Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Examples See Also

UpdateBucketMetadataAnnotationTableConfiguration

Updates the annotation table configuration for an Amazon S3 bucket's metadata configuration. Use this operation to enable or disable the annotation table, or to update its associated IAM role.

An annotation table is a queryable Iceberg table that contains records of all annotations attached to objects in the bucket. To use this operation, the bucket must have an existing Amazon S3 Metadata configuration.

To use this operation, you must have the s3:UpdateBucketMetadataAnnotationTableConfiguration permission. If you are specifying or changing the IAM role, you must also have iam:PassRole permission for the role.

The IAM role must have a trust policy that allows the Amazon S3 metadata service to assume it, and a permissions policy that grants the actions needed to read annotations from your bucket. The following examples show a trust policy and a permissions policy that you can adapt for your bucket and account.

The following operations are related to UpdateBucketMetadataAnnotationTableConfiguration:

Request Syntax


PUT /?metadataAnnotationTable HTTP/1.1
Host: Bucket.s3.amazonaws.com
Content-MD5: ContentMD5
x-amz-sdk-checksum-algorithm: ChecksumAlgorithm
x-amz-expected-bucket-owner: ExpectedBucketOwner
<?xml version="1.0" encoding="UTF-8"?>
<AnnotationTableConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <ConfigurationState>string</ConfigurationState>
   <EncryptionConfiguration>
      <KmsKeyArn>string</KmsKeyArn>
      <SseAlgorithm>string</SseAlgorithm>
   </EncryptionConfiguration>
   <Role>string</Role>
</AnnotationTableConfiguration>

URI Request Parameters

The request uses the following URI parameters.

Bucket

The name of the bucket whose annotation table configuration to update.

Required: Yes

Content-MD5

Base64-encoded MD5 digest of the message body.

x-amz-expected-bucket-owner

The account ID of the expected bucket owner.

x-amz-sdk-checksum-algorithm

Checksum algorithm for the request payload.

Request Body

The request accepts the following data in XML format.

AnnotationTableConfiguration

Root level tag for the AnnotationTableConfiguration parameters.

Required: Yes

ConfigurationState

The new configuration state to apply.

Type: String

Valid Values: ENABLED | DISABLED

Required: Yes

EncryptionConfiguration

The encryption settings for an S3 Metadata journal table or inventory table configuration.

Type: MetadataTableEncryptionConfiguration data type

Required: No

Role

The new IAM role ARN to apply.

Type: String

Required: No

Response Syntax


HTTP/1.1 200

Response Elements

If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.

Examples

Trust policy

This example illustrates one usage of UpdateBucketMetadataAnnotationTableConfiguration.



{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "metadata.s3.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123456789012"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:s3:::amzn-s3-demo-bucket"
                }
            }
        }
    ]
}

Permissions policy

This example illustrates one usage of UpdateBucketMetadataAnnotationTableConfiguration.



{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PermissionForGetAnnotation",
      "Effect": "Allow",
      "Action": [
        "s3:GetObjectAnnotation",
        "s3:GetObjectVersionAnnotation"
      ],
      "Resource": ["arn:aws:s3:::amzn-s3-demo-bucket/*"],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "{{Account}}"
        }
      }
    },
    {
      "Sid": "PermissionsForListBucket",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListBucketVersions"
      ],
      "Resource": ["arn:aws:s3:::amzn-s3-demo-bucket"],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "{{Account}}"
        }
      }
    },
    {
      "Sid": "PermissionsForDecryptAnnotation",
      "Effect": "Allow",
      "Action": ["kms:Decrypt"],
      "Condition": {
        "StringLike": {
          "kms:ViaService": [
            "s3.{{Region}}.amazonaws.com"
          ]
        },
        "ArnLike": {
          "kms:EncryptionContext:aws:s3:arn": [
            "arn:aws:s3:::{{BucketName}}",
            "arn:aws:s3:::{{BucketName}}/*"
          ]
        }
      },
      "Resource": ["arn:aws:kms:{{Region}}:{{Account}}:key/{{KmsKeyId}}"]
    }
  ]
}