S3 class

Constructors

S3({required String region, AwsClientCredentials? credentials, AwsClientCredentialsProvider? credentialsProvider, Client? client, String? endpointUrl, bool useFipsEndpoint = false, bool useDualStackEndpoint = false, bool forcePathStyle = false, bool? useArnRegion, bool disableMultiRegionAccessPoints = false, bool accelerate = false, bool? disableS3ExpressSessionAuth, bool disableHostPrefix = false}): factory

Properties

hashCode → int: The hash code for this object.
no setterinherited
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited

Methods

abortMultipartUpload({required String bucket, required String key, required String uploadId, String? expectedBucketOwner, DateTime? ifMatchInitiatedTime, RequestPayer? requestPayer}) → Future<AbortMultipartUploadOutput>

This operation aborts a multipart upload. After a multipart upload is aborted, no additional parts can be uploaded using that upload ID. The storage consumed by any previously uploaded parts will be freed. However, if any part uploads are currently in progress, those part uploads might or might not succeed. As a result, it might be necessary to abort a given multipart upload multiple times in order to completely free all storage consumed by all parts.

close() → void

Closes the internal HTTP client if none was provided at creation. If a client was passed as a constructor argument, this becomes a noop.

completeMultipartUpload({required String bucket, required String key, required String uploadId, String? checksumCRC32, String? checksumCRC32C, String? checksumCRC64NVME, String? checksumMD5, String? checksumSHA1, String? checksumSHA256, String? checksumSHA512, ChecksumType? checksumType, String? checksumXXHASH128, String? checksumXXHASH3, String? checksumXXHASH64, String? expectedBucketOwner, String? ifMatch, String? ifNoneMatch, int? mpuObjectSize, CompletedMultipartUpload? multipartUpload, RequestPayer? requestPayer, String? sSECustomerAlgorithm, String? sSECustomerKey, String? sSECustomerKeyMD5}) → Future<CompleteMultipartUploadOutput>

Completes a multipart upload by assembling previously uploaded parts.

copyObject({required String bucket, required String copySource, required String key, ObjectCannedACL? acl, bool? bucketKeyEnabled, String? cacheControl, ChecksumAlgorithm? checksumAlgorithm, String? contentDisposition, String? contentEncoding, String? contentLanguage, String? contentType, String? copySourceIfMatch, DateTime? copySourceIfModifiedSince, String? copySourceIfNoneMatch, DateTime? copySourceIfUnmodifiedSince, String? copySourceSSECustomerAlgorithm, String? copySourceSSECustomerKey, String? copySourceSSECustomerKeyMD5, String? expectedBucketOwner, String? expectedSourceBucketOwner, String? expires, String? grantFullControl, String? grantRead, String? grantReadACP, String? grantWriteACP, String? ifMatch, String? ifNoneMatch, Map<String, String>? metadata, MetadataDirective? metadataDirective, ObjectLockLegalHoldStatus? objectLockLegalHoldStatus, ObjectLockMode? objectLockMode, DateTime? objectLockRetainUntilDate, RequestPayer? requestPayer, String? sSECustomerAlgorithm, String? sSECustomerKey, String? sSECustomerKeyMD5, String? sSEKMSEncryptionContext, String? sSEKMSKeyId, ServerSideEncryption? serverSideEncryption, StorageClass? storageClass, String? tagging, TaggingDirective? taggingDirective, String? websiteRedirectLocation}) → Future<CopyObjectOutput>

Creates a copy of an object that is already stored in Amazon S3.

createBucket({required String bucket, BucketCannedACL? acl, BucketNamespace? bucketNamespace, CreateBucketConfiguration? createBucketConfiguration, String? grantFullControl, String? grantRead, String? grantReadACP, String? grantWrite, String? grantWriteACP, bool? objectLockEnabledForBucket, ObjectOwnership? objectOwnership}) → Future<CreateBucketOutput>

This action creates an Amazon S3 bucket. To create an Amazon S3 on Outposts bucket, see CreateBucket .

createBucketMetadataConfiguration({required String bucket, required MetadataConfiguration metadataConfiguration, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

Creates an S3 Metadata V2 metadata configuration for a general purpose bucket. For more information, see Accelerating data discovery with S3 Metadata in the Amazon S3 User Guide.

createBucketMetadataTableConfiguration({required String bucket, required MetadataTableConfiguration metadataTableConfiguration, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

We recommend that you create your S3 Metadata configurations by using the V2 CreateBucketMetadataConfiguration API operation. We no longer recommend using the V1 CreateBucketMetadataTableConfiguration API operation.

If you created your S3 Metadata configuration before July 15, 2025, we recommend that you delete and re-create your configuration by using CreateBucketMetadataConfiguration so that you can expire journal table records and create a live inventory table. Creates a V1 S3 Metadata configuration for a general purpose bucket. For more information, see Accelerating data discovery with S3 Metadata in the Amazon S3 User Guide.

Permissions

To use this operation, you must have the following permissions. For more information, see Setting up permissions for configuring metadata tables in the Amazon S3 User Guide.

If you want to encrypt your metadata tables with server-side encryption with Key Management Service (KMS) keys (SSE-KMS), you need additional permissions. For more information, see Setting up permissions for configuring metadata tables in the Amazon S3 User Guide.

If you also want to integrate your table bucket with Amazon Web Services analytics services so that you can query your metadata table, you need additional permissions. For more information, see Integrating Amazon S3 Tables with Amazon Web Services analytics services in the Amazon S3 User Guide.

s3:CreateBucketMetadataTableConfiguration
s3tables:CreateNamespace
s3tables:GetTable
s3tables:CreateTable
s3tables:PutTablePolicy

The following operations are related to CreateBucketMetadataTableConfiguration:

Parameter bucket : The general purpose bucket that you want to create the metadata table configuration for.

Parameter metadataTableConfiguration : The contents of your metadata table configuration.

Parameter checksumAlgorithm : The checksum algorithm to use with your metadata table configuration.

Parameter contentMD5 : The Content-MD5 header for the metadata table configuration.

Parameter expectedBucketOwner : The expected owner of the general purpose bucket that corresponds to your metadata table configuration.

createMultipartUpload({required String bucket, required String key, ObjectCannedACL? acl, bool? bucketKeyEnabled, String? cacheControl, ChecksumAlgorithm? checksumAlgorithm, ChecksumType? checksumType, String? contentDisposition, String? contentEncoding, String? contentLanguage, String? contentType, String? expectedBucketOwner, String? expires, String? grantFullControl, String? grantRead, String? grantReadACP, String? grantWriteACP, Map<String, String>? metadata, ObjectLockLegalHoldStatus? objectLockLegalHoldStatus, ObjectLockMode? objectLockMode, DateTime? objectLockRetainUntilDate, RequestPayer? requestPayer, String? sSECustomerAlgorithm, String? sSECustomerKey, String? sSECustomerKeyMD5, String? sSEKMSEncryptionContext, String? sSEKMSKeyId, ServerSideEncryption? serverSideEncryption, StorageClass? storageClass, String? tagging, String? websiteRedirectLocation}) → Future<CreateMultipartUploadOutput>

End of support notice: As of October 1, 2025, Amazon S3 has discontinued support for Email Grantee Access Control Lists (ACLs). If you attempt to use an Email Grantee ACL in a request after October 1, 2025, the request will receive an HTTP 405 (Method Not Allowed) error.

This change affects the following Amazon Web Services Regions: US East (N. Virginia), US West (N. California), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland), and South America (São Paulo). This action initiates a multipart upload and returns an upload ID. This upload ID is used to associate all of the parts in the specific multipart upload. You specify this upload ID in each of your subsequent upload part requests (see UploadPart). You also include this upload ID in the final request to either complete or abort the multipart upload request. For more information about multipart uploads, see Multipart Upload Overview in the Amazon S3 User Guide. If you have configured a lifecycle rule to abort incomplete multipart uploads, the created multipart upload must be completed within the number of days specified in the bucket lifecycle configuration. Otherwise, the incomplete multipart upload becomes eligible for an abort action and Amazon S3 aborts the multipart upload. For more information, see Aborting Incomplete Multipart Uploads Using a Bucket Lifecycle Configuration.

Directory buckets - S3 Lifecycle is not supported by directory buckets.
Directory buckets - For directory buckets, you must make requests for this API operation to the Zonal endpoint. These endpoints support virtual-hosted-style requests in the format https://amzn-s3-demo-bucket.s3express-zone-id.region-code.amazonaws.com/key-name. Path-style requests are not supported. For more information about endpoints in Availability Zones, see Regional and Zonal endpoints for directory buckets in Availability Zones in the Amazon S3 User Guide. For more information about endpoints in Local Zones, see Concepts for directory buckets in Local Zones in the Amazon S3 User Guide.

Request signing

For request signing, multipart upload is just a series of regular requests. You initiate a multipart upload, send one or more requests to upload parts, and then complete the multipart upload process. You sign each request individually. There is nothing special about signing multipart upload requests. For more information about signing, see Authenticating Requests (Amazon Web Services Signature Version 4) in the Amazon S3 User Guide.

Permissions

General purpose bucket permissions - To perform a multipart upload with encryption using an Key Management Service (KMS) KMS key, the requester must have permission to the kms:Decrypt and kms:GenerateDataKey actions on the key. The requester must also have permissions for the kms:GenerateDataKey action for the CreateMultipartUpload API. Then, the requester needs permissions for the kms:Decrypt action on the UploadPart and UploadPartCopy APIs. These permissions are required because Amazon S3 must decrypt and read data from the encrypted file parts before it completes the multipart upload. For more information, see Multipart upload API and permissions and Protecting data using server-side encryption with Amazon Web Services KMS in the Amazon S3 User Guide.
Directory bucket permissions - To grant access to this API operation on a directory bucket, we recommend that you use the CreateSession API operation for session-based authorization. Specifically, you grant the s3express:CreateSession permission to the directory bucket in a bucket policy or an IAM identity-based policy. Then, you make the CreateSession API call on the bucket to obtain a session token. With the session token in your request header, you can make API requests to this operation. After the session token expires, you make another CreateSession API call to generate a new session token for use. Amazon Web Services CLI or SDKs create session and refresh the session token automatically to avoid service interruptions when a session expires. For more information about authorization, see CreateSession .

Encryption

General purpose buckets - Server-side encryption is for data encryption at rest. Amazon S3 encrypts your data as it writes it to disks in its data centers and decrypts it when you access it. Amazon S3 automatically encrypts all new objects that are uploaded to an S3 bucket. When doing a multipart upload, if you don't specify encryption information in your request, the encryption setting of the uploaded parts is set to the default encryption configuration of the destination bucket. By default, all buckets have a base level of encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3). If the destination bucket has a default encryption configuration that uses server-side encryption with an Key Management Service (KMS) key (SSE-KMS), or a customer-provided encryption key (SSE-C), Amazon S3 uses the corresponding KMS key, or a customer-provided key to encrypt the uploaded parts. When you perform a CreateMultipartUpload operation, if you want to use a different type of encryption setting for the uploaded parts, you can request that Amazon S3 encrypts the object with a different encryption key (such as an Amazon S3 managed key, a KMS key, or a customer-provided key). When the encryption setting in your request is different from the default encryption configuration of the destination bucket, the encryption setting in your request takes precedence. If you choose to provide your own encryption key, the request headers you provide in UploadPart and UploadPartCopy requests must match the headers you used in the CreateMultipartUpload request.
- Use KMS keys (SSE-KMS) that include the Amazon Web Services managed key (aws/s3) and KMS customer managed keys stored in Key Management Service (KMS) – If you want Amazon Web Services to manage the keys used to encrypt data, specify the following headers in the request.
  - x-amz-server-side-encryption
  - x-amz-server-side-encryption-aws-kms-key-id
  - x-amz-server-side-encryption-context
  For more information about server-side encryption with KMS keys (SSE-KMS), see Protecting Data Using Server-Side Encryption with KMS keys in the Amazon S3 User Guide.
- Use customer-provided encryption keys (SSE-C) – If you want to manage your own encryption keys, provide all the following headers in the request.
  - x-amz-server-side-encryption-customer-algorithm
  - x-amz-server-side-encryption-customer-key
  - x-amz-server-side-encryption-customer-key-MD5
  For more information about server-side encryption with customer-provided encryption keys (SSE-C), see Protecting data using server-side encryption with customer-provided encryption keys (SSE-C) in the Amazon S3 User Guide.
Directory buckets - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (AES256) and server-side encryption with KMS keys (SSE-KMS) (aws:kms). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your CreateSession requests or PUT object requests. Then, new objects are automatically encrypted with the desired encryption settings. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide. For more information about the encryption overriding behaviors in directory buckets, see Specifying server-side encryption with KMS for new object uploads.
In the Zonal endpoint API calls (except CopyObject and UploadPartCopy) using the REST API, the encryption request headers must match the encryption settings that are specified in the CreateSession request. You can't override the values of the encryption settings (x-amz-server-side-encryption, x-amz-server-side-encryption-aws-kms-key-id, x-amz-server-side-encryption-context, and x-amz-server-side-encryption-bucket-key-enabled) that are specified in the CreateSession request. You don't need to explicitly specify these encryption settings values in Zonal endpoint API calls, and Amazon S3 will use the encryption settings values from the CreateSession request to protect new objects in the directory bucket.

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax is


Bucket-name.s3express-zone-id.region-code.amazonaws.com

The following operations are related to CreateMultipartUpload:

Parameter bucket : The name of the bucket where the multipart upload is initiated and where the object is uploaded.

Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the format Bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the format bucket-base-name--zone-id--x-s3 (for example, amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide.

Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide. S3 on Outposts - When you use this action with S3 on Outposts, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When you use this action with S3 on Outposts, the destination bucket must be the Outposts access point ARN or the access point alias. For more information about S3 on Outposts, see What is S3 on Outposts? in the Amazon S3 User Guide.

Parameter key : Object key for which the multipart upload is to be initiated.

Parameter acl : The canned ACL to apply to the object. Amazon S3 supports a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and permissions. For more information, see Canned ACL in the Amazon S3 User Guide.

By default, all objects are private. Only the owner has full access control. When uploading an object, you can grant access permissions to individual Amazon Web Services accounts or to predefined groups defined by Amazon S3. These permissions are then added to the access control list (ACL) on the new object. For more information, see Using ACLs. One way to grant the permissions using the request headers is to specify a canned ACL with the x-amz-acl request header.

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter bucketKeyEnabled : Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Key Management Service (KMS) keys (SSE-KMS).

General purpose buckets - Setting this header to true causes Amazon S3 to use an S3 Bucket Key for object encryption with SSE-KMS. Also, specifying this header with a PUT action doesn't affect bucket-level settings for S3 Bucket Key.

Directory buckets - S3 Bucket Keys are always enabled for GET and PUT operations in a directory bucket and can’t be disabled. S3 Bucket Keys aren't supported, when you copy SSE-KMS encrypted objects from general purpose buckets to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through CopyObject, UploadPartCopy, the Copy operation in Batch Operations, or the import jobs. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.

Parameter cacheControl : Specifies caching behavior along the request/reply chain.

Parameter checksumAlgorithm : Indicates the algorithm that you want Amazon S3 to use to create the checksum for the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumType : Indicates the checksum type that you want Amazon S3 to use to calculate the object’s checksum value. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter contentDisposition : Specifies presentational information for the object.

Parameter contentLanguage : The language that the content is in.

Parameter contentType : A standard MIME type describing the format of the object data.

Parameter expectedBucketOwner : The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).

Parameter expires : The date and time at which the object is no longer cacheable.

Parameter grantFullControl : Specify access permissions explicitly to give the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.

By default, all objects are private. Only the owner has full access control. When uploading an object, you can use this header to explicitly grant access permissions to specific Amazon Web Services accounts or groups. This header maps to specific permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview in the Amazon S3 User Guide.

You specify each grantee as a type=value pair, where the type is one of the following:

id – if the value specified is the canonical user ID of an Amazon Web Services account
uri – if you are granting permissions to a predefined group
emailAddress – if the value specified is the email address of an Amazon Web Services account

For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:

x-amz-grant-read: id="11112222333", id="444455556666"

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter grantRead : Specify access permissions explicitly to allow grantee to read the object data and its metadata.

You specify each grantee as a type=value pair, where the type is one of the following:

id – if the value specified is the canonical user ID of an Amazon Web Services account
uri – if you are granting permissions to a predefined group
emailAddress – if the value specified is the email address of an Amazon Web Services account

For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:

x-amz-grant-read: id="11112222333", id="444455556666"

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter grantReadACP : Specify access permissions explicitly to allows grantee to read the object ACL.

You specify each grantee as a type=value pair, where the type is one of the following:

id – if the value specified is the canonical user ID of an Amazon Web Services account
uri – if you are granting permissions to a predefined group
emailAddress – if the value specified is the email address of an Amazon Web Services account

For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:

x-amz-grant-read: id="11112222333", id="444455556666"

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter grantWriteACP : Specify access permissions explicitly to allows grantee to allow grantee to write the ACL for the applicable object.

You specify each grantee as a type=value pair, where the type is one of the following:

id – if the value specified is the canonical user ID of an Amazon Web Services account
uri – if you are granting permissions to a predefined group
emailAddress – if the value specified is the email address of an Amazon Web Services account

For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:

x-amz-grant-read: id="11112222333", id="444455556666"

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter metadata : A map of metadata to store with the object in S3.

Parameter objectLockLegalHoldStatus : Specifies whether you want to apply a legal hold to the uploaded object.

Parameter objectLockMode : Specifies the Object Lock mode that you want to apply to the uploaded object.

Parameter objectLockRetainUntilDate : Specifies the date and time when you want the Object Lock to expire.

Parameter sSECustomerAlgorithm : Specifies the algorithm to use when encrypting the object (for example, AES256).

Parameter sSECustomerKey : Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded; Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.

Parameter sSECustomerKeyMD5 : Specifies the 128-bit MD5 digest of the customer-provided encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.

Parameter sSEKMSEncryptionContext : Specifies the Amazon Web Services KMS Encryption Context to use for object encryption. The value of this header is a Base64 encoded string of a UTF-8 encoded JSON, which contains the encryption context as key-value pairs.

Directory buckets - You can optionally provide an explicit encryption context value. The value must match the default encryption context - the bucket Amazon Resource Name (ARN). An additional encryption context value is not supported.

Parameter sSEKMSKeyId : Specifies the KMS key ID (Key ID, Key ARN, or Key Alias) to use for object encryption. If the KMS key doesn't exist in the same account that's issuing the command, you must use the full Key ARN not the Key ID.

General purpose buckets - If you specify x-amz-server-side-encryption with aws:kms or aws:kms:dsse, this header specifies the ID (Key ID, Key ARN, or Key Alias) of the KMS key to use. If you specify x-amz-server-side-encryption:aws:kms or x-amz-server-side-encryption:aws:kms:dsse, but do not provide x-amz-server-side-encryption-aws-kms-key-id, Amazon S3 uses the Amazon Web Services managed key (aws/s3) to protect the data.

Directory buckets - To encrypt data using SSE-KMS, it's recommended to specify the x-amz-server-side-encryption header to aws:kms. Then, the x-amz-server-side-encryption-aws-kms-key-id header implicitly uses the bucket's default KMS customer managed key ID. If you want to explicitly set the x-amz-server-side-encryption-aws-kms-key-id header, it must match the bucket's default customer managed key (using key ID or ARN, not alias). Your SSE-KMS configuration can only support 1 customer managed key per directory bucket's lifetime. The Amazon Web Services managed key (aws/s3) isn't supported. Incorrect key specification results in an HTTP 400 Bad Request error.

Parameter serverSideEncryption : The server-side encryption algorithm used when you store this object in Amazon S3 or Amazon FSx.

Directory buckets - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (AES256) and server-side encryption with KMS keys (SSE-KMS) (aws:kms). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your CreateSession requests or PUT object requests. Then, new objects are automatically encrypted with the desired encryption settings. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide. For more information about the encryption overriding behaviors in directory buckets, see Specifying server-side encryption with KMS for new object uploads.
In the Zonal endpoint API calls (except CopyObject and UploadPartCopy) using the REST API, the encryption request headers must match the encryption settings that are specified in the CreateSession request. You can't override the values of the encryption settings (x-amz-server-side-encryption, x-amz-server-side-encryption-aws-kms-key-id, x-amz-server-side-encryption-context, and x-amz-server-side-encryption-bucket-key-enabled) that are specified in the CreateSession request. You don't need to explicitly specify these encryption settings values in Zonal endpoint API calls, and Amazon S3 will use the encryption settings values from the CreateSession request to protect new objects in the directory bucket.

S3 access points for Amazon FSx - When accessing data stored in Amazon FSx file systems using S3 access points, the only valid server side encryption option is aws:fsx. All Amazon FSx file systems have encryption configured by default and are encrypted at rest. Data is automatically encrypted before being written to the file system, and automatically decrypted as it is read. These processes are handled transparently by Amazon FSx.

Parameter storageClass : By default, Amazon S3 uses the STANDARD Storage Class to store newly created objects. The STANDARD storage class provides high durability and high availability. Depending on performance needs, you can specify a different Storage Class. For more information, see Storage Classes in the Amazon S3 User Guide.

Directory buckets only support EXPRESS_ONEZONE (the S3 Express One Zone storage class) in Availability Zones and ONEZONE_IA (the S3 One Zone-Infrequent Access storage class) in Dedicated Local Zones.
Amazon S3 on Outposts only uses the OUTPOSTS Storage Class.

Parameter tagging : The tag-set for the object. The tag-set must be encoded as URL Query parameters.

Parameter websiteRedirectLocation : If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata.

createSession({required String bucket, bool? bucketKeyEnabled, String? sSEKMSEncryptionContext, String? sSEKMSKeyId, ServerSideEncryption? serverSideEncryption, SessionMode? sessionMode}) → Future<CreateSessionOutput>

Creates a session that establishes temporary security credentials to support fast authentication and authorization for the Zonal endpoint API operations on directory buckets. For more information about Zonal endpoint API operations that include the Availability Zone in the request endpoint, see S3 Express One Zone APIs in the Amazon S3 User Guide.

deleteBucket({required String bucket, String? expectedBucketOwner}) → Future<void>

Deletes the S3 bucket. All objects (including all object versions and delete markers) in the bucket must be deleted before the bucket itself can be deleted.

deleteBucketAnalyticsConfiguration({required String bucket, required String id, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

deleteBucketCors({required String bucket, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

deleteBucketEncryption({required String bucket, String? expectedBucketOwner}) → Future<void>

This implementation of the DELETE action resets the default encryption for the bucket as server-side encryption with Amazon S3 managed keys (SSE-S3).

deleteBucketIntelligentTieringConfiguration({required String bucket, required String id, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

deleteBucketInventoryConfiguration({required String bucket, required String id, String? expectedBucketOwner}) → Future<void>

Deletes an S3 Inventory configuration (identified by the inventory ID) from the bucket.

deleteBucketLifecycle({required String bucket, String? expectedBucketOwner}) → Future<void>

Deletes the lifecycle configuration from the specified bucket. Amazon S3 removes all the lifecycle configuration rules in the lifecycle subresource associated with the bucket. Your objects never expire, and Amazon S3 no longer automatically deletes any objects on the basis of rules contained in the deleted lifecycle configuration.

deleteBucketMetadataConfiguration({required String bucket, String? expectedBucketOwner}) → Future<void>

Deletes an S3 Metadata configuration from a general purpose bucket. For more information, see Accelerating data discovery with S3 Metadata in the Amazon S3 User Guide.

deleteBucketMetadataTableConfiguration({required String bucket, String? expectedBucketOwner}) → Future<void>

We recommend that you delete your S3 Metadata configurations by using the V2 DeleteBucketMetadataTableConfiguration API operation. We no longer recommend using the V1 DeleteBucketMetadataTableConfiguration API operation.

If you created your S3 Metadata configuration before July 15, 2025, we recommend that you delete and re-create your configuration by using CreateBucketMetadataConfiguration so that you can expire journal table records and create a live inventory table. Deletes a V1 S3 Metadata configuration from a general purpose bucket. For more information, see Accelerating data discovery with S3 Metadata in the Amazon S3 User Guide.

Make sure that you update your processes to use the new V2 API operations (CreateBucketMetadataConfiguration, GetBucketMetadataConfiguration, and DeleteBucketMetadataConfiguration) instead of the V1 API operations.

Permissions: To use this operation, you must have the s3:DeleteBucketMetadataTableConfiguration permission. For more information, see Setting up permissions for configuring metadata tables in the Amazon S3 User Guide.

The following operations are related to DeleteBucketMetadataTableConfiguration:

Parameter bucket : The general purpose bucket that you want to remove the metadata table configuration from.

Parameter expectedBucketOwner : The expected bucket owner of the general purpose bucket that you want to remove the metadata table configuration from.

deleteBucketMetricsConfiguration({required String bucket, required String id, String? expectedBucketOwner}) → Future<void>

Deletes a metrics configuration for the Amazon CloudWatch request metrics (specified by the metrics configuration ID) from the bucket. Note that this doesn't include the daily storage metrics.

deleteBucketOwnershipControls({required String bucket, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

deleteBucketPolicy({required String bucket, String? expectedBucketOwner}) → Future<void>

Deletes the policy of a specified bucket.

deleteBucketReplication({required String bucket, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

deleteBucketTagging({required String bucket, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

deleteBucketWebsite({required String bucket, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

deleteObject({required String bucket, required String key, bool? bypassGovernanceRetention, String? expectedBucketOwner, String? ifMatch, DateTime? ifMatchLastModifiedTime, int? ifMatchSize, String? mfa, RequestPayer? requestPayer, String? versionId}) → Future<DeleteObjectOutput>

Removes an object from a bucket. The behavior depends on the bucket's versioning state:

deleteObjects({required String bucket, required Delete delete, bool? bypassGovernanceRetention, ChecksumAlgorithm? checksumAlgorithm, String? expectedBucketOwner, String? mfa, RequestPayer? requestPayer}) → Future<DeleteObjectsOutput>

This operation enables you to delete multiple objects from a bucket using a single HTTP request. If you know the object keys that you want to delete, then this operation provides a suitable alternative to sending individual delete requests, reducing per-request overhead.

deleteObjectTagging({required String bucket, required String key, String? expectedBucketOwner, String? versionId}) → Future<DeleteObjectTaggingOutput>

This operation is not supported for directory buckets.

deletePublicAccessBlock({required String bucket, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

getBucketAbac({required String bucket, String? expectedBucketOwner}) → Future<GetBucketAbacOutput>

Returns the attribute-based access control (ABAC) property of the general purpose bucket. If ABAC is enabled on your bucket, you can use tags on the bucket for access control. For more information, see Enabling ABAC in general purpose buckets.

getBucketAccelerateConfiguration({required String bucket, String? expectedBucketOwner, RequestPayer? requestPayer}) → Future<GetBucketAccelerateConfigurationOutput>

This operation is not supported for directory buckets.

getBucketAcl({required String bucket, String? expectedBucketOwner}) → Future<GetBucketAclOutput>

This operation is not supported for directory buckets.

getBucketAnalyticsConfiguration({required String bucket, required String id, String? expectedBucketOwner}) → Future<GetBucketAnalyticsConfigurationOutput>

This operation is not supported for directory buckets.

getBucketCors({required String bucket, String? expectedBucketOwner}) → Future<GetBucketCorsOutput>

This operation is not supported for directory buckets.

getBucketEncryption({required String bucket, String? expectedBucketOwner}) → Future<GetBucketEncryptionOutput>

Returns the default encryption configuration for an Amazon S3 bucket. By default, all buckets have a default encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3). This operation also returns the BucketKeyEnabled and BlockedEncryptionTypes statuses.

getBucketIntelligentTieringConfiguration({required String bucket, required String id, String? expectedBucketOwner}) → Future<GetBucketIntelligentTieringConfigurationOutput>

This operation is not supported for directory buckets.

getBucketInventoryConfiguration({required String bucket, required String id, String? expectedBucketOwner}) → Future<GetBucketInventoryConfigurationOutput>

Returns an S3 Inventory configuration (identified by the inventory configuration ID) from the bucket.

getBucketLifecycleConfiguration({required String bucket, String? expectedBucketOwner}) → Future<GetBucketLifecycleConfigurationOutput>

Returns the lifecycle configuration information set on the bucket. For information about lifecycle configuration, see Object Lifecycle Management.

getBucketLocation({required String bucket, String? expectedBucketOwner}) → Future<GetBucketLocationOutput>

Using the GetBucketLocation operation is no longer a best practice. To return the Region that a bucket resides in, we recommend that you use the HeadBucket operation instead. For backward compatibility, Amazon S3 continues to support the GetBucketLocation operation.

getBucketLogging({required String bucket, String? expectedBucketOwner}) → Future<GetBucketLoggingOutput>

This operation is not supported for directory buckets.

getBucketMetadataConfiguration({required String bucket, String? expectedBucketOwner}) → Future<GetBucketMetadataConfigurationOutput>

Retrieves the S3 Metadata configuration for a general purpose bucket. For more information, see Accelerating data discovery with S3 Metadata in the Amazon S3 User Guide.

getBucketMetadataTableConfiguration({required String bucket, String? expectedBucketOwner}) → Future<GetBucketMetadataTableConfigurationOutput>

We recommend that you retrieve your S3 Metadata configurations by using the V2 GetBucketMetadataTableConfiguration API operation. We no longer recommend using the V1 GetBucketMetadataTableConfiguration API operation.

If you created your S3 Metadata configuration before July 15, 2025, we recommend that you delete and re-create your configuration by using CreateBucketMetadataConfiguration so that you can expire journal table records and create a live inventory table. Retrieves the V1 S3 Metadata configuration for a general purpose bucket. For more information, see Accelerating data discovery with S3 Metadata in the Amazon S3 User Guide.

Permissions: To use this operation, you must have the s3:GetBucketMetadataTableConfiguration permission. For more information, see Setting up permissions for configuring metadata tables in the Amazon S3 User Guide.

The following operations are related to GetBucketMetadataTableConfiguration:

Parameter bucket : The general purpose bucket that corresponds to the metadata table configuration that you want to retrieve.

Parameter expectedBucketOwner : The expected owner of the general purpose bucket that you want to retrieve the metadata table configuration for.

getBucketMetricsConfiguration({required String bucket, required String id, String? expectedBucketOwner}) → Future<GetBucketMetricsConfigurationOutput>

Gets a metrics configuration (specified by the metrics configuration ID) from the bucket. Note that this doesn't include the daily storage metrics.

getBucketNotificationConfiguration({required String bucket, String? expectedBucketOwner}) → Future<NotificationConfiguration>

This operation is not supported for directory buckets.

getBucketOwnershipControls({required String bucket, String? expectedBucketOwner}) → Future<GetBucketOwnershipControlsOutput>

This operation is not supported for directory buckets.

getBucketPolicy({required String bucket, String? expectedBucketOwner}) → Future<GetBucketPolicyOutput>

Returns the policy of a specified bucket.

getBucketPolicyStatus({required String bucket, String? expectedBucketOwner}) → Future<GetBucketPolicyStatusOutput>

This operation is not supported for directory buckets.

getBucketReplication({required String bucket, String? expectedBucketOwner}) → Future<GetBucketReplicationOutput>

This operation is not supported for directory buckets.

getBucketRequestPayment({required String bucket, String? expectedBucketOwner}) → Future<GetBucketRequestPaymentOutput>

This operation is not supported for directory buckets.

getBucketTagging({required String bucket, String? expectedBucketOwner}) → Future<GetBucketTaggingOutput>

This operation is not supported for directory buckets.

getBucketVersioning({required String bucket, String? expectedBucketOwner}) → Future<GetBucketVersioningOutput>

This operation is not supported for directory buckets.

getBucketWebsite({required String bucket, String? expectedBucketOwner}) → Future<GetBucketWebsiteOutput>

This operation is not supported for directory buckets.

getObject({required String bucket, required String key, ChecksumMode? checksumMode, String? expectedBucketOwner, String? ifMatch, DateTime? ifModifiedSince, String? ifNoneMatch, DateTime? ifUnmodifiedSince, int? partNumber, String? range, RequestPayer? requestPayer, String? responseCacheControl, String? responseContentDisposition, String? responseContentEncoding, String? responseContentLanguage, String? responseContentType, DateTime? responseExpires, String? sSECustomerAlgorithm, String? sSECustomerKey, String? sSECustomerKeyMD5, String? versionId}) → Future<GetObjectOutput>

Retrieves an object from Amazon S3.

getObjectAcl({required String bucket, required String key, String? expectedBucketOwner, RequestPayer? requestPayer, String? versionId}) → Future<GetObjectAclOutput>

This operation is not supported for directory buckets.

getObjectAttributes({required String bucket, required String key, required List<ObjectAttributes> objectAttributes, String? expectedBucketOwner, int? maxParts, String? partNumberMarker, RequestPayer? requestPayer, String? sSECustomerAlgorithm, String? sSECustomerKey, String? sSECustomerKeyMD5, String? versionId}) → Future<GetObjectAttributesOutput>

Retrieves all of the metadata from an object without returning the object itself. This operation is useful if you're interested only in an object's metadata.

getObjectLegalHold({required String bucket, required String key, String? expectedBucketOwner, RequestPayer? requestPayer, String? versionId}) → Future<GetObjectLegalHoldOutput>

This operation is not supported for directory buckets.

getObjectLockConfiguration({required String bucket, String? expectedBucketOwner}) → Future<GetObjectLockConfigurationOutput>

This operation is not supported for directory buckets.

getObjectRetention({required String bucket, required String key, String? expectedBucketOwner, RequestPayer? requestPayer, String? versionId}) → Future<GetObjectRetentionOutput>

This operation is not supported for directory buckets.

getObjectTagging({required String bucket, required String key, String? expectedBucketOwner, RequestPayer? requestPayer, String? versionId}) → Future<GetObjectTaggingOutput>

This operation is not supported for directory buckets.

getObjectTorrent({required String bucket, required String key, String? expectedBucketOwner, RequestPayer? requestPayer}) → Future<GetObjectTorrentOutput>

This operation is not supported for directory buckets.

getPublicAccessBlock({required String bucket, String? expectedBucketOwner}) → Future<GetPublicAccessBlockOutput>

This operation is not supported for directory buckets.

headBucket({required String bucket, String? expectedBucketOwner}) → Future<HeadBucketOutput>

You can use this operation to determine if a bucket exists and if you have permission to access it. The action returns a 200 OK HTTP status code if the bucket exists and you have permission to access it. You can make a HeadBucket call on any bucket name to any Region in the partition, and regardless of the permissions on the bucket, you will receive a response header with the correct bucket location so that you can then make a proper, signed request to the appropriate Regional endpoint.

headObject({required String bucket, required String key, ChecksumMode? checksumMode, String? expectedBucketOwner, String? ifMatch, DateTime? ifModifiedSince, String? ifNoneMatch, DateTime? ifUnmodifiedSince, int? partNumber, String? range, RequestPayer? requestPayer, String? responseCacheControl, String? responseContentDisposition, String? responseContentEncoding, String? responseContentLanguage, String? responseContentType, DateTime? responseExpires, String? sSECustomerAlgorithm, String? sSECustomerKey, String? sSECustomerKeyMD5, String? versionId}) → Future<HeadObjectOutput>

The HEAD operation retrieves metadata from an object without returning the object itself. This operation is useful if you're interested only in an object's metadata. Request headers are limited to 8 KB in size. For more information, see Common Request Headers.

listBucketAnalyticsConfigurations({required String bucket, String? continuationToken, String? expectedBucketOwner}) → Future<ListBucketAnalyticsConfigurationsOutput>

This operation is not supported for directory buckets.

listBucketIntelligentTieringConfigurations({required String bucket, String? continuationToken, String? expectedBucketOwner}) → Future<ListBucketIntelligentTieringConfigurationsOutput>

This operation is not supported for directory buckets.

listBucketInventoryConfigurations({required String bucket, String? continuationToken, String? expectedBucketOwner}) → Future<ListBucketInventoryConfigurationsOutput>

Returns a list of S3 Inventory configurations for the bucket. You can have up to 1,000 inventory configurations per bucket.

listBucketMetricsConfigurations({required String bucket, String? continuationToken, String? expectedBucketOwner}) → Future<ListBucketMetricsConfigurationsOutput>

Lists the metrics configurations for the bucket. The metrics configurations are only for the request metrics of the bucket and do not provide information on daily storage metrics. You can have up to 1,000 configurations per bucket. This action supports list pagination and does not return more than 100 configurations at a time. Always check the IsTruncated element in the response. If there are no more configurations to list, IsTruncated is set to false. If there are more configurations to list, IsTruncated is set to true, and there is a value in NextContinuationToken. You use the NextContinuationToken value to continue the pagination of the list by passing the value in continuation-token in the request to GET the next page.

listBuckets({String? bucketRegion, String? continuationToken, int? maxBuckets, String? prefix}) → Future<ListBucketsOutput>

This operation is not supported for directory buckets.

listDirectoryBuckets({String? continuationToken, int? maxDirectoryBuckets}) → Future<ListDirectoryBucketsOutput>

Returns a list of all Amazon S3 directory buckets owned by the authenticated sender of the request. For more information about directory buckets, see Directory buckets in the Amazon S3 User Guide.

listMultipartUploads({required String bucket, String? delimiter, EncodingType? encodingType, String? expectedBucketOwner, String? keyMarker, int? maxUploads, String? prefix, RequestPayer? requestPayer, String? uploadIdMarker}) → Future<ListMultipartUploadsOutput>

This operation lists in-progress multipart uploads in a bucket. An in-progress multipart upload is a multipart upload that has been initiated by the CreateMultipartUpload request, but has not yet been completed or aborted. The ListMultipartUploads operation returns a maximum of 1,000 multipart uploads in the response. The limit of 1,000 multipart uploads is also the default value. You can further limit the number of uploads in a response by specifying the max-uploads request parameter. If there are more than 1,000 multipart uploads that satisfy your ListMultipartUploads request, the response returns an IsTruncated element with the value of true, a NextKeyMarker element, and a NextUploadIdMarker element. To list the remaining multipart uploads, you need to make subsequent ListMultipartUploads requests. In these requests, include two query parameters: key-marker and upload-id-marker. Set the value of key-marker to the NextKeyMarker value from the previous response. Similarly, set the value of upload-id-marker to the NextUploadIdMarker value from the previous response. For more information about multipart uploads, see Uploading Objects Using Multipart Upload in the Amazon S3 User Guide.

listObjects({required String bucket, String? delimiter, EncodingType? encodingType, String? expectedBucketOwner, String? marker, int? maxKeys, List<OptionalObjectAttributes>? optionalObjectAttributes, String? prefix, RequestPayer? requestPayer}) → Future<ListObjectsOutput>

This operation is not supported for directory buckets.

listObjectsV2({required String bucket, String? continuationToken, String? delimiter, EncodingType? encodingType, String? expectedBucketOwner, bool? fetchOwner, int? maxKeys, List<OptionalObjectAttributes>? optionalObjectAttributes, String? prefix, RequestPayer? requestPayer, String? startAfter}) → Future<ListObjectsV2Output>

Returns some or all (up to 1,000) of the objects in a bucket with each request. You can use the request parameters as selection criteria to return a subset of the objects in a bucket. A 200 OK response can contain valid or invalid XML. Make sure to design your application to parse the contents of the response and handle it appropriately. For more information about listing objects, see Listing object keys programmatically in the Amazon S3 User Guide. To get a list of your buckets, see ListBuckets.

listObjectVersions({required String bucket, String? delimiter, EncodingType? encodingType, String? expectedBucketOwner, String? keyMarker, int? maxKeys, List<OptionalObjectAttributes>? optionalObjectAttributes, String? prefix, RequestPayer? requestPayer, String? versionIdMarker}) → Future<ListObjectVersionsOutput>

This operation is not supported for directory buckets.

listParts({required String bucket, required String key, required String uploadId, String? expectedBucketOwner, int? maxParts, String? partNumberMarker, RequestPayer? requestPayer, String? sSECustomerAlgorithm, String? sSECustomerKey, String? sSECustomerKeyMD5}) → Future<ListPartsOutput>

Lists the parts that have been uploaded for a specific multipart upload.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

putBucketAbac({required AbacStatus abacStatus, required String bucket, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

Sets the attribute-based access control (ABAC) property of the general purpose bucket. You must have s3:PutBucketABAC permission to perform this action. When you enable ABAC, you can use tags for access control on your buckets. Additionally, when ABAC is enabled, you must use the TagResource and UntagResource actions to manage tags on your buckets. You can nolonger use the PutBucketTagging and DeleteBucketTagging actions to tag your bucket. For more information, see Enabling ABAC in general purpose buckets.

putBucketAccelerateConfiguration({required AccelerateConfiguration accelerateConfiguration, required String bucket, ChecksumAlgorithm? checksumAlgorithm, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

putBucketAcl({required String bucket, BucketCannedACL? acl, AccessControlPolicy? accessControlPolicy, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner, String? grantFullControl, String? grantRead, String? grantReadACP, String? grantWrite, String? grantWriteACP}) → Future<void>

This change affects the following Amazon Web Services Regions: US East (N. Virginia), US West (N. California), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland), and South America (São Paulo). Sets the permissions on an existing bucket using access control lists (ACL). For more information, see Using ACLs. To set the ACL of a bucket, you must have the WRITE_ACP permission.

You can use one of the following two ways to set a bucket's permissions:

Specify the ACL in the request body
Specify permissions using request headers

Depending on your application needs, you may choose to set the ACL on a bucket using either the request body or the headers. For example, if you have an existing application that updates a bucket ACL using the request body, then you can continue to use that approach.

Permissions

You can set access permissions by using one of the following methods:

Specify a canned ACL with the x-amz-acl request header. Amazon S3 supports a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and permissions. Specify the canned ACL name as the value of x-amz-acl. If you use this header, you cannot use other access control-specific headers in your request. For more information, see Canned ACL.
Specify access permissions explicitly with the x-amz-grant-read, x-amz-grant-read-acp, x-amz-grant-write-acp, and x-amz-grant-full-control headers. When using these headers, you specify explicit access permissions and grantees (Amazon Web Services accounts or Amazon S3 groups) who will receive the permission. If you use these ACL-specific headers, you cannot use the x-amz-acl header to set a canned ACL. These parameters map to the set of permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview.
You specify each grantee as a type=value pair, where the type is one of the following:
- id – if the value specified is the canonical user ID of an Amazon Web Services account
- uri – if you are granting permissions to a predefined group
- emailAddress – if the value specified is the email address of an Amazon Web Services account
For example, the following x-amz-grant-write header grants create, overwrite, and delete objects permission to LogDelivery group predefined by Amazon S3 and two Amazon Web Services accounts identified by their email addresses.
x-amz-grant-write: uri="http://acs.amazonaws.com/groups/s3/LogDelivery", id="111122223333", id="555566667777"

You can use either a canned ACL or specify access permissions explicitly. You cannot do both.

Grantee Values

You can specify the person (grantee) to whom you're assigning access rights (using request elements) in the following ways. For examples of how to specify these grantee values in JSON format, see the Amazon Web Services CLI example in Enabling Amazon S3 server access logging in the Amazon S3 User Guide.

By the person's ID:

DisplayName is optional and ignored in the request
By URI:
By Email address:

The grantee is resolved to the CanonicalUser and, in a response to a GET Object acl request, appears as the CanonicalUser.
- US East (N. Virginia)
- US West (N. California)
- US West (Oregon)
- Asia Pacific (Singapore)
- Asia Pacific (Sydney)
- Asia Pacific (Tokyo)
- Europe (Ireland)
- South America (São Paulo)
For a list of all the Amazon S3 supported Regions and endpoints, see Regions and Endpoints in the Amazon Web Services General Reference.

The following operations are related to PutBucketAcl:

Parameter bucket : The bucket to which to apply the ACL.

Parameter acl : The canned ACL to apply to the bucket.

Parameter accessControlPolicy : Contains the elements that set the ACL permissions for an object per grantee.

Parameter checksumAlgorithm : Indicates the algorithm used to create the checksum for the request when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request. For more information, see Checking object integrity in the Amazon S3 User Guide.

If you provide an individual checksum, Amazon S3 ignores any provided ChecksumAlgorithm parameter.

Parameter contentMD5 : The Base64 encoded 128-bit MD5 digest of the data. This header must be used as a message integrity check to verify that the request body was not corrupted in transit. For more information, go to RFC 1864.

For requests made using the Amazon Web Services Command Line Interface (CLI) or Amazon Web Services SDKs, this field is calculated automatically.

Parameter grantFullControl : Allows grantee the read, write, read ACP, and write ACP permissions on the bucket.

Parameter grantRead : Allows grantee to list the objects in the bucket.

Parameter grantReadACP : Allows grantee to read the bucket ACL.

Parameter grantWrite : Allows grantee to create new objects in the bucket.

For the bucket and object owners of existing objects, also allows deletions and overwrites of those objects.

Parameter grantWriteACP : Allows grantee to write the ACL for the applicable bucket.

putBucketAnalyticsConfiguration({required AnalyticsConfiguration analyticsConfiguration, required String bucket, required String id, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

putBucketCors({required String bucket, required CORSConfiguration cORSConfiguration, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

putBucketEncryption({required String bucket, required ServerSideEncryptionConfiguration serverSideEncryptionConfiguration, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

This operation configures default encryption and Amazon S3 Bucket Keys for an existing bucket. You can also block encryption types using this operation. By default, all buckets have a default encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3).

putBucketIntelligentTieringConfiguration({required String bucket, required String id, required IntelligentTieringConfiguration intelligentTieringConfiguration, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

putBucketInventoryConfiguration({required String bucket, required String id, required InventoryConfiguration inventoryConfiguration, String? expectedBucketOwner}) → Future<void>

This implementation of the PUT action adds an S3 Inventory configuration (identified by the inventory ID) to the bucket. You can have up to 1,000 inventory configurations per bucket.

putBucketLifecycleConfiguration({required String bucket, ChecksumAlgorithm? checksumAlgorithm, String? expectedBucketOwner, BucketLifecycleConfiguration? lifecycleConfiguration, TransitionDefaultMinimumObjectSize? transitionDefaultMinimumObjectSize}) → Future<PutBucketLifecycleConfigurationOutput>

Creates a new lifecycle configuration for the bucket or replaces an existing lifecycle configuration. Keep in mind that this will overwrite an existing lifecycle configuration, so if you want to retain any configuration details, they must be included in the new lifecycle configuration. For information about lifecycle configuration, see Managing your storage lifecycle.

putBucketLogging({required String bucket, required BucketLoggingStatus bucketLoggingStatus, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

This change affects the following Amazon Web Services Regions: US East (N. Virginia), US West (N. California), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland), and South America (São Paulo). Set the logging parameters for a bucket and to specify permissions for who can view and modify the logging parameters. All logs are saved to buckets in the same Amazon Web Services Region as the source bucket. To set the logging status of a bucket, you must be the bucket owner.

The bucket owner is automatically granted FULL_CONTROL to all logs. You use the Grantee request element to grant access to other people. The Permissions request element specifies the kind of access the grantee has to the logs.

Grantee Values

You can specify the person (grantee) to whom you're assigning access rights (by using request elements) in the following ways. For examples of how to specify these grantee values in JSON format, see the Amazon Web Services CLI example in Enabling Amazon S3 server access logging in the Amazon S3 User Guide.

By the person's ID:

DisplayName is optional and ignored in the request.
By Email address:

The grantee is resolved to the CanonicalUser and, in a response to a GETObjectAcl request, appears as the CanonicalUser.
By URI:

To enable logging, you use LoggingEnabled and its children request elements. To disable logging, you use an empty BucketLoggingStatus request element:

For more information about server access logging, see Server Access Logging in the Amazon S3 User Guide.

For more information about creating a bucket, see CreateBucket. For more information about returning the logging status of a bucket, see GetBucketLogging.

The following operations are related to PutBucketLogging:

Parameter bucket : The name of the bucket for which to set the logging parameters.

Parameter bucketLoggingStatus : Container for logging status information.

If you provide an individual checksum, Amazon S3 ignores any provided ChecksumAlgorithm parameter.

Parameter contentMD5 : The MD5 hash of the PutBucketLogging request body.

For requests made using the Amazon Web Services Command Line Interface (CLI) or Amazon Web Services SDKs, this field is calculated automatically.

putBucketMetricsConfiguration({required String bucket, required String id, required MetricsConfiguration metricsConfiguration, String? expectedBucketOwner}) → Future<void>

Sets a metrics configuration (specified by the metrics configuration ID) for the bucket. You can have up to 1,000 metrics configurations per bucket. If you're updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don't include the elements you want to keep, they are erased.

putBucketNotificationConfiguration({required String bucket, required NotificationConfiguration notificationConfiguration, String? expectedBucketOwner, bool? skipDestinationValidation}) → Future<void>

This operation is not supported for directory buckets.

putBucketOwnershipControls({required String bucket, required OwnershipControls ownershipControls, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

putBucketPolicy({required String bucket, required String policy, ChecksumAlgorithm? checksumAlgorithm, bool? confirmRemoveSelfBucketAccess, String? contentMD5, String? expectedBucketOwner}) → Future<void>

Applies an Amazon S3 bucket policy to an Amazon S3 bucket.

putBucketReplication({required String bucket, required ReplicationConfiguration replicationConfiguration, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner, String? token}) → Future<void>

This operation is not supported for directory buckets.

putBucketRequestPayment({required String bucket, required RequestPaymentConfiguration requestPaymentConfiguration, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

putBucketTagging({required String bucket, required Tagging tagging, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

putBucketVersioning({required String bucket, required VersioningConfiguration versioningConfiguration, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner, String? mfa}) → Future<void>

This operation is not supported for directory buckets.

putBucketWebsite({required String bucket, required WebsiteConfiguration websiteConfiguration, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner}) → Future<void>

This operation is not supported for directory buckets.

putObject({required String bucket, required String key, ObjectCannedACL? acl, Uint8List? body, bool? bucketKeyEnabled, String? cacheControl, ChecksumAlgorithm? checksumAlgorithm, String? checksumCRC32, String? checksumCRC32C, String? checksumCRC64NVME, String? checksumMD5, String? checksumSHA1, String? checksumSHA256, String? checksumSHA512, String? checksumXXHASH128, String? checksumXXHASH3, String? checksumXXHASH64, String? contentDisposition, String? contentEncoding, String? contentLanguage, int? contentLength, String? contentMD5, String? contentType, String? expectedBucketOwner, String? expires, String? grantFullControl, String? grantRead, String? grantReadACP, String? grantWriteACP, String? ifMatch, String? ifNoneMatch, Map<String, String>? metadata, ObjectLockLegalHoldStatus? objectLockLegalHoldStatus, ObjectLockMode? objectLockMode, DateTime? objectLockRetainUntilDate, RequestPayer? requestPayer, String? sSECustomerAlgorithm, String? sSECustomerKey, String? sSECustomerKeyMD5, String? sSEKMSEncryptionContext, String? sSEKMSKeyId, ServerSideEncryption? serverSideEncryption, StorageClass? storageClass, String? tagging, String? websiteRedirectLocation, int? writeOffsetBytes}) → Future<PutObjectOutput>

Amazon S3 never adds partial objects; if you receive a success response, Amazon S3 added the entire object to the bucket. You cannot use PutObject to only update a single piece of metadata for an existing object. You must put the entire object with updated metadata if you want to update some values.
If your bucket uses the bucket owner enforced setting for Object Ownership, ACLs are disabled and no longer affect permissions. All objects written to the bucket by any account will be owned by the bucket owner.
Directory buckets - For directory buckets, you must make requests for this API operation to the Zonal endpoint. These endpoints support virtual-hosted-style requests in the format https://amzn-s3-demo-bucket.s3express-zone-id.region-code.amazonaws.com/key-name. Path-style requests are not supported. For more information about endpoints in Availability Zones, see Regional and Zonal endpoints for directory buckets in Availability Zones in the Amazon S3 User Guide. For more information about endpoints in Local Zones, see Concepts for directory buckets in Local Zones in the Amazon S3 User Guide.

Amazon S3 is a distributed system. If it receives multiple write requests for the same object simultaneously, it overwrites all but the last object written. However, Amazon S3 provides features that can modify this behavior:

S3 Object Lock - To prevent objects from being deleted or overwritten, you can use Amazon S3 Object Lock in the Amazon S3 User Guide.
If-None-Match - Uploads the object only if the object key name does not already exist in the specified bucket. Otherwise, Amazon S3 returns a 412 Precondition Failed error. If a conflicting operation occurs during the upload, S3 returns a 409 ConditionalRequestConflict response. On a 409 failure, retry the upload.
Expects the * character (asterisk).

For more information, see Add preconditions to S3 operations with conditional requests in the Amazon S3 User Guide or RFC 7232.

S3 Versioning - When you enable versioning for a bucket, if Amazon S3 receives multiple write requests for the same object simultaneously, it stores all versions of the objects. For each write request that is made to the same object, Amazon S3 automatically generates a unique version ID of that object being stored in Amazon S3. You can retrieve, replace, or delete any version of the object. For more information about versioning, see Adding Objects to Versioning-Enabled Buckets in the Amazon S3 User Guide. For information about returning the versioning state of a bucket, see GetBucketVersioning.

Permissions

General purpose bucket permissions - The following permissions are required in your policies when your PutObject request includes specific headers.
- s3:PutObject - To successfully complete the PutObject request, you must always have the s3:PutObject permission on a bucket to add an object to it.
- s3:PutObjectAcl - To successfully change the objects ACL of your PutObject request, you must have the s3:PutObjectAcl.
- s3:PutObjectTagging - To successfully set the tag-set with your PutObject request, you must have the s3:PutObjectTagging.
Directory bucket permissions - To grant access to this API operation on a directory bucket, we recommend that you use the CreateSession API operation for session-based authorization. Specifically, you grant the s3express:CreateSession permission to the directory bucket in a bucket policy or an IAM identity-based policy. Then, you make the CreateSession API call on the bucket to obtain a session token. With the session token in your request header, you can make API requests to this operation. After the session token expires, you make another CreateSession API call to generate a new session token for use. Amazon Web Services CLI or SDKs create session and refresh the session token automatically to avoid service interruptions when a session expires. For more information about authorization, see CreateSession .
If the object is encrypted with SSE-KMS, you must also have the kms:GenerateDataKey and kms:Decrypt permissions in IAM identity-based policies and KMS key policies for the KMS key.

Data integrity with Content-MD5

General purpose bucket - To ensure that data is not corrupted traversing the network, use the Content-MD5 header. When you use this header, Amazon S3 checks the object against the provided MD5 value and, if they do not match, Amazon S3 returns an error. Alternatively, when the object's ETag is its MD5 digest, you can calculate the MD5 while putting the object to Amazon S3 and compare the returned ETag to the calculated MD5 value.
Directory bucket - This functionality is not supported for directory buckets.

HTTP Host header syntax

Directory buckets - The HTTP Host header syntax is


Bucket-name.s3express-zone-id.region-code.amazonaws.com

Errors

You might receive an InvalidRequest error for several reasons. Depending on the reason for the error, you might receive one of the following messages:
- Cannot specify both a write offset value and user-defined object metadata for existing objects.
- Checksum Type mismatch occurred, expected checksum Type: sha1, actual checksum Type: crc32c.
- Request body cannot be empty when 'write offset' is specified.

For more information about related Amazon S3 APIs, see the following:

May throw EncryptionTypeMismatch. May throw InvalidRequest. May throw InvalidWriteOffset. May throw TooManyParts.

Parameter bucket : The bucket name to which the PUT action was initiated.

Parameter key : Object key for which the PUT action was initiated.

Parameter acl : The canned ACL to apply to the object. For more information, see Canned ACL in the Amazon S3 User Guide.

When adding a new object, you can use headers to grant ACL-based permissions to individual Amazon Web Services accounts or to predefined groups defined by Amazon S3. These permissions are then added to the ACL on the object. By default, all objects are private. Only the owner has full access control. For more information, see Access Control List (ACL) Overview and Managing ACLs Using the REST API in the Amazon S3 User Guide.

If the bucket that you're uploading objects to uses the bucket owner enforced setting for S3 Object Ownership, ACLs are disabled and no longer affect permissions. Buckets that use this setting only accept PUT requests that don't specify an ACL or PUT requests that specify bucket owner full control ACLs, such as the bucket-owner-full-control canned ACL or an equivalent form of this ACL expressed in the XML format. PUT requests that contain other ACLs (for example, custom grants to certain Amazon Web Services accounts) fail and return a 400 error with the error code AccessControlListNotSupported. For more information, see Controlling ownership of objects and disabling ACLs in the Amazon S3 User Guide.

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter body : Object data.

Parameter bucketKeyEnabled : Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Key Management Service (KMS) keys (SSE-KMS).

Parameter cacheControl : Can be used to specify caching behavior along the request/reply chain. For more information, see http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.

Parameter checksumAlgorithm : Indicates the algorithm used to create the checksum for the object when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum-algorithm or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request.

For the x-amz-checksum-algorithm header, replace algorithm with the supported algorithm from the following list:

CRC32
CRC32C
CRC64NVME
MD5
SHA1
SHA256
SHA512
XXHASH3
XXHASH64
XXHASH128

For more information, see Checking object integrity in the Amazon S3 User Guide.

If the individual checksum value you provide through x-amz-checksum-algorithm doesn't match the checksum algorithm you set through x-amz-sdk-checksum-algorithm, Amazon S3 fails the request with a BadDigest error. For directory buckets, when you use Amazon Web Services SDKs, CRC32 is the default checksum algorithm that's used for performance.

Parameter checksumCRC32 : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 32-bit CRC32 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumCRC32C : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 32-bit CRC32C checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumCRC64NVME : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 64-bit CRC64NVME checksum of the object. The CRC64NVME checksum is always a full object checksum. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumMD5 : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 128-bit MD5 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumSHA1 : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 160-bit SHA1 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumSHA256 : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 256-bit SHA256 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumSHA512 : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 512-bit SHA512 digest of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumXXHASH128 : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 128-bit XXHASH128 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumXXHASH3 : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 64-bit XXHASH3 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter checksumXXHASH64 : This header can be used as a data integrity check to verify that the data received is the same data that was originally sent. This header specifies the Base64 encoded, 64-bit XXHASH64 checksum of the object. For more information, see Checking object integrity in the Amazon S3 User Guide.

Parameter contentDisposition : Specifies presentational information for the object. For more information, see https://www.rfc-editor.org/rfc/rfc6266#section-4.

Parameter contentEncoding : Specifies what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. For more information, see https://www.rfc-editor.org/rfc/rfc9110.html#field.content-encoding.

Parameter contentLanguage : The language the content is in.

Parameter contentLength : Size of the body in bytes. This parameter is useful when the size of the body cannot be determined automatically. For more information, see https://www.rfc-editor.org/rfc/rfc9110.html#name-content-length.

Parameter contentMD5 : The Base64 encoded 128-bit MD5 digest of the message (without the headers) according to RFC 1864. This header can be used as a message integrity check to verify that the data is the same data that was originally sent. Although it is optional, we recommend using the Content-MD5 mechanism as an end-to-end integrity check. For more information about REST request authentication, see REST Authentication.

Parameter contentType : A standard MIME type describing the format of the contents. For more information, see https://www.rfc-editor.org/rfc/rfc9110.html#name-content-type.

Parameter expires : The date and time at which the object is no longer cacheable. For more information, see https://www.rfc-editor.org/rfc/rfc7234#section-5.3.

Parameter grantFullControl : Gives the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter grantRead : Allows grantee to read the object data and its metadata.

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter grantReadACP : Allows grantee to read the object ACL.

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter grantWriteACP : Allows grantee to write the ACL for the applicable object.

This functionality is not supported for directory buckets.
This functionality is not supported for Amazon S3 on Outposts.

Parameter ifMatch : Uploads the object only if the ETag (entity tag) value provided during the WRITE operation matches the ETag of the object in S3. If the ETag values do not match, the operation returns a 412 Precondition Failed error.

If a conflicting operation occurs during the upload S3 returns a 409 ConditionalRequestConflict response. On a 409 failure you should fetch the object's ETag and retry the upload.

Expects the ETag value as a string.

For more information about conditional requests, see RFC 7232, or Conditional requests in the Amazon S3 User Guide.

Parameter ifNoneMatch : Uploads the object only if the object key name does not already exist in the bucket specified. Otherwise, Amazon S3 returns a 412 Precondition Failed error.

If a conflicting operation occurs during the upload S3 returns a 409 ConditionalRequestConflict response. On a 409 failure you should retry the upload.

Expects the '*' (asterisk) character.

For more information about conditional requests, see RFC 7232, or Conditional requests in the Amazon S3 User Guide.

Parameter metadata : A map of metadata to store with the object in S3.

Parameter objectLockLegalHoldStatus : Specifies whether a legal hold will be applied to this object. For more information about S3 Object Lock, see Object Lock in the Amazon S3 User Guide.

Parameter objectLockMode : The Object Lock mode that you want to apply to this object.

Parameter objectLockRetainUntilDate : The date and time when you want this object's Object Lock to expire. Must be formatted as a timestamp parameter.

Parameter sSECustomerAlgorithm : Specifies the algorithm to use when encrypting the object (for example, AES256).

Parameter sSECustomerKeyMD5 : Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.

Parameter sSEKMSEncryptionContext : Specifies the Amazon Web Services KMS Encryption Context as an additional encryption context to use for object encryption. The value of this header is a Base64 encoded string of a UTF-8 encoded JSON, which contains the encryption context as key-value pairs. This value is stored as object metadata and automatically gets passed on to Amazon Web Services KMS for future GetObject operations on this object.

General purpose buckets - This value must be explicitly added during CopyObject operations if you want an additional encryption context for your object. For more information, see Encryption context in the Amazon S3 User Guide.

Parameter serverSideEncryption : The server-side encryption algorithm that was used when you store this object in Amazon S3 or Amazon FSx.

General purpose buckets - You have four mutually exclusive options to protect data using server-side encryption in Amazon S3, depending on how you choose to manage the encryption keys. Specifically, the encryption key options are Amazon S3 managed keys (SSE-S3), Amazon Web Services KMS keys (SSE-KMS or DSSE-KMS), and customer-provided keys (SSE-C). Amazon S3 encrypts data with server-side encryption by using Amazon S3 managed keys (SSE-S3) by default. You can optionally tell Amazon S3 to encrypt data at rest by using server-side encryption with other key options. For more information, see Using Server-Side Encryption in the Amazon S3 User Guide.
Directory buckets - For directory buckets, there are only two supported options for server-side encryption: server-side encryption with Amazon S3 managed keys (SSE-S3) (AES256) and server-side encryption with KMS keys (SSE-KMS) (aws:kms). We recommend that the bucket's default encryption uses the desired encryption configuration and you don't override the bucket default encryption in your CreateSession requests or PUT object requests. Then, new objects are automatically encrypted with the desired encryption settings. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide. For more information about the encryption overriding behaviors in directory buckets, see Specifying server-side encryption with KMS for new object uploads.
In the Zonal endpoint API calls (except CopyObject and UploadPartCopy) using the REST API, the encryption request headers must match the encryption settings that are specified in the CreateSession request. You can't override the values of the encryption settings (x-amz-server-side-encryption, x-amz-server-side-encryption-aws-kms-key-id, x-amz-server-side-encryption-context, and x-amz-server-side-encryption-bucket-key-enabled) that are specified in the CreateSession request. You don't need to explicitly specify these encryption settings values in Zonal endpoint API calls, and Amazon S3 will use the encryption settings values from the CreateSession request to protect new objects in the directory bucket.

S3 access points for Amazon FSx - When accessing data stored in Amazon FSx file systems using S3 access points, the only valid server side encryption option is aws:fsx. All Amazon FSx file systems have encryption configured by default and are encrypted at rest. Data is automatically encrypted before being written to the file system, and automatically decrypted as it is read. These processes are handled transparently by Amazon FSx.

Directory buckets only support EXPRESS_ONEZONE (the S3 Express One Zone storage class) in Availability Zones and ONEZONE_IA (the S3 One Zone-Infrequent Access storage class) in Dedicated Local Zones.
Amazon S3 on Outposts only uses the OUTPOSTS Storage Class.

Parameter tagging : The tag-set for the object. The tag-set must be encoded as URL Query parameters. (For example, "Key1=Value1")

In the following example, the request header sets the redirect to an object (anotherPage.html) in the same bucket:

x-amz-website-redirect-location: /anotherPage.html

In the following example, the request header sets the object redirect to another website:

x-amz-website-redirect-location: http://www.example.com/

For more information about website hosting in Amazon S3, see Hosting Websites on Amazon S3 and How to Configure Website Page Redirects in the Amazon S3 User Guide.

Parameter writeOffsetBytes : Specifies the offset for appending data to existing objects in bytes. The offset must be equal to the size of the existing object being appended to. If no object exists, setting this header to 0 will create a new object.

putObjectAcl({required String bucket, required String key, ObjectCannedACL? acl, AccessControlPolicy? accessControlPolicy, ChecksumAlgorithm? checksumAlgorithm, String? contentMD5, String? expectedBucketOwner, String? grantFullControl, String? grantRead, String? grantReadACP, String? grantWrite, String? grantWriteACP, RequestPayer? requestPayer, String? versionId}) → Future<PutObjectAclOutput>

This change affects the following Amazon Web Services Regions: US East (N. Virginia), US West (N. California), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland), and South America (São Paulo). Uses the acl subresource to set the access control list (ACL) permissions for a new or existing object in an S3 bucket. You must have the WRITE_ACP permission to set the ACL of an object. For more information, see What permissions can I grant? in the Amazon S3 User Guide.

This functionality is not supported for Amazon S3 on Outposts.

Depending on your application needs, you can choose to set the ACL on an object using either the request body or the headers. For example, if you have an existing application that updates a bucket ACL using the request body, you can continue to use that approach. For more information, see Access Control List (ACL) Overview in the Amazon S3 User Guide.

Permissions

You can set access permissions using one of the following methods:

Specify a canned ACL with the x-amz-acl request header. Amazon S3 supports a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and permissions. Specify the canned ACL name as the value of x-amz-acl. If you use this header, you cannot use other access control-specific headers in your request. For more information, see Canned ACL.
Specify access permissions explicitly with the x-amz-grant-read, x-amz-grant-read-acp, x-amz-grant-write-acp, and x-amz-grant-full-control headers. When using these headers, you specify explicit access permissions and grantees (Amazon Web Services accounts or Amazon S3 groups) who will receive the permission. If you use these ACL-specific headers, you cannot use x-amz-acl header to set a canned ACL. These parameters map to the set of permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview.
You specify each grantee as a type=value pair, where the type is one of the following:
- id – if the value specified is the canonical user ID of an Amazon Web Services account
- uri – if you are granting permissions to a predefined group
- emailAddress – if the value specified is the email address of an Amazon Web Services account
For example, the following x-amz-grant-read header grants list objects permission to the two Amazon Web Services accounts identified by their email addresses.
x-amz-grant-read: emailAddress="xyz@amazon.com", emailAddress="abc@amazon.com"

You can use either a canned ACL or specify access permissions explicitly. You cannot do both.

Grantee Values

By the person's ID:

DisplayName is optional and ignored in the request.
By URI:
By Email address:

The grantee is resolved to the CanonicalUser and, in a response to a GET Object acl request, appears as the CanonicalUser.
- US East (N. Virginia)
- US West (N. California)
- US West (Oregon)
- Asia Pacific (Singapore)
- Asia Pacific (Sydney)
- Asia Pacific (Tokyo)
- Europe (Ireland)
- South America (São Paulo)
For a list of all the Amazon S3 supported Regions and endpoints, see Regions and Endpoints in the Amazon Web Services General Reference.

Versioning

The ACL of an object is set at the object version level. By default, PUT sets the ACL of the current version of an object. To set the ACL of a different version, use the versionId subresource.

The following operations are related to PutObjectAcl:

May throw NoSuchKey.

Parameter bucket : The bucket name that contains the object to which you want to attach the ACL.

S3 on Outposts - When you use this action with S3 on Outposts, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When you use this action with S3 on Outposts, the destination bucket must be the Outposts access point ARN or the access point alias. For more information about S3 on Outposts, see What is S3 on Outposts? in the Amazon S3 User Guide.

Parameter key : Key for which the PUT action was initiated.

Parameter acl : The canned ACL to apply to the object. For more information, see Canned ACL.

Parameter accessControlPolicy : Contains the elements that set the ACL permissions for an object per grantee.

Parameter checksumAlgorithm : Indicates the algorithm used to create the checksum for the object when you use the SDK. This header will not provide any additional functionality if you don't use the SDK. When you send this header, there must be a corresponding x-amz-checksum or x-amz-trailer header sent. Otherwise, Amazon S3 fails the request with the HTTP status code 400 Bad Request. For more information, see Checking object integrity in the Amazon S3 User Guide.