon S3 returns412 Precondition Failed response code.

Copies the object if it hasn't been modified since the specified time.

If both of thex-amz-copy-source-if-match andx-amz-copy-source-if-unmodified-since headers are present in the request as follows:

x-amz-copy-source-if-match condition evaluates totrue, and;

x-amz-copy-source-if-unmodified-since condition evaluates tofalse;

Amazon S3 returns200 OK and copies the data.

The range of bytes to copy from the source object. The range value must use the form bytes=first-last, where the first and last are the zero-based byte offsets to copy. For example, bytes=0-9 indicates that you want to copy the first 10 bytes of the source. You can copy a range only if the source object is greater than 5 MB.

Specifies the algorithm to use when decrypting the source object (for example,AES256).

Specifies the customer-provided encryption key for Amazon S3 to use to decrypt the source object. The encryption key provided in this header must be one that was used when the source object was created.

Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.

The account ID of the expected destination bucket owner. If the account ID that you provide does not match the actual owner of the destination bucket, the request fails with the HTTP status code403 Forbidden (access denied).

Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If either the source or destination S3 bucket has Requester Pays enabled, the requester will pay for corresponding charges to copy the object. For information about downloading objects from Requester Pays buckets, seeDownloading Objects in Requester Pays Buckets in theAmazon S3 User Guide.

Valid Values:requester

Specifies the algorithm to use when encrypting the object (for example, AES256).

Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded; Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in thex-amz-server-side-encryption-customer-algorithm header. This must be the same encryption key specified in the initiate multipart upload request.

Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.

The account ID of the expected source bucket owner. If the account ID that you provide does not match the actual owner of the source bucket, the request fails with the HTTP status code403 Forbidden (access denied).

The version of the source object that was copied, if you have enabled versioning on the source bucket.

If present, indicates that the requester was successfully charged for the request. For more information, seeUsing Requester Pays buckets for storage transfers and usage in theAmazon Simple Storage Service user guide.

Valid Values:requester

The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.

Valid Values:AES256 | aws:fsx | aws:kms | aws:kms:dsse

If present, indicates the ID of the KMS key that was used for object encryption.

Indicates whether the multipart upload uses an S3 Bucket Key for server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS).

If server-side encryption with a customer-provided encryption key was requested, the response will include this header to confirm the encryption algorithm that's used.

If server-side encryption with a customer-provided encryption key was requested, the response will include this header to provide the round-trip message integrity verification of the customer-provided encryption key.

Root level tag for the CopyPartResult parameters.

Required: Yes

This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 32-bitCRC32 checksum of the part. For more information, seeChecking object integrity in theAmazon S3 User Guide.

Type: String

This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 32-bitCRC32C checksum of the part. For more information, seeChecking object integrity in theAmazon S3 User Guide.

Type: String

The Base64 encoded, 64-bitCRC64NVME checksum of the part. This checksum is present if the multipart upload request was created with theCRC64NVME checksum algorithm to the uploaded object). For more information, seeChecking object integrity in theAmazon S3 User Guide.

Type: String

This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 160-bitSHA1 checksum of the part. For more information, seeChecking object integrity in theAmazon S3 User Guide.

Type: String

This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 256-bitSHA256 checksum of the part. For more information, seeChecking object integrity in theAmazon S3 User Guide.

Type: String

Entity tag of the object.

Type: String

Date and time at which the object was uploaded.

Type: Timestamp