AWS S3 Control 2018-08-20
- Client: Aws\S3Control\S3ControlClient
- Service ID: s3control
- Version: 2018-08-20
This page describes the parameters and results for the operations of the AWS S3 Control (2018-08-20), and shows how to use the Aws\S3Control\S3ControlClient object to call the described operations. This documentation is specific to the 2018-08-20 API version of the service.
Operation Summary
Each of the following operations can be created from a client using
$client->getCommand('CommandName'), where "CommandName" is the
name of one of the following operations. Note: a command is a value that
encapsulates an operation and the parameters used to create an HTTP request.
You can also create and send a command immediately using the magic methods
available on a client object: $client->commandName(/* parameters */).
You can send the command asynchronously (returning a promise) by appending the
word "Async" to the operation name: $client->commandNameAsync(/* parameters */).
- DeletePublicAccessBlock ( array $params = [] )
Removes the Public Access Block configuration for an Amazon Web Services account.
- GetPublicAccessBlock ( array $params = [] )
Retrieves the Public Access Block configuration for an Amazon Web Services account.
- PutPublicAccessBlock ( array $params = [] )
Creates or modifies the Public Access Block configuration for an Amazon Web Services account.
Operations
DeletePublicAccessBlock
$result = $client->deletePublicAccessBlock([/* ... */]); $promise = $client->deletePublicAccessBlockAsync([/* ... */]);
Removes the Public Access Block configuration for an Amazon Web Services account.
Parameter Syntax
$result = $client->deletePublicAccessBlock([
'AccountId' => '<string>', // REQUIRED
]);
Parameter Details
Members
Result Syntax
[]
Result Details
Errors
There are no errors described for this operation.
GetPublicAccessBlock
$result = $client->getPublicAccessBlock([/* ... */]); $promise = $client->getPublicAccessBlockAsync([/* ... */]);
Retrieves the Public Access Block configuration for an Amazon Web Services account.
Parameter Syntax
$result = $client->getPublicAccessBlock([
'AccountId' => '<string>', // REQUIRED
]);
Parameter Details
Members
Result Syntax
[
'PublicAccessBlockConfiguration' => [
'BlockPublicAcls' => true || false,
'BlockPublicPolicy' => true || false,
'IgnorePublicAcls' => true || false,
'RestrictPublicBuckets' => true || false,
],
]
Result Details
Members
- PublicAccessBlockConfiguration
-
- Type: PublicAccessBlockConfiguration structure
The Public Access Block configuration currently in effect for this Amazon Web Services account.
Errors
-
NoSuchPublicAccessBlockConfiguration:
This exception is thrown if a
GetPublicAccessBlockrequest is made against an account that does not have a PublicAccessBlockConfiguration set.
PutPublicAccessBlock
$result = $client->putPublicAccessBlock([/* ... */]); $promise = $client->putPublicAccessBlockAsync([/* ... */]);
Creates or modifies the Public Access Block configuration for an Amazon Web Services account.
Parameter Syntax
$result = $client->putPublicAccessBlock([
'AccountId' => '<string>', // REQUIRED
'PublicAccessBlockConfiguration' => [ // REQUIRED
'BlockPublicAcls' => true || false,
'BlockPublicPolicy' => true || false,
'IgnorePublicAcls' => true || false,
'RestrictPublicBuckets' => true || false,
],
]);
Parameter Details
Members
- AccountId
-
- Required: Yes
- Type: string
The Account ID for the Amazon Web Services account whose Public Access Block configuration you want to set.
- PublicAccessBlockConfiguration
-
- Required: Yes
- Type: PublicAccessBlockConfiguration structure
The Public Access Block configuration that you want to apply to this Amazon Web Services account.
Result Syntax
[]
Result Details
Errors
There are no errors described for this operation.
Shapes
NoSuchPublicAccessBlockConfiguration
Description
This exception is thrown if a GetPublicAccessBlock request is made against an account that does not have a PublicAccessBlockConfiguration set.
Members
PublicAccessBlockConfiguration
Description
The container element for all Public Access Block configuration options. You can enable the configuration options in any combination.
Amazon S3 considers a bucket policy public unless at least one of the following conditions is true:
-
The policy limits access to a set of CIDRs using
aws:SourceIp. For more information on CIDR, see http://www.rfc-editor.org/rfc/rfc4632.txt -
The policy grants permissions, not including any "bad actions," to one of the following:
-
A fixed AWS principal, user, role, or service principal
-
A fixed
aws:SourceArn -
A fixed
aws:SourceVpc -
A fixed
aws:SourceVpce -
A fixed
aws:SourceOwner -
A fixed
aws:SourceAccount -
A fixed value of
s3:x-amz-server-side-encryption-aws-kms-key-id -
A fixed value of
aws:useridoutside the pattern "AROLEID:*"
-
"Bad actions" are those that could expose the data inside a bucket to reads or writes by the public. These actions are s3:Get*, s3:List*, s3:AbortMultipartUpload, s3:Delete*, s3:Put*, and s3:RestoreObject.
The star notation for bad actions indicates that all matching operations are considered bad actions. For example, because s3:Get* is a bad action, s3:GetObject, s3:GetObjectVersion, and s3:GetObjectAcl are all bad actions.
Members
- BlockPublicAcls
-
- Type: boolean
Specifies whether Amazon S3 should block public ACLs for buckets in this account. Setting this element to
TRUEcauses the following behavior:-
PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access.
-
PUT Object calls will fail if the request includes an object ACL.
Note that enabling this setting doesn't affect existing policies or ACLs.
- BlockPublicPolicy
-
- Type: boolean
Specifies whether Amazon S3 should block public bucket policies for buckets in this account. Setting this element to
TRUEcauses Amazon S3 to reject calls to PUT Bucket policy if the specified bucket policy allows public access.Note that enabling this setting doesn't affect existing bucket policies.
- IgnorePublicAcls
-
- Type: boolean
Specifies whether Amazon S3 should ignore public ACLs for buckets in this account. Setting this element to
TRUEcauses Amazon S3 to ignore all public ACLs on buckets in this account and any objects that they contain.Note that enabling this setting doesn't affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set.
- RestrictPublicBuckets
-
- Type: boolean
Specifies whether Amazon S3 should restrict public bucket policies for buckets in this account. If this element is set to
TRUE, then only the bucket owner and AWS Services can access buckets with public policies.Note that enabling this setting doesn't affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.
