Returns a new instance of Client.

Parameters:

• options(Hash)

Options Hash (options):

• :plugins(Array<Seahorse::Client::Plugin>) — default:[]] —

  A list of plugins to apply to the client. Each plugin is either aclass name or an instance of a plugin class.

• :credentials(required,Aws::CredentialProvider) —

  Your AWS credentials used for authentication. This can be any class that includes and implementsAws::CredentialProvider, or instance of any one of the following classes:

  • Aws::Credentials - Used for configuring static, non-refreshingcredentials.

  • Aws::SharedCredentials - Used for loading static credentials from ashared file, such as~/.aws/config.

  • Aws::AssumeRoleCredentials - Used when you need to assume a role.

  • Aws::AssumeRoleWebIdentityCredentials - Used when you need toassume a role after providing credentials via the web.

  • Aws::SSOCredentials - Used for loading credentials from AWS SSO using anaccess token generated fromaws login.

  • Aws::ProcessCredentials - Used for loading credentials from aprocess that outputs to stdout.

  • Aws::InstanceProfileCredentials - Used for loading credentialsfrom an EC2 IMDS on an EC2 instance.

  • Aws::ECSCredentials - Used for loading credentials frominstances running in ECS.

  • Aws::CognitoIdentityCredentials - Used for loading credentialsfrom the Cognito Identity service.

  When:credentials are not configured directly, the following locations will be searched for credentials:

  • Aws.config[:credentials]

  • The:access_key_id,:secret_access_key,:session_token, and:account_id options.

  • ENV['AWS_ACCESS_KEY_ID'],ENV['AWS_SECRET_ACCESS_KEY'],ENV['AWS_SESSION_TOKEN'], andENV['AWS_ACCOUNT_ID'].

  • ~/.aws/credentials

  • ~/.aws/config

  • EC2/ECS IMDS instance profile - When used by default, the timeouts are very aggressive.Construct and pass an instance ofAws::InstanceProfileCredentials orAws::ECSCredentials toenable retries and extended timeouts. Instance profile credential fetching can be disabled bysettingENV['AWS_EC2_METADATA_DISABLED'] totrue.

• :region(required,String) —

  The AWS region to connect to. The configured:region isused to determine the service:endpoint. When not passed,a default:region is searched for in the following locations:

  • Aws.config[:region]
  • ENV['AWS_REGION']
  • ENV['AMAZON_REGION']
  • ENV['AWS_DEFAULT_REGION']
  • ~/.aws/credentials
  • ~/.aws/config
• :access_grants(Boolean) — default:false —

  Whentrue, the S3 client will use the S3 Access Grants feature toauthenticate requests. Bucket credentials will be fetched from S3Control using theget_data_access API.

• :access_grants_credentials_provider(Aws::S3::AccessGrantsCredentialsProvider) —

  Whenaccess_grants istrue, this option can be used to provideadditional options to the credentials provider, including a privilegesetting, caching, and fallback behavior.

• :access_key_id(String)
• :account_id(String)
• :active_endpoint_cache(Boolean) — default:false —

  When set totrue, a thread polling for endpoints will be running inthe background every 60 secs (default). Defaults tofalse.

• :adaptive_retry_wait_to_fill(Boolean) — default:true —

  Used only inadaptive retry mode. When true, the request will sleepuntil there is sufficent client side capacity to retry the request.When false, the request will raise aRetryCapacityNotAvailableError and willnot retry instead of sleeping.

• :auth_scheme_preference(Array<String>) —

  A list of preferred authentication schemes to use when making a request. Supported values are:sigv4,sigv4a,httpBearerAuth, andnoAuth. When set usingENV['AWS_AUTH_SCHEME_PREFERENCE'] or inshared config asauth_scheme_preference, the value should be a comma-separated list.

• :client_side_monitoring(Boolean) — default:false —

  Whentrue, client-side metrics will be collected for all API requests fromthis client.

• :client_side_monitoring_client_id(String) — default:"" —

  Allows you to provide an identifier for this client which will be attached toall generated client side metrics. Defaults to an empty string.

• :client_side_monitoring_host(String) — default:"127.0.0.1" —

  Allows you to specify the DNS hostname or IPv4 or IPv6 address that the clientside monitoring agent is running on, where client metrics will be published via UDP.

• :client_side_monitoring_port(Integer) — default:31000 —

  Required for publishing client metrics. The port that the client side monitoringagent is running on, where client metrics will be published via UDP.

• :client_side_monitoring_publisher(Aws::ClientSideMonitoring::Publisher) — default:Aws::ClientSideMonitoring::Publisher —

  Allows you to provide a custom client-side monitoring publisher class. By default,will use the Client Side Monitoring Agent Publisher.

• :compute_checksums(Boolean) — default:true —

  This option is deprecated. Please use:request_checksum_calculation instead.Whenfalse,request_checksum_calculation is overridden towhen_required.

• :convert_params(Boolean) — default:true —

  Whentrue, an attempt is made to coerce request parameters intothe required types.

• :correct_clock_skew(Boolean) — default:true —

  Used only instandard and adaptive retry modes. Specifies whether to applya clock skew correction and retry requests with skewed client clocks.

• :defaults_mode(String) — default:"legacy" —

  SeeDefaultsModeConfiguration for a list of theaccepted modes and the configuration defaults that are included.

• :disable_host_prefix_injection(Boolean) — default:false —

  Whentrue, the SDK will not prepend the modeled host prefix to the endpoint.

• :disable_request_compression(Boolean) — default:false —

  When set to 'true' the request body will not be compressedfor supported operations.

• :disable_s3_express_session_auth(boolean) —

  Parameter to indicate whether S3Express session auth should be disabled

• :endpoint(String,URI::HTTPS,URI::HTTP) —

  Normally you should not configure the:endpoint optiondirectly. This is normally constructed from the:regionoption. Configuring:endpoint is normally reserved forconnecting to test or custom endpoints. The endpoint shouldbe a URI formatted like:

  'http://example.com''https://example.com''http://example.com:123'

• :endpoint_cache_max_entries(Integer) — default:1000 —

  Used for the maximum size limit of the LRU cache storing endpoints datafor endpoint discovery enabled operations. Defaults to 1000.

• :endpoint_cache_max_threads(Integer) — default:10 —

  Used for the maximum threads in use for polling endpoints to be cached, defaults to 10.

• :endpoint_cache_poll_interval(Integer) — default:60 —

  When :endpoint_discovery and :active_endpoint_cache is enabled,Use this option to config the time interval in seconds for makingrequests fetching endpoints information. Defaults to 60 sec.

• :endpoint_discovery(Boolean) — default:false —

  When set totrue, endpoint discovery will be enabled for operations when available.

• :event_stream_handler(Proc) —

  When an EventStream or Proc object is provided, it will be used as callback for each chunk of event stream response received along the way.

• :express_credentials_provider(Aws::S3::ExpressCredentialsProvider) —

  Credential Provider for S3 Express endpoints. Manages credentialsfor different buckets.

• :follow_redirects(Boolean) — default:true —

  Whentrue, this client will follow 307 redirects returnedby Amazon S3.

• :force_path_style(Boolean) — default:false —

  When set totrue, the bucket name is always left in therequest URI and never moved to the host as a sub-domain.

• :ignore_configured_endpoint_urls(Boolean) —

  Setting to true disables use of endpoint URLs provided via environmentvariables and the shared configuration file.

• :input_event_stream_handler(Proc) —

  When an EventStream or Proc object is provided, it can be used for sending events for the event stream.

• :log_formatter(Aws::Log::Formatter) — default:Aws::Log::Formatter.default —

  The log formatter.

• :log_level(Symbol) — default::info —

  The log level to send messages to the:logger at.

• :logger(Logger) —

  The Logger instance to send log messages to. If this optionis not set, logging will be disabled.

• :max_attempts(Integer) — default:3 —

  An integer representing the maximum number attempts that will be made fora single request, including the initial attempt. For example,setting this value to 5 will result in a request being retried up to4 times. Used instandard andadaptive retry modes.

• :output_event_stream_handler(Proc) —

  When an EventStream or Proc object is provided, it will be used as callback for each chunk of event stream response received along the way.

• :profile(String) — default:"default" —

  Used when loading credentials from the shared credentials file atHOME/.aws/credentials.When not specified, 'default' is used.

• :request_checksum_calculation(String) — default:"when_supported" —

  Determines when a checksum will be calculated for request payloads. Values are:

  • when_supported - (default) When set, a checksum will becalculated for all request payloads of operations modeled with thehttpChecksum trait whererequestChecksumRequired istrue and/or arequestAlgorithmMember is modeled.
  • when_required - When set, a checksum will only be calculated forrequest payloads of operations modeled with thehttpChecksum trait whererequestChecksumRequired istrue or where arequestAlgorithmMemberis modeled and supplied.
• :request_min_compression_size_bytes(Integer) — default:10240 —

  The minimum size in bytes that triggers compression for requestbodies. The value must be non-negative integer value between 0and 10485780 bytes inclusive.

• :require_https_for_sse_cpk(Boolean) — default:true —

  Whentrue, the endpointmust be HTTPS for all operationswhere server-side-encryption is used with customer-provided keys.This should only be disabled for local testing.

• :response_checksum_validation(String) — default:"when_supported" —

  Determines when checksum validation will be performed on response payloads. Values are:

  • when_supported - (default) When set, checksum validation is performed on allresponse payloads of operations modeled with thehttpChecksum trait whereresponseAlgorithms is modeled, except when no modeled checksum algorithmsare supported.
  • when_required - When set, checksum validation is not performed onresponse payloads of operations unless the checksum algorithm is supported andtherequestValidationModeMember member is set toENABLED.
• :retry_backoff(Proc) —

  A proc or lambda used for backoff. Defaults to 2**retries * retry_base_delay.This option is only used in thelegacy retry mode.

• :retry_base_delay(Float) — default:0.3 —

  The base delay in seconds used by the default backoff function. This optionis only used in thelegacy retry mode.

• :retry_jitter(Symbol) — default::none —

  A delay randomiser function used by the default backoff function.Some predefined functions can be referenced by name - :none, :equal, :full,otherwise a Proc that takes and returns a number. This option is only usedin thelegacy retry mode.

  @seehttps://www.awsarchitectureblog.com/2015/03/backoff.html

• :retry_limit(Integer) — default:3 —

  The maximum number of times to retry failed requests. Only~ 500 level server errors and certain ~ 400 level client errorsare retried. Generally, these are throttling errors, datachecksum errors, networking errors, timeout errors, auth errors,endpoint discovery, and errors from expired credentials.This option is only used in thelegacy retry mode.

• :retry_max_delay(Integer) — default:0 —

  The maximum number of seconds to delay between retries (0 for no limit)used by the default backoff function. This option is only used in thelegacy retry mode.

• :retry_mode(String) — default:"legacy" —

  Specifies which retry algorithm to use. Values are:

  • legacy - The pre-existing retry behavior. This is default value ifno retry mode is provided.

  • standard - A standardized set of retry rules across the AWS SDKs.This includes support for retry quotas, which limit the number ofunsuccessful retries a client can make.

  • adaptive - An experimental retry mode that includes all thefunctionality ofstandard mode along with automatic client sidethrottling. This is a provisional mode that may change behaviorin the future.

• :s3_disable_multiregion_access_points(Boolean) — default:false —

  When set tofalse this will option will raise errors when multi-regionaccess point ARNs are used. Multi-region access points can potentiallyresult in cross region requests.

• :s3_us_east_1_regional_endpoint(String) — default:"legacy" —

  Pass inregional to enable theus-east-1 regional endpoint.Defaults tolegacy mode which uses the global endpoint.

• :s3_use_arn_region(Boolean) — default:true —

  For S3 ARNs passed into the:bucket parameter, this option willuse the region in the ARN, allowing for cross-region requests tobe made. Set tofalse to use the client's region instead.

• :sdk_ua_app_id(String) —

  A unique and opaque application ID that is appended to theUser-Agent header as app/sdk_ua_app_id. It should have amaximum length of 50. This variable is sourced from environmentvariable AWS_SDK_UA_APP_ID or the shared config profile attribute sdk_ua_app_id.

• :secret_access_key(String)
• :session_token(String)
• :sigv4a_signing_region_set(Array) —

  A list of regions that should be signed with SigV4a signing. Whennot passed, a default:sigv4a_signing_region_set is searched forin the following locations:

  • Aws.config[:sigv4a_signing_region_set]
  • ENV['AWS_SIGV4A_SIGNING_REGION_SET']
  • ~/.aws/config
• :stub_responses(Boolean) — default:false —

  Causes the client to return stubbed responses. By defaultfake responses are generated and returned. You can specifythe response data to return or errors to raise by callingClientStubs#stub_responses. SeeClientStubs for more information.

  Please note When response stubbing is enabled, no HTTPrequests are made, and retries are disabled.

• :telemetry_provider(Aws::Telemetry::TelemetryProviderBase) — default:Aws::Telemetry::NoOpTelemetryProvider —

  Allows you to provide a telemetry provider, which is used toemit telemetry data. By default, usesNoOpTelemetryProvider whichwill not record or emit any telemetry data. The SDK supports thefollowing telemetry providers:

  • OpenTelemetry (OTel) - To use the OTel provider, install and require theopentelemetry-sdk gem and then, pass in an instance of aAws::Telemetry::OTelProvider for telemetry provider.
• :token_provider(Aws::TokenProvider) —

  Your Bearer token used for authentication. This can be any class that includes and implementsAws::TokenProvider, or instance of any one of the following classes:

  • Aws::StaticTokenProvider - Used for configuring static, non-refreshingtokens.

  • Aws::SSOTokenProvider - Used for loading tokens from AWS SSO using anaccess token generated fromaws login.

  When:token_provider is not configured directly, theAws::TokenProviderChainwill be used to search for tokens configured for your profile in shared configuration files.

• :use_accelerate_endpoint(Boolean) — default:false —

  When set totrue, accelerated bucket endpoints will be usedfor all object operations. You must first enable accelerate foreach bucket.Go here for more information.

• :use_dualstack_endpoint(Boolean) —

  When set totrue, dualstack enabled endpoints (with.aws TLD)will be used if available.

• :use_fips_endpoint(Boolean) —

  When set totrue, fips compatible endpoints will be used if available.When afips region is used, the region is normalized and this configis set totrue.

• :validate_params(Boolean) — default:true —

  Whentrue, request parameters are validated beforesending the request.

• :endpoint_provider(Aws::S3::EndpointProvider) —

  The endpoint provider used to resolve endpoints. Any object that responds to#resolve_endpoint(parameters) whereparameters is a Struct similar toAws::S3::EndpointParameters.

• :http_continue_timeout(Float) — default:1 —

  The number of seconds to wait for a 100-continue response before sending therequest body. This option has no effect unless the request has "Expect"header set to "100-continue". Defaults tonil which disables thisbehaviour. This value can safely be set per request on the session.

• :http_idle_timeout(Float) — default:5 —

  The number of seconds a connection is allowed to sit idle before itis considered stale. Stale connections are closed and removed from thepool before making a request.

• :http_open_timeout(Float) — default:15 —

  The default number of seconds to wait for response data.This value can safely be set per-request on the session.

• :http_proxy(URI::HTTP,String) —

  A proxy to send requests through. Formatted like 'http://proxy.com:123'.

• :http_read_timeout(Float) — default:60 —

  The default number of seconds to wait for response data.This value can safely be set per-request on the session.

• :http_wire_trace(Boolean) — default:false —

  Whentrue, HTTP debug output will be sent to the:logger.

• :on_chunk_received(Proc) —

  When a Proc object is provided, it will be used as callback when each chunkof the response body is received. It provides three arguments: the chunk,the number of bytes received, and the total number ofbytes in the response (or nil if the server did not send acontent-length).

• :on_chunk_sent(Proc) —

  When a Proc object is provided, it will be used as callback when each chunkof the request body is sent. It provides three arguments: the chunk,the number of bytes read from the body, and the total number ofbytes in the body.

• :raise_response_errors(Boolean) — default:true —

  Whentrue, response errors are raised.

• :ssl_ca_bundle(String) —

  Full path to the SSL certificate authority bundle file that should be used whenverifying peer certificates. If you do not pass:ssl_ca_bundle or:ssl_ca_directory the the system default will be used if available.

• :ssl_ca_directory(String) —

  Full path of the directory that contains the unbundled SSL certificateauthority files for verifying peer certificates. If you donot pass:ssl_ca_bundle or:ssl_ca_directory the the systemdefault will be used if available.

• :ssl_ca_store(String) —

  Sets the X509::Store to verify peer certificate.

• :ssl_cert(OpenSSL::X509::Certificate) —

  Sets a client certificate when creating http connections.

• :ssl_key(OpenSSL::PKey) —

  Sets a client key when creating http connections.

• :ssl_timeout(Float) —

  Sets the SSL timeout in seconds

• :ssl_verify_peer(Boolean) — default:true —

  Whentrue, SSL peer certificates are verified when establishing a connection.

This operation aborts a multipart upload. After a multipart upload isaborted, no additional parts can be uploaded using that upload ID. Thestorage consumed by any previously uploaded parts will be freed.However, if any part uploads are currently in progress, those partuploads might or might not succeed. As a result, it might be necessaryto abort a given multipart upload multiple times in order tocompletely free all storage consumed by all parts.

To verify that all parts have been removed and prevent getting chargedfor the part storage, you should call theListParts API operationand ensure that the parts list is empty.

*Directory buckets - If multipart uploads in a directory bucket are in progress, you can't delete the bucket until all the in-progress multipart uploads are aborted or completed. To delete these in-progress multipart uploads, use theListMultipartUploads operation to list the in-progress multipart uploads in the bucket and use theAbortMultipartUpload operation to abort all the in-progress multipart uploads.

• Directory buckets - For directory buckets, you must makerequests for this API operation to the Zonal endpoint. Theseendpoints support virtual-hosted-style requests in the formathttps://amzn-s3-demo-bucket.s3express-zone-id.region-code.amazonaws.com/key-name. Path-style requests are not supported. For more information aboutendpoints in Availability Zones, seeRegional and Zonal endpointsfor directory buckets in Availability Zones in theAmazon S3User Guide. For more information about endpoints in Local Zones,seeConcepts for directory buckets in Local Zones in theAmazon S3 User Guide.

Permissions

• General purpose bucket permissions - For information aboutpermissions required to use the multipart upload, seeMultipartUpload and Permissions in theAmazon S3 User Guide.

• Directory bucket permissions - To grant access to this APIoperation on a directory bucket, we recommend that you use theCreateSession API operation for session-basedauthorization. Specifically, you grant thes3express:CreateSession permission to the directory bucket in abucket policy or an IAM identity-based policy. Then, you make theCreateSession API call on the bucket to obtain a session token.With the session token in your request header, you can make APIrequests to this operation. After the session token expires, youmake anotherCreateSession API call to generate a new sessiontoken for use. Amazon Web Services CLI or SDKs create session andrefresh the session token automatically to avoid serviceinterruptions when a session expires. For more information aboutauthorization, seeCreateSession.

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax isBucket-name.s3express-zone-id.region-code.amazonaws.com.

The following operations are related toAbortMultipartUpload:

• CreateMultipartUpload

• UploadPart

• CompleteMultipartUpload

• ListParts

• ListMultipartUploads

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Example: To abort a multipart upload

# The following example aborts a multipart upload.resp=client.abort_multipart_upload({bucket:"examplebucket",key:"bigobject",upload_id:"xadcOB_7YPBOJuoFiQ9cz4P3Pe6FIZwO4f7wN93uHsNBEw97pl5eNwzExg0LAT2dUN91cOmrEQHDsP3WA60CEg--",})resp.to_houtputsthefollowing:{}

Request syntax with placeholder values

resp=client.abort_multipart_upload({bucket:"BucketName",# requiredkey:"ObjectKey",# requiredupload_id:"MultipartUploadId",# requiredrequest_payer:"requester",# accepts requesterexpected_bucket_owner:"AccountId",if_match_initiated_time:Time.now,})

Response structure

resp.request_charged#=> String, one of "requester"

Completes a multipart upload by assembling previously uploaded parts.

You first initiate the multipart upload and then upload all partsusing theUploadPart operation or theUploadPartCopyoperation. After successfully uploading all relevant parts of anupload, you call thisCompleteMultipartUpload operation to completethe upload. Upon receiving this request, Amazon S3 concatenates allthe parts in ascending order by part number to create a new object. Inthe CompleteMultipartUpload request, you must provide the parts listand ensure that the parts list is complete. TheCompleteMultipartUpload API operation concatenates the parts that youprovide in the list. For each part in the list, you must provide thePartNumber value and theETag value that are returned after thatpart was uploaded.

The processing of a CompleteMultipartUpload request could take severalminutes to finalize. After Amazon S3 begins processing the request, itsends an HTTP response header that specifies a200 OK response.While processing is in progress, Amazon S3 periodically sends whitespace characters to keep the connection from timing out. A requestcould fail after the initial200 OK response has been sent. Thismeans that a200 OK response can contain either a success or anerror. The error response might be embedded in the200 OK response.If you call this API operation directly, make sure to design yourapplication to parse the contents of the response and handle itappropriately. If you use Amazon Web Services SDKs, SDKs handle thiscondition. The SDKs detect the embedded error and apply error handlingper your configuration settings (including automatically retrying therequest as appropriate). If the condition persists, the SDKs throw anexception (or, for the SDKs that don't use exceptions, they return anerror).

Note that ifCompleteMultipartUpload fails, applications should beprepared to retry any failed requests (including 500 error responses).For more information, seeAmazon S3 Error Best Practices.

You can't useContent-Type: application/x-www-form-urlencoded forthe CompleteMultipartUpload requests. Also, if you don't provide aContent-Type header,CompleteMultipartUpload can still return a200 OK response.

For more information about multipart uploads, seeUploading ObjectsUsing Multipart Upload in theAmazon S3 User Guide.

Directory buckets - For directory buckets, you must make requestsfor this API operation to the Zonal endpoint. These endpoints supportvirtual-hosted-style requests in the formathttps://amzn-s3-demo-bucket.s3express-zone-id.region-code.amazonaws.com/key-name. Path-style requests are not supported. For more information aboutendpoints in Availability Zones, seeRegional and Zonal endpoints fordirectory buckets in Availability Zones in theAmazon S3 UserGuide. For more information about endpoints in Local Zones, seeConcepts for directory buckets in Local Zones in theAmazon S3User Guide.

Permissions

• General purpose bucket permissions - For information aboutpermissions required to use the multipart upload API, seeMultipart Upload and Permissions in theAmazon S3 UserGuide.

  If you provide anadditional checksum value in yourMultipartUpload requests and the object is encrypted with KeyManagement Service, you must have permission to use thekms:Decrypt action for theCompleteMultipartUpload request tosucceed.

• Directory bucket permissions - To grant access to this APIoperation on a directory bucket, we recommend that you use theCreateSession API operation for session-basedauthorization. Specifically, you grant thes3express:CreateSession permission to the directory bucket in abucket policy or an IAM identity-based policy. Then, you make theCreateSession API call on the bucket to obtain a session token.With the session token in your request header, you can make APIrequests to this operation. After the session token expires, youmake anotherCreateSession API call to generate a new sessiontoken for use. Amazon Web Services CLI or SDKs create session andrefresh the session token automatically to avoid serviceinterruptions when a session expires. For more information aboutauthorization, seeCreateSession.

  If the object is encrypted with SSE-KMS, you must also have thekms:GenerateDataKey andkms:Decrypt permissions in IAMidentity-based policies and KMS key policies for the KMS key.

Special errors

• Error Code:EntityTooSmall

  • Description: Your proposed upload is smaller than the minimumallowed object size. Each part must be at least 5 MB in size,except the last part.

  • HTTP Status Code: 400 Bad Request

• Error Code:InvalidPart

  • Description: One or more of the specified parts could not befound. The part might not have been uploaded, or the specifiedETag might not have matched the uploaded part's ETag.

  • HTTP Status Code: 400 Bad Request

• Error Code:InvalidPartOrder

  • Description: The list of parts was not in ascending order. Theparts list must be specified in order by part number.

  • HTTP Status Code: 400 Bad Request

• Error Code:NoSuchUpload

  • Description: The specified multipart upload does not exist. Theupload ID might be invalid, or the multipart upload might havebeen aborted or completed.

  • HTTP Status Code: 404 Not Found

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax isBucket-name.s3express-zone-id.region-code.amazonaws.com.

The following operations are related toCompleteMultipartUpload:

• CreateMultipartUpload

• UploadPart

• AbortMultipartUpload

• ListParts

• ListMultipartUploads

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Example: To complete multipart upload

# The following example completes a multipart upload.resp=client.complete_multipart_upload({bucket:"examplebucket",key:"bigobject",multipart_upload:{parts:[{etag:"\"d8c2eafd90c266e19ab9dcacc479f8af\"",part_number:1,},{etag:"\"d8c2eafd90c266e19ab9dcacc479f8af\"",part_number:2,},],},upload_id:"7YPBOJuoFiQ9cz4P3Pe6FIZwO4f7wN93uHsNBEw97pl5eNwzExg0LAT2dUN91cOmrEQHDsP3WA60CEg--",})resp.to_houtputsthefollowing:{bucket:"acexamplebucket",etag:"\"4d9031c7644d8081c2829f4ea23c55f7-2\"",key:"bigobject",location:"https://examplebucket.s3.<Region>.amazonaws.com/bigobject",}

Request syntax with placeholder values

resp=client.complete_multipart_upload({bucket:"BucketName",# requiredkey:"ObjectKey",# requiredmultipart_upload:{parts:[{etag:"ETag",checksum_crc32:"ChecksumCRC32",checksum_crc32c:"ChecksumCRC32C",checksum_crc64nvme:"ChecksumCRC64NVME",checksum_sha1:"ChecksumSHA1",checksum_sha256:"ChecksumSHA256",part_number:1,},],},upload_id:"MultipartUploadId",# requiredchecksum_crc32:"ChecksumCRC32",checksum_crc32c:"ChecksumCRC32C",checksum_crc64nvme:"ChecksumCRC64NVME",checksum_sha1:"ChecksumSHA1",checksum_sha256:"ChecksumSHA256",checksum_type:"COMPOSITE",# accepts COMPOSITE, FULL_OBJECTmpu_object_size:1,request_payer:"requester",# accepts requesterexpected_bucket_owner:"AccountId",if_match:"IfMatch",if_none_match:"IfNoneMatch",sse_customer_algorithm:"SSECustomerAlgorithm",sse_customer_key:"SSECustomerKey",sse_customer_key_md5:"SSECustomerKeyMD5",})

Response structure

resp.location#=> Stringresp.bucket#=> Stringresp.key#=> Stringresp.expiration#=> Stringresp.etag#=> Stringresp.checksum_crc32#=> Stringresp.checksum_crc32c#=> Stringresp.checksum_crc64nvme#=> Stringresp.checksum_sha1#=> Stringresp.checksum_sha256#=> Stringresp.checksum_type#=> String, one of "COMPOSITE", "FULL_OBJECT"resp.server_side_encryption#=> String, one of "AES256", "aws:fsx", "aws:kms", "aws:kms:dsse"resp.version_id#=> Stringresp.ssekms_key_id#=> Stringresp.bucket_key_enabled#=> Booleanresp.request_charged#=> String, one of "requester"

Creates a copy of an object that is already stored in Amazon S3.

End of support notice: As of October 1, 2025, Amazon S3 hasdiscontinued support for Email Grantee Access Control Lists (ACLs). Ifyou attempt to use an Email Grantee ACL in a request after October 1,2025, the request will receive anHTTP 405 (Method Not Allowed)error.

This change affects the following Amazon Web Services Regions: USEast(N. Virginia), US West (N. California), US West (Oregon), Asia Pacific(Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe(Ireland), and South America (São Paulo).

You can store individual objects of up to 50 TB in Amazon S3. Youcreate a copy of your object up to 5 GB in size in a single atomicaction using this API. However, to copy an object greater than 5 GB,you must use the multipart upload Upload Part - Copy (UploadPartCopy)API. For more information, seeCopy Object Using the REST MultipartUpload API.

You can copy individual objects between general purpose buckets,between directory buckets, and between general purpose buckets anddirectory buckets.

* Amazon S3 supports copy operations using Multi-Region Access Points only as a destination when using the Multi-Region Access Point ARN.

• Directory buckets - For directory buckets, you must makerequests for this API operation to the Zonal endpoint. Theseendpoints support virtual-hosted-style requests in the formathttps://amzn-s3-demo-bucket.s3express-zone-id.region-code.amazonaws.com/key-name. Path-style requests are not supported. For more information aboutendpoints in Availability Zones, seeRegional and Zonal endpointsfor directory buckets in Availability Zones in theAmazon S3User Guide. For more information about endpoints in Local Zones,seeConcepts for directory buckets in Local Zones in theAmazon S3 User Guide.

• VPC endpoints don't support cross-Region requests (includingcopies). If you're using VPC endpoints, your source and destinationbuckets should be in the same Amazon Web Services Region as your VPCendpoint.

Both the Region that you want to copy the object from and the Regionthat you want to copy the object to must be enabled for your account.For more information about how to enable a Region for your account,seeEnable or disable a Region for standalone accounts in theAmazon Web Services Account Management Guide.

Amazon S3 transfer acceleration does not support cross-Region copies.If you request a cross-Region copy using a transfer accelerationendpoint, you get a400 Bad Request error. For more information, seeTransfer Acceleration.

Authentication and authorization

AllCopyObject requests must be authenticated and signed by usingIAM credentials (access key ID and secret access key for the IAMidentities). All headers with thex-amz- prefix, includingx-amz-copy-source, must be signed. For more information, seeRESTAuthentication.

Directory buckets - You must use the IAM credentials toauthenticate and authorize your access to theCopyObject APIoperation, instead of using the temporary security credentialsthrough theCreateSession API operation.

Amazon Web Services CLI or SDKs handles authentication andauthorization on your behalf.

Permissions

You must haveread access to the source object andwrite accessto the destination bucket.

• General purpose bucket permissions - You must have permissionsin an IAM policy based on the source and destination bucket typesin aCopyObject operation.

  • If the source object is in a general purpose bucket, you musthaves3:GetObject permission to read thesource object that is being copied.

  • If the destination bucket is a general purpose bucket, you musthaves3:PutObject permission to write theobject copy to the destination bucket.

• Directory bucket permissions - You must have permissions in abucket policy or an IAM identity-based policy based on the sourceand destination bucket types in aCopyObject operation.

  • If the source object that you want to copy is in a directorybucket, you must have thes3express:CreateSession permission in theAction element of a policy to read the object. By default, thesession is in theReadWrite mode. If you want to restrict theaccess, you can explicitly set thes3express:SessionModecondition key toReadOnly on the copy source bucket.

  • If the copy destination is a directory bucket, you must have thes3express:CreateSession permission in theAction element of a policy to write the object to thedestination. Thes3express:SessionMode condition key can't beset toReadOnly on the copy destination bucket.If the object is encrypted with SSE-KMS, you must also have thekms:GenerateDataKey andkms:Decrypt permissions in IAMidentity-based policies and KMS key policies for the KMS key.

  For example policies, seeExample bucket policies for S3 ExpressOne Zone andAmazon Web Services Identity and AccessManagement (IAM) identity-based policies for S3 Express OneZone in theAmazon S3 User Guide.

Response and special errors

When the request is an HTTP 1.1 request, the response is chunkencoded. When the request is not an HTTP 1.1 request, the responsewould not contain theContent-Length. You always need to read theentire response body to check if the copy succeeds.

• If the copy is successful, you receive a response with informationabout the copied object.

• A copy request might return an error when Amazon S3 receives thecopy request or while Amazon S3 is copying the files. A200 OKresponse can contain either a success or an error.

  • If the error occurs before the copy action starts, you receive astandard Amazon S3 error.

  • If the error occurs during the copy operation, the errorresponse is embedded in the200 OK response. For example, in across-region copy, you may encounter throttling and receive a200 OK response. For more information, seeResolve the Error200 response when copying objects to Amazon S3. The200 OKstatus code means the copy was accepted, but it doesn't meanthe copy is complete. Another example is when you disconnectfrom Amazon S3 before the copy is complete, Amazon S3 mightcancel the copy and you may receive a200 OK response. Youmust stay connected to Amazon S3 until the entire response issuccessfully received and processed.

    If you call this API operation directly, make sure to designyour application to parse the content of the response and handleit appropriately. If you use Amazon Web Services SDKs, SDKshandle this condition. The SDKs detect the embedded error andapply error handling per your configuration settings (includingautomatically retrying the request as appropriate). If thecondition persists, the SDKs throw an exception (or, for theSDKs that don't use exceptions, they return an error).

Charge

The copy request charge is based on the storage class and Regionthat you specify for the destination object. The request can alsoresult in a data retrieval charge for the source if the sourcestorage class bills for data retrieval. If the copy source is in adifferent region, the data transfer is billed to the copy sourceaccount. For pricing information, seeAmazon S3 pricing.

HTTP Host header syntax

• Directory buckets - The HTTP Host header syntax isBucket-name.s3express-zone-id.region-code.amazonaws.com.

• Amazon S3 on Outposts - When you use this action with S3 onOutposts through the REST API, you must direct requests to the S3on Outposts hostname. The S3 on Outposts hostname takes the formAccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com.The hostname isn't required when you use the Amazon Web ServicesCLI or SDKs.

The following operations are related toCopyObject:

• PutObject

• GetObject

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Example: To copy an object

# The following example copies an object from one bucket to another.resp=client.copy_object({bucket:"destinationbucket",copy_source:"/sourcebucket/HappyFacejpg",key:"HappyFaceCopyjpg",})resp.to_houtputsthefollowing:{copy_object_result:{etag:"\"6805f2cfc46c0f04559748bb039d69ae\"",last_modified:Time.parse("2016-12-15T17:38:53.000Z"),},}

Request syntax with placeholder values

resp=client.copy_object({acl:"private",# accepts private, public-read, public-read-write, authenticated-read, aws-exec-read, bucket-owner-read, bucket-owner-full-controlbucket:"BucketName",# requiredcache_control:"CacheControl",checksum_algorithm:"CRC32",# accepts CRC32, CRC32C, SHA1, SHA256, CRC64NVMEcontent_disposition:"ContentDisposition",content_encoding:"ContentEncoding",content_language:"ContentLanguage",content_type:"ContentType",copy_source:"CopySource",# requiredcopy_source_if_match:"CopySourceIfMatch",copy_source_if_modified_since:Time.now,copy_source_if_none_match:"CopySourceIfNoneMatch",copy_source_if_unmodified_since:Time.now,expires:Time.now,grant_full_control:"GrantFullControl",grant_read:"GrantRead",grant_read_acp:"GrantReadACP",grant_write_acp:"GrantWriteACP",if_match:"IfMatch",if_none_match:"IfNoneMatch",key:"ObjectKey",# requiredmetadata:{"MetadataKey"=>"MetadataValue",},metadata_directive:"COPY",# accepts COPY, REPLACEtagging_directive:"COPY",# accepts COPY, REPLACEserver_side_encryption:"AES256",# accepts AES256, aws:fsx, aws:kms, aws:kms:dssestorage_class:"STANDARD",# accepts STANDARD, REDUCED_REDUNDANCY, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER, DEEP_ARCHIVE, OUTPOSTS, GLACIER_IR, SNOW, EXPRESS_ONEZONE, FSX_OPENZFS, FSX_ONTAPwebsite_redirect_location:"WebsiteRedirectLocation",sse_customer_algorithm:"SSECustomerAlgorithm",sse_customer_key:"SSECustomerKey",sse_customer_key_md5:"SSECustomerKeyMD5",ssekms_key_id:"SSEKMSKeyId",ssekms_encryption_context:"SSEKMSEncryptionContext",bucket_key_enabled:false,copy_source_sse_customer_algorithm:"CopySourceSSECustomerAlgorithm",copy_source_sse_customer_key:"CopySourceSSECustomerKey",copy_source_sse_customer_key_md5:"CopySourceSSECustomerKeyMD5",request_payer:"requester",# accepts requestertagging:"TaggingHeader",object_lock_mode:"GOVERNANCE",# accepts GOVERNANCE, COMPLIANCEobject_lock_retain_until_date:Time.now,object_lock_legal_hold_status:"ON",# accepts ON, OFFexpected_bucket_owner:"AccountId",expected_source_bucket_owner:"AccountId",})

Response structure

resp.copy_object_result.etag#=> Stringresp.copy_object_result.last_modified#=> Timeresp.copy_object_result.checksum_type#=> String, one of "COMPOSITE", "FULL_OBJECT"resp.copy_object_result.checksum_crc32#=> Stringresp.copy_object_result.checksum_crc32c#=> Stringresp.copy_object_result.checksum_crc64nvme#=> Stringresp.copy_object_result.checksum_sha1#=> Stringresp.copy_object_result.checksum_sha256#=> Stringresp.expiration#=> Stringresp.copy_source_version_id#=> Stringresp.version_id#=> Stringresp.server_side_encryption#=> String, one of "AES256", "aws:fsx", "aws:kms", "aws:kms:dsse"resp.sse_customer_algorithm#=> Stringresp.sse_customer_key_md5#=> Stringresp.ssekms_key_id#=> Stringresp.ssekms_encryption_context#=> Stringresp.bucket_key_enabled#=> Booleanresp.request_charged#=> String, one of "requester"

This action creates an Amazon S3 bucket. To create an Amazon S3 onOutposts bucket, seeCreateBucket.

Creates a new S3 bucket. To create a bucket, you must set up Amazon S3and have a valid Amazon Web Services Access Key ID to authenticaterequests. Anonymous requests are never allowed to create buckets. Bycreating the bucket, you become the bucket owner.

There are two types of buckets: general purpose buckets and directorybuckets. For more information about these bucket types, seeCreating,configuring, and working with Amazon S3 buckets in theAmazon S3User Guide.

*General purpose buckets - If you send yourCreateBucket request to thes3.amazonaws.com global endpoint, the request goes to theus-east-1 Region. So the signature calculations in Signature Version 4 must useus-east-1 as the Region, even if the location constraint in the request specifies another Region where the bucket is to be created. If you create a bucket in a Region other than US East (N. Virginia), your application must be able to handle 307 redirect. For more information, seeVirtual hosting of buckets in theAmazon S3 User Guide.

• Directory buckets - For directory buckets, you must makerequests for this API operation to the Regional endpoint. Theseendpoints support path-style requests in the formathttps://s3express-control.region-code.amazonaws.com/bucket-name.Virtual-hosted-style requests aren't supported. For moreinformation about endpoints in Availability Zones, seeRegional andZonal endpoints for directory buckets in Availability Zones intheAmazon S3 User Guide. For more information about endpoints inLocal Zones, seeConcepts for directory buckets in Local Zonesin theAmazon S3 User Guide.

Permissions

• General purpose bucket permissions - In addition to thes3:CreateBucket permission, the following permissions arerequired in a policy when yourCreateBucket request includesspecific headers:

  • Access control lists (ACLs) - In yourCreateBucketrequest, if you specify an access control list (ACL) and set ittopublic-read,public-read-write,authenticated-read, orif you explicitly specify any other custom ACLs, boths3:CreateBucket ands3:PutBucketAcl permissions arerequired. In yourCreateBucket request, if you set the ACL toprivate, or if you don't specify any ACLs, only thes3:CreateBucket permission is required.

  • Object Lock - In yourCreateBucket request, if you setx-amz-bucket-object-lock-enabled to true, thes3:PutBucketObjectLockConfiguration ands3:PutBucketVersioning permissions are required.

  • S3 Object Ownership - If yourCreateBucket requestincludes thex-amz-object-ownership header, then thes3:PutBucketOwnershipControls permission is required.

    To set an ACL on a bucket as part of aCreateBucket request,you must explicitly set S3 Object Ownership for the bucket to adifferent value than the default,BucketOwnerEnforced.Additionally, if your desired bucket ACL grants public access,you must first create the bucket (without the bucket ACL) andthen explicitly disable Block Public Access on the bucket beforeusingPutBucketAcl to set the ACL. If you try to create abucket with a public ACL, the request will fail.

    For the majority of modern use cases in S3, we recommend thatyou keep all Block Public Access settings enabled and keep ACLsdisabled. If you would like to share data with users outside ofyour account, you can use bucket policies as needed. For moreinformation, seeControlling ownership of objects and disablingACLs for your bucket andBlocking public access to yourAmazon S3 storage in theAmazon S3 User Guide.

  • S3 Block Public Access - If your specific use case requiresgranting public access to your S3 resources, you can disableBlock Public Access. Specifically, you can create a new bucketwith Block Public Access enabled, then separately call theDeletePublicAccessBlock API. To use this operation, youmust have thes3:PutBucketPublicAccessBlock permission. Formore information about S3 Block Public Access, seeBlockingpublic access to your Amazon S3 storage in theAmazon S3User Guide.

• Directory bucket permissions - You must have thes3express:CreateBucket permission in an IAM identity-basedpolicy instead of a bucket policy. Cross-account access to thisAPI operation isn't supported. This operation can only beperformed by the Amazon Web Services account that owns theresource. For more information about directory bucket policies andpermissions, seeAmazon Web Services Identity and AccessManagement (IAM) for S3 Express One Zone in theAmazon S3User Guide.

  The permissions for ACLs, Object Lock, S3 Object Ownership, and S3Block Public Access are not supported for directory buckets. Fordirectory buckets, all Block Public Access settings are enabled atthe bucket level and S3 Object Ownership is set to Bucket ownerenforced (ACLs disabled). These settings can't be modified.

  For more information about permissions for creating and workingwith directory buckets, seeDirectory buckets in theAmazonS3 User Guide. For more information about supported S3 featuresfor directory buckets, seeFeatures of S3 Express One Zonein theAmazon S3 User Guide.

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax iss3express-control.region-code.amazonaws.com.

The following operations are related toCreateBucket:

• PutObject

• DeleteBucket

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Example: To create a bucket in a specific region

# The following example creates a bucket. The request specifies an AWS region where to create the bucket.resp=client.create_bucket({bucket:"examplebucket",create_bucket_configuration:{location_constraint:"eu-west-1",},})resp.to_houtputsthefollowing:{location:"http://examplebucket.<Region>.s3.amazonaws.com/",}

Example: To create a bucket

# The following example creates a bucket.resp=client.create_bucket({bucket:"examplebucket",})resp.to_houtputsthefollowing:{location:"/examplebucket",}

Request syntax with placeholder values

resp=client.create_bucket({acl:"private",# accepts private, public-read, public-read-write, authenticated-readbucket:"BucketName",# requiredcreate_bucket_configuration:{location_constraint:"af-south-1",# accepts af-south-1, ap-east-1, ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-south-2, ap-southeast-1, ap-southeast-2, ap-southeast-3, ap-southeast-4, ap-southeast-5, ca-central-1, cn-north-1, cn-northwest-1, EU, eu-central-1, eu-central-2, eu-north-1, eu-south-1, eu-south-2, eu-west-1, eu-west-2, eu-west-3, il-central-1, me-central-1, me-south-1, sa-east-1, us-east-2, us-gov-east-1, us-gov-west-1, us-west-1, us-west-2location:{type:"AvailabilityZone",# accepts AvailabilityZone, LocalZonename:"LocationNameAsString",},bucket:{data_redundancy:"SingleAvailabilityZone",# accepts SingleAvailabilityZone, SingleLocalZonetype:"Directory",# accepts Directory},tags:[{key:"ObjectKey",# requiredvalue:"Value",# required},],},grant_full_control:"GrantFullControl",grant_read:"GrantRead",grant_read_acp:"GrantReadACP",grant_write:"GrantWrite",grant_write_acp:"GrantWriteACP",object_lock_enabled_for_bucket:false,object_ownership:"BucketOwnerPreferred",# accepts BucketOwnerPreferred, ObjectWriter, BucketOwnerEnforced})

Response structure

resp.location#=> Stringresp.bucket_arn#=> String

Creates an S3 Metadata V2 metadata configuration for a general purposebucket. For more information, seeAccelerating data discovery with S3Metadata in theAmazon S3 User Guide.

Permissions

To use this operation, you must have the following permissions. Formore information, seeSetting up permissions for configuringmetadata tables in theAmazon S3 User Guide.

If you want to encrypt your metadata tables with server-sideencryption with Key Management Service (KMS) keys (SSE-KMS), youneed additional permissions in your KMS key policy. For moreinformation, see Setting up permissions for configuring metadatatables in theAmazon S3 User Guide.

If you also want to integrate your table bucket with Amazon WebServices analytics services so that you can query your metadatatable, you need additional permissions. For more information, seeIntegrating Amazon S3 Tables with Amazon Web Services analyticsservices in theAmazon S3 User Guide.

To query your metadata tables, you need additional permissions. Formore information, see Permissions for querying metadata tablesin theAmazon S3 User Guide.

• s3:CreateBucketMetadataTableConfiguration

  The IAM policy action name is the same for the V1 and V2 APIoperations.

• s3tables:CreateTableBucket

• s3tables:CreateNamespace

• s3tables:GetTable

• s3tables:CreateTable

• s3tables:PutTablePolicy

• s3tables:PutTableEncryption

• kms:DescribeKey

The following operations are related toCreateBucketMetadataConfiguration:

• DeleteBucketMetadataConfiguration

• GetBucketMetadataConfiguration

• UpdateBucketMetadataInventoryTableConfiguration

• UpdateBucketMetadataJournalTableConfiguration

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Request syntax with placeholder values

resp=client.create_bucket_metadata_configuration({bucket:"BucketName",# requiredcontent_md5:"ContentMD5",checksum_algorithm:"CRC32",# accepts CRC32, CRC32C, SHA1, SHA256, CRC64NVMEmetadata_configuration:{# requiredjournal_table_configuration:{# requiredrecord_expiration:{# requiredexpiration:"ENABLED",# required, accepts ENABLED, DISABLEDdays:1,},encryption_configuration:{sse_algorithm:"aws:kms",# required, accepts aws:kms, AES256kms_key_arn:"KmsKeyArn",},},inventory_table_configuration:{configuration_state:"ENABLED",# required, accepts ENABLED, DISABLEDencryption_configuration:{sse_algorithm:"aws:kms",# required, accepts aws:kms, AES256kms_key_arn:"KmsKeyArn",},},},expected_bucket_owner:"AccountId",})

We recommend that you create your S3 Metadata configurations by usingthe V2CreateBucketMetadataConfiguration API operation. We nolonger recommend using the V1CreateBucketMetadataTableConfigurationAPI operation.

If you created your S3 Metadata configuration before July 15, 2025,werecommend that you delete and re-create your configuration by usingCreateBucketMetadataConfiguration so that you can expire journaltable records and create a live inventory table.

Creates a V1 S3 Metadata configuration for a general purpose bucket.For more information, seeAccelerating data discovery with S3Metadata in theAmazon S3 User Guide.

Permissions

To use this operation, you must have the following permissions. Formore information, seeSetting up permissions for configuringmetadata tables in theAmazon S3 User Guide.

If you want to encrypt your metadata tables with server-sideencryption with Key Management Service (KMS) keys (SSE-KMS), youneed additional permissions. For more information, see Setting uppermissions for configuring metadata tables in theAmazon S3User Guide.

If you also want to integrate your table bucket with Amazon WebServices analytics services so that you can query your metadatatable, you need additional permissions. For more information, seeIntegrating Amazon S3 Tables with Amazon Web Services analyticsservices in theAmazon S3 User Guide.

• s3:CreateBucketMetadataTableConfiguration

• s3tables:CreateNamespace

• s3tables:GetTable

• s3tables:CreateTable

• s3tables:PutTablePolicy

The following operations are related toCreateBucketMetadataTableConfiguration:

• DeleteBucketMetadataTableConfiguration

• GetBucketMetadataTableConfiguration

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Request syntax with placeholder values

resp=client.create_bucket_metadata_table_configuration({bucket:"BucketName",# requiredcontent_md5:"ContentMD5",checksum_algorithm:"CRC32",# accepts CRC32, CRC32C, SHA1, SHA256, CRC64NVMEmetadata_table_configuration:{# requireds3_tables_destination:{# requiredtable_bucket_arn:"S3TablesBucketArn",# requiredtable_name:"S3TablesName",# required},},expected_bucket_owner:"AccountId",})

End of support notice: As of October 1, 2025, Amazon S3 hasdiscontinued support for Email Grantee Access Control Lists (ACLs). Ifyou attempt to use an Email Grantee ACL in a request after October 1,2025, the request will receive anHTTP 405 (Method Not Allowed)error.

This change affects the following Amazon Web Services Regions: USEast(N. Virginia), US West (N. California), US West (Oregon), Asia Pacific(Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe(Ireland), and South America (São Paulo).

This action initiates a multipart upload and returns an upload ID.This upload ID is used to associate all of the parts in the specificmultipart upload. You specify this upload ID in each of yoursubsequent upload part requests (seeUploadPart). You alsoinclude this upload ID in the final request to either complete orabort the multipart upload request. For more information aboutmultipart uploads, seeMultipart Upload Overview in theAmazonS3 User Guide.

After you initiate a multipart upload and upload one or more parts, tostop being charged for storing the uploaded parts, you must eithercomplete or abort the multipart upload. Amazon S3 frees up the spaceused to store the parts and stops charging you for storing them onlyafter you either complete or abort a multipart upload.

If you have configured a lifecycle rule to abort incomplete multipartuploads, the created multipart upload must be completed within thenumber of days specified in the bucket lifecycle configuration.Otherwise, the incomplete multipart upload becomes eligible for anabort action and Amazon S3 aborts the multipart upload. For moreinformation, seeAborting Incomplete Multipart Uploads Using a BucketLifecycle Configuration.

*Directory buckets - S3 Lifecycle is not supported by directory buckets.

• Directory buckets - For directory buckets, you must makerequests for this API operation to the Zonal endpoint. Theseendpoints support virtual-hosted-style requests in the formathttps://amzn-s3-demo-bucket.s3express-zone-id.region-code.amazonaws.com/key-name. Path-style requests are not supported. For more information aboutendpoints in Availability Zones, seeRegional and Zonal endpointsfor directory buckets in Availability Zones in theAmazon S3User Guide. For more information about endpoints in Local Zones,seeConcepts for directory buckets in Local Zones in theAmazon S3 User Guide.

Request signing

For request signing, multipart upload is just a series of regularrequests. You initiate a multipart upload, send one or more requeststo upload parts, and then complete the multipart upload process. Yousign each request individually. There is nothing special aboutsigning multipart upload requests. For more information aboutsigning, seeAuthenticating Requests (Amazon Web Services SignatureVersion 4) in theAmazon S3 User Guide.

Permissions

• General purpose bucket permissions - To perform a multipartupload with encryption using an Key Management Service (KMS) KMSkey, the requester must have permission to thekms:Decrypt andkms:GenerateDataKey actions on the key. The requester must alsohave permissions for thekms:GenerateDataKey action for theCreateMultipartUpload API. Then, the requester needs permissionsfor thekms:Decrypt action on theUploadPart andUploadPartCopy APIs. These permissions are required becauseAmazon S3 must decrypt and read data from the encrypted file partsbefore it completes the multipart upload. For more information,seeMultipart upload API and permissions andProtecting datausing server-side encryption with Amazon Web Services KMS intheAmazon S3 User Guide.

• Directory bucket permissions - To grant access to this APIoperation on a directory bucket, we recommend that you use theCreateSession API operation for session-basedauthorization. Specifically, you grant thes3express:CreateSession permission to the directory bucket in abucket policy or an IAM identity-based policy. Then, you make theCreateSession API call on the bucket to obtain a session token.With the session token in your request header, you can make APIrequests to this operation. After the session token expires, youmake anotherCreateSession API call to generate a new sessiontoken for use. Amazon Web Services CLI or SDKs create session andrefresh the session token automatically to avoid serviceinterruptions when a session expires. For more information aboutauthorization, seeCreateSession.

Encryption

• General purpose buckets - Server-side encryption is for dataencryption at rest. Amazon S3 encrypts your data as it writes itto disks in its data centers and decrypts it when you access it.Amazon S3 automatically encrypts all new objects that are uploadedto an S3 bucket. When doing a multipart upload, if you don'tspecify encryption information in your request, the encryptionsetting of the uploaded parts is set to the default encryptionconfiguration of the destination bucket. By default, all bucketshave a base level of encryption configuration that usesserver-side encryption with Amazon S3 managed keys (SSE-S3). Ifthe destination bucket has a default encryption configuration thatuses server-side encryption with an Key Management Service (KMS)key (SSE-KMS), or a customer-provided encryption key (SSE-C),Amazon S3 uses the corresponding KMS key, or a customer-providedkey to encrypt the uploaded parts. When you perform aCreateMultipartUpload operation, if you want to use a differenttype of encryption setting for the uploaded parts, you can requestthat Amazon S3 encrypts the object with a different encryption key(such as an Amazon S3 managed key, a KMS key, or acustomer-provided key). When the encryption setting in yourrequest is different from the default encryption configuration ofthe destination bucket, the encryption setting in your requesttakes precedence. If you choose to provide your own encryptionkey, the request headers you provide inUploadPart andUploadPartCopy requests must match the headers you used intheCreateMultipartUpload request.

  • Use KMS keys (SSE-KMS) that include the Amazon Web Servicesmanaged key (aws/s3) and KMS customer managed keys stored inKey Management Service (KMS) – If you want Amazon Web Servicesto manage the keys used to encrypt data, specify the followingheaders in the request.

    • x-amz-server-side-encryption

    • x-amz-server-side-encryption-aws-kms-key-id

    • x-amz-server-side-encryption-context * If you specifyx-amz-server-side-encryption:aws:kms, butdon't providex-amz-server-side-encryption-aws-kms-key-id,Amazon S3 uses the Amazon Web Services managed key (aws/s3key) in KMS to protect the data.

    • To perform a multipart upload with encryption by using anAmazon Web Services KMS key, the requester must havepermission to thekms:Decrypt andkms:GenerateDataKey*actions on the key. These permissions are required becauseAmazon S3 must decrypt and read data from the encrypted fileparts before it completes the multipart upload. For moreinformation, seeMultipart upload API and permissions andProtecting data using server-side encryption with Amazon WebServices KMS in theAmazon S3 User Guide.

    • If your Identity and Access Management (IAM) user or role isin the same Amazon Web Services account as the KMS key, thenyou must have these permissions on the key policy. If your IAMuser or role is in a different account from the key, then youmust have the permissions on both the key policy and your IAMuser or role.

    • AllGET andPUT requests for an object protected by KMSfail if you don't make them by using Secure Sockets Layer(SSL), Transport Layer Security (TLS), or Signature Version 4.For information about configuring any of the officiallysupported Amazon Web Services SDKs and Amazon Web ServicesCLI, seeSpecifying the Signature Version in RequestAuthentication in theAmazon S3 User Guide.

    For more information about server-side encryption with KMS keys(SSE-KMS), seeProtecting Data Using Server-Side Encryptionwith KMS keys in theAmazon S3 User Guide.

  • Use customer-provided encryption keys (SSE-C) – If you want tomanage your own encryption keys, provide all the followingheaders in the request.

    • x-amz-server-side-encryption-customer-algorithm

    • x-amz-server-side-encryption-customer-key

    • x-amz-server-side-encryption-customer-key-MD5For more information about server-side encryption withcustomer-provided encryption keys (SSE-C), see Protecting datausing server-side encryption with customer-provided encryptionkeys (SSE-C) in theAmazon S3 User Guide.

• Directory buckets - For directory buckets, there are only twosupported options for server-side encryption: server-sideencryption with Amazon S3 managed keys (SSE-S3) (AES256) andserver-side encryption with KMS keys (SSE-KMS) (aws:kms). Werecommend that the bucket's default encryption uses the desiredencryption configuration and you don't override the bucketdefault encryption in yourCreateSession requests orPUTobject requests. Then, new objects are automatically encryptedwith the desired encryption settings. For more information, seeProtecting data with server-side encryption in theAmazonS3 User Guide. For more information about the encryptionoverriding behaviors in directory buckets, seeSpecifyingserver-side encryption with KMS for new object uploads.

  In the Zonal endpoint API calls (exceptCopyObject andUploadPartCopy) using the REST API, the encryption requestheaders must match the encryption settings that are specified intheCreateSession request. You can't override the values of theencryption settings (x-amz-server-side-encryption,x-amz-server-side-encryption-aws-kms-key-id,x-amz-server-side-encryption-context, andx-amz-server-side-encryption-bucket-key-enabled) that arespecified in theCreateSession request. You don't need toexplicitly specify these encryption settings values in Zonalendpoint API calls, and Amazon S3 will use the encryption settingsvalues from theCreateSession request to protect new objects inthe directory bucket.

  When you use the CLI or the Amazon Web Services SDKs, forCreateSession, the session token refreshes automatically toavoid service interruptions when a session expires. The CLI or theAmazon Web Services SDKs use the bucket's default encryptionconfiguration for theCreateSession request. It's not supportedto override the encryption settings values in theCreateSessionrequest. So in the Zonal endpoint API calls (exceptCopyObject andUploadPartCopy), the encryption requestheaders must match the default encryption configuration of thedirectory bucket.

  For directory buckets, when you perform aCreateMultipartUploadoperation and anUploadPartCopy operation, the request headersyou provide in theCreateMultipartUpload request must match thedefault encryption configuration of the destination bucket.

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax isBucket-name.s3express-zone-id.region-code.amazonaws.com.

The following operations are related toCreateMultipartUpload:

• UploadPart

• CompleteMultipartUpload

• AbortMultipartUpload

• ListParts

• ListMultipartUploads

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Example: To initiate a multipart upload

# The following example initiates a multipart upload.resp=client.create_multipart_upload({bucket:"examplebucket",key:"largeobject",})resp.to_houtputsthefollowing:{bucket:"examplebucket",key:"largeobject",upload_id:"ibZBv_75gd9r8lH_gqXatLdxMVpAlj6ZQjEs.OwyF3953YdwbcQnMA2BLGn8Lx12fQNICtMw5KyteFeHw.Sjng--",}

Request syntax with placeholder values

resp=client.create_multipart_upload({acl:"private",# accepts private, public-read, public-read-write, authenticated-read, aws-exec-read, bucket-owner-read, bucket-owner-full-controlbucket:"BucketName",# requiredcache_control:"CacheControl",content_disposition:"ContentDisposition",content_encoding:"ContentEncoding",content_language:"ContentLanguage",content_type:"ContentType",expires:Time.now,grant_full_control:"GrantFullControl",grant_read:"GrantRead",grant_read_acp:"GrantReadACP",grant_write_acp:"GrantWriteACP",key:"ObjectKey",# requiredmetadata:{"MetadataKey"=>"MetadataValue",},server_side_encryption:"AES256",# accepts AES256, aws:fsx, aws:kms, aws:kms:dssestorage_class:"STANDARD",# accepts STANDARD, REDUCED_REDUNDANCY, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER, DEEP_ARCHIVE, OUTPOSTS, GLACIER_IR, SNOW, EXPRESS_ONEZONE, FSX_OPENZFS, FSX_ONTAPwebsite_redirect_location:"WebsiteRedirectLocation",sse_customer_algorithm:"SSECustomerAlgorithm",sse_customer_key:"SSECustomerKey",sse_customer_key_md5:"SSECustomerKeyMD5",ssekms_key_id:"SSEKMSKeyId",ssekms_encryption_context:"SSEKMSEncryptionContext",bucket_key_enabled:false,request_payer:"requester",# accepts requestertagging:"TaggingHeader",object_lock_mode:"GOVERNANCE",# accepts GOVERNANCE, COMPLIANCEobject_lock_retain_until_date:Time.now,object_lock_legal_hold_status:"ON",# accepts ON, OFFexpected_bucket_owner:"AccountId",checksum_algorithm:"CRC32",# accepts CRC32, CRC32C, SHA1, SHA256, CRC64NVMEchecksum_type:"COMPOSITE",# accepts COMPOSITE, FULL_OBJECT})

Response structure

resp.abort_date#=> Timeresp.abort_rule_id#=> Stringresp.bucket#=> Stringresp.key#=> Stringresp.upload_id#=> Stringresp.server_side_encryption#=> String, one of "AES256", "aws:fsx", "aws:kms", "aws:kms:dsse"resp.sse_customer_algorithm#=> Stringresp.sse_customer_key_md5#=> Stringresp.ssekms_key_id#=> Stringresp.ssekms_encryption_context#=> Stringresp.bucket_key_enabled#=> Booleanresp.request_charged#=> String, one of "requester"resp.checksum_algorithm#=> String, one of "CRC32", "CRC32C", "SHA1", "SHA256", "CRC64NVME"resp.checksum_type#=> String, one of "COMPOSITE", "FULL_OBJECT"

Creates a session that establishes temporary security credentials tosupport fast authentication and authorization for the Zonal endpointAPI operations on directory buckets. For more information about Zonalendpoint API operations that include the Availability Zone in therequest endpoint, seeS3 Express One Zone APIs in theAmazon S3User Guide.

To make Zonal endpoint API requests on a directory bucket, use theCreateSession API operation. Specifically, you grants3express:CreateSession permission to a bucket in a bucket policy oran IAM identity-based policy. Then, you use IAM credentials to maketheCreateSession API request on the bucket, which returns temporarysecurity credentials that include the access key ID, secret accesskey, session token, and expiration. These credentials have associatedpermissions to access the Zonal endpoint API operations. After thesession is created, you don’t need to use other policies to grantpermissions to each Zonal endpoint API individually. Instead, in yourZonal endpoint API requests, you sign your requests by applying thetemporary security credentials of the session to the request headersand following the SigV4 protocol for authentication. You also applythe session token to thex-amz-s3session-token request header forauthorization. Temporary security credentials are scoped to the bucketand expire after 5 minutes. After the expiration time, any calls thatyou make with those credentials will fail. You must use IAMcredentials again to make aCreateSession API request that generatesa new set of temporary credentials for use. Temporary credentialscannot be extended or refreshed beyond the original specifiedinterval.

If you use Amazon Web Services SDKs, SDKs handle the session tokenrefreshes automatically to avoid service interruptions when a sessionexpires. We recommend that you use the Amazon Web Services SDKs toinitiate and manage requests to the CreateSession API. For moreinformation, seePerformance guidelines and design patterns intheAmazon S3 User Guide.

* You must make requests for this API operation to the Zonal endpoint. These endpoints support virtual-hosted-style requests in the formathttps://bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. For more information about endpoints in Availability Zones, seeRegional and Zonal endpoints for directory buckets in Availability Zones in theAmazon S3 User Guide. For more information about endpoints in Local Zones, seeConcepts for directory buckets in Local Zones in theAmazon S3 User Guide.

• CopyObject API operation - Unlike other Zonalendpoint API operations, theCopyObject API operation doesn't usethe temporary security credentials returned from theCreateSessionAPI operation for authentication and authorization. For informationabout authentication and authorization of theCopyObject APIoperation on directory buckets, seeCopyObject.

• HeadBucket API operation - Unlike other Zonalendpoint API operations, theHeadBucket API operation doesn't usethe temporary security credentials returned from theCreateSessionAPI operation for authentication and authorization. For informationabout authentication and authorization of theHeadBucket APIoperation on directory buckets, seeHeadBucket.

Permissions

To obtain temporary security credentials, you must create a bucketpolicy or an IAM identity-based policy that grantss3express:CreateSession permission to the bucket. In a policy, youcan have thes3express:SessionMode condition key to control whocan create aReadWrite orReadOnly session. For more informationaboutReadWrite orReadOnly sessions, seex-amz-create-session-mode. For example policies, seeExamplebucket policies for S3 Express One Zone andAmazon Web ServicesIdentity and Access Management (IAM) identity-based policies for S3Express One Zone in theAmazon S3 User Guide.

To grant cross-account access to Zonal endpoint API operations, thebucket policy should also grant both accounts thes3express:CreateSession permission.

If you want to encrypt objects with SSE-KMS, you must also have thekms:GenerateDataKey and thekms:Decrypt permissions in IAMidentity-based policies and KMS key policies for the target KMS key.

Encryption

For directory buckets, there are only two supported options forserver-side encryption: server-side encryption with Amazon S3managed keys (SSE-S3) (AES256) and server-side encryption with KMSkeys (SSE-KMS) (aws:kms). We recommend that the bucket's defaultencryption uses the desired encryption configuration and you don'toverride the bucket default encryption in yourCreateSessionrequests orPUT object requests. Then, new objects areautomatically encrypted with the desired encryption settings. Formore information, seeProtecting data with server-sideencryption in theAmazon S3 User Guide. For more informationabout the encryption overriding behaviors in directory buckets, seeSpecifying server-side encryption with KMS for new objectuploads.

ForZonal endpoint (object-level) API operations exceptCopyObject andUploadPartCopy, you authenticate andauthorize requests throughCreateSession for low latency. Toencrypt new objects in a directory bucket with SSE-KMS, you mustspecify SSE-KMS as the directory bucket's default encryptionconfiguration with a KMS key (specifically, acustomer managedkey). Then, when a session is created for Zonal endpoint APIoperations, new objects are automatically encrypted and decryptedwith SSE-KMS and S3 Bucket Keys during the session.

Only 1customer managed key is supported per directory bucketfor the lifetime of the bucket. TheAmazon Web Services managedkey (aws/s3) isn't supported. After you specify SSE-KMS asyour bucket's default encryption configuration with a customermanaged key, you can't change the customer managed key for thebucket's SSE-KMS configuration.

In the Zonal endpoint API calls (exceptCopyObject andUploadPartCopy) using the REST API, you can't override thevalues of the encryption settings (x-amz-server-side-encryption,x-amz-server-side-encryption-aws-kms-key-id,x-amz-server-side-encryption-context, andx-amz-server-side-encryption-bucket-key-enabled) from theCreateSession request. You don't need to explicitly specify theseencryption settings values in Zonal endpoint API calls, and AmazonS3 will use the encryption settings values from theCreateSessionrequest to protect new objects in the directory bucket.

When you use the CLI or the Amazon Web Services SDKs, forCreateSession, the session token refreshes automatically to avoidservice interruptions when a session expires. The CLI or the AmazonWeb Services SDKs use the bucket's default encryption configurationfor theCreateSession request. It's not supported to override theencryption settings values in theCreateSession request. Also, inthe Zonal endpoint API calls (exceptCopyObject andUploadPartCopy), it's not supported to override the values ofthe encryption settings from theCreateSession request.

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax isBucket-name.s3express-zone-id.region-code.amazonaws.com.

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Request syntax with placeholder values

resp=client.create_session({session_mode:"ReadOnly",# accepts ReadOnly, ReadWritebucket:"BucketName",# requiredserver_side_encryption:"AES256",# accepts AES256, aws:fsx, aws:kms, aws:kms:dssessekms_key_id:"SSEKMSKeyId",ssekms_encryption_context:"SSEKMSEncryptionContext",bucket_key_enabled:false,})

Response structure

resp.server_side_encryption#=> String, one of "AES256", "aws:fsx", "aws:kms", "aws:kms:dsse"resp.ssekms_key_id#=> Stringresp.ssekms_encryption_context#=> Stringresp.bucket_key_enabled#=> Booleanresp.credentials.access_key_id#=> Stringresp.credentials.secret_access_key#=> Stringresp.credentials.session_token#=> Stringresp.credentials.expiration#=> Time

Deletes the S3 bucket. All objects (including all object versions anddelete markers) in the bucket must be deleted before the bucket itselfcan be deleted.

*Directory buckets - If multipart uploads in a directory bucket are in progress, you can't delete the bucket until all the in-progress multipart uploads are aborted or completed.

• Directory buckets - For directory buckets, you must makerequests for this API operation to the Regional endpoint. Theseendpoints support path-style requests in the formathttps://s3express-control.region-code.amazonaws.com/bucket-name.Virtual-hosted-style requests aren't supported. For moreinformation about endpoints in Availability Zones, seeRegional andZonal endpoints for directory buckets in Availability Zones intheAmazon S3 User Guide. For more information about endpoints inLocal Zones, seeConcepts for directory buckets in Local Zonesin theAmazon S3 User Guide.

Permissions

• General purpose bucket permissions - You must have thes3:DeleteBucket permission on the specified bucket in a policy.

• Directory bucket permissions - You must have thes3express:DeleteBucket permission in an IAM identity-basedpolicy instead of a bucket policy. Cross-account access to thisAPI operation isn't supported. This operation can only beperformed by the Amazon Web Services account that owns theresource. For more information about directory bucket policies andpermissions, seeAmazon Web Services Identity and AccessManagement (IAM) for S3 Express One Zone in theAmazon S3User Guide.

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax iss3express-control.region-code.amazonaws.com.

The following operations are related toDeleteBucket:

• CreateBucket

• DeleteObject

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Example: To delete a bucket

# The following example deletes the specified bucket.resp=client.delete_bucket({bucket:"forrandall2",})

Request syntax with placeholder values

resp=client.delete_bucket({bucket:"BucketName",# requiredexpected_bucket_owner:"AccountId",})

This operation is not supported for directory buckets.

Deletes an analytics configuration for the bucket (specified by theanalytics configuration ID).

To use this operation, you must have permissions to perform thes3:PutAnalyticsConfiguration action. The bucket owner has thispermission by default. The bucket owner can grant this permission toothers. For more information about permissions, seePermissionsRelated to Bucket Subresource Operations andManaging AccessPermissions to Your Amazon S3 Resources.

For information about the Amazon S3 analytics feature, seeAmazon S3Analytics – Storage Class Analysis.

The following operations are related toDeleteBucketAnalyticsConfiguration:

• GetBucketAnalyticsConfiguration

• ListBucketAnalyticsConfigurations

• PutBucketAnalyticsConfiguration

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Request syntax with placeholder values

resp=client.delete_bucket_analytics_configuration({bucket:"BucketName",# requiredid:"AnalyticsId",# requiredexpected_bucket_owner:"AccountId",})

This operation is not supported for directory buckets.

Deletes thecors configuration information set for the bucket.

To use this operation, you must have permission to perform thes3:PutBucketCORS action. The bucket owner has this permission bydefault and can grant this permission to others.

For information aboutcors, seeEnabling Cross-Origin ResourceSharing in theAmazon S3 User Guide.

Related Resources

• PutBucketCors

• RESTOPTIONSobject

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Example: To delete cors configuration on a bucket.

# The following example deletes CORS configuration on a bucket.resp=client.delete_bucket_cors({bucket:"examplebucket",})

Request syntax with placeholder values

resp=client.delete_bucket_cors({bucket:"BucketName",# requiredexpected_bucket_owner:"AccountId",})

This implementation of the DELETE action resets the default encryptionfor the bucket as server-side encryption with Amazon S3 managed keys(SSE-S3).

*General purpose buckets - For information about the bucket default encryption feature, seeAmazon S3 Bucket Default Encryption in theAmazon S3 User Guide.

• Directory buckets - For directory buckets, there are only twosupported options for server-side encryption: SSE-S3 and SSE-KMS.For information about the default encryption configuration indirectory buckets, seeSetting default server-side encryptionbehavior for directory buckets.

Permissions

• General purpose bucket permissions - Thes3:PutEncryptionConfiguration permission is required in apolicy. The bucket owner has this permission by default. Thebucket owner can grant this permission to others. For moreinformation about permissions, seePermissions Related to BucketOperations andManaging Access Permissions to Your Amazon S3Resources.

• Directory bucket permissions - To grant access to this APIoperation, you must have thes3express:PutEncryptionConfiguration permission in an IAMidentity-based policy instead of a bucket policy. Cross-accountaccess to this API operation isn't supported. This operation canonly be performed by the Amazon Web Services account that owns theresource. For more information about directory bucket policies andpermissions, seeAmazon Web Services Identity and AccessManagement (IAM) for S3 Express One Zone in theAmazon S3User Guide.

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax iss3express-control.region-code.amazonaws.com.

The following operations are related toDeleteBucketEncryption:

• PutBucketEncryption

• GetBucketEncryption

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Request syntax with placeholder values

resp=client.delete_bucket_encryption({bucket:"BucketName",# requiredexpected_bucket_owner:"AccountId",})

This operation is not supported for directory buckets.

Deletes the S3 Intelligent-Tiering configuration from the specifiedbucket.

The S3 Intelligent-Tiering storage class is designed to optimizestorage costs by automatically moving data to the most cost-effectivestorage access tier, without performance impact or operationaloverhead. S3 Intelligent-Tiering delivers automatic cost savings inthree low latency and high throughput access tiers. To get the loweststorage cost on data that can be accessed in minutes to hours, you canchoose to activate additional archiving capabilities.

The S3 Intelligent-Tiering storage class is the ideal storage classfor data with unknown, changing, or unpredictable access patterns,independent of object size or retention period. If the size of anobject is less than 128 KB, it is not monitored and not eligible forauto-tiering. Smaller objects can be stored, but they are alwayscharged at the Frequent Access tier rates in the S3Intelligent-Tiering storage class.

For more information, seeStorage class for automatically optimizingfrequently and infrequently accessed objects.

Operations related toDeleteBucketIntelligentTieringConfigurationinclude:

• GetBucketIntelligentTieringConfiguration

• PutBucketIntelligentTieringConfiguration

• ListBucketIntelligentTieringConfigurations

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Request syntax with placeholder values

resp=client.delete_bucket_intelligent_tiering_configuration({bucket:"BucketName",# requiredid:"IntelligentTieringId",# requiredexpected_bucket_owner:"AccountId",})

This operation is not supported for directory buckets.

Deletes an S3 Inventory configuration (identified by the inventory ID)from the bucket.

To use this operation, you must have permissions to perform thes3:PutInventoryConfiguration action. The bucket owner has thispermission by default. The bucket owner can grant this permission toothers. For more information about permissions, seePermissionsRelated to Bucket Subresource Operations andManaging AccessPermissions to Your Amazon S3 Resources.

For information about the Amazon S3 inventory feature, seeAmazon S3Inventory.

Operations related toDeleteBucketInventoryConfiguration include:

• GetBucketInventoryConfiguration

• PutBucketInventoryConfiguration

• ListBucketInventoryConfigurations

You must URL encode any signed header values that contain spaces. Forexample, if your header value ismy file.txt, containing two spacesaftermy, you must URL encode this value tomy%20%20file.txt.

Examples:

Request syntax with placeholder values

resp=client.delete_bucket_inventory_configuration({bucket:"BucketName",# requiredid:"InventoryId",# requiredexpected_bucket_owner:"AccountId",})