S3 オブジェクトロック保持コンプライアンスモードでの S3 バッチオペレーションの使用 - Amazon Simple Storage Service

S3 オブジェクトロック保持コンプライアンスモードでの S3 バッチオペレーションの使用

以下の例は、信頼ポリシーを作成し、オブジェクトに S3 バッチオペレーションと S3 オブジェクトロックの設定アクセス許可を設定する前の例に基づいています。この例では、保持モードを COMPLIANCE に、retain until date を 2020 年 1 月 1 日に設定しています。また、マニフェストバケット内のオブジェクトをターゲットとし指定したレポートバケットに結果を書き込むジョブを作成します。

例 複数のオブジェクト間でのメンションのコンプライアンスの設定

export AWS_PROFILE='aws-user' export AWS_DEFAULT_REGION='us-west-2' export ACCOUNT_ID=123456789012 export ROLE_ARN='arn:aws:iam::123456789012:role/bops-objectlock' read -d '' OPERATION <<EOF { "S3PutObjectRetention": { "Retention": { "RetainUntilDate":"2025-01-01T00:00:00", "Mode":"COMPLIANCE" } } } EOF read -d '' MANIFEST <<EOF { "Spec": { "Format": "S3BatchOperations_CSV_20180820", "Fields": [ "Bucket", "Key" ] }, "Location": { "ObjectArn": "arn:aws:s3:::ManifestBucket/compliance-objects-manifest.csv", "ETag": "Your-manifest-ETag" } } EOF read -d '' REPORT <<EOF { "Bucket": "arn:aws:s3:::ReportBucket", "Format": "Report_CSV_20180820", "Enabled": true, "Prefix": "reports/compliance-objects-bops", "ReportScope": "AllTasks" } EOF aws \ s3control create-job \ --account-id "${ACCOUNT_ID}" \ --manifest "${MANIFEST//$'\n'}" \ --operation "${OPERATION//$'\n'/}" \ --report "${REPORT//$'\n'}" \ --priority 10 \ --role-arn "${ROLE_ARN}" \ --client-request-token "$(uuidgen)" \ --region "${AWS_DEFAULT_REGION}" \ --description "Set compliance retain-until to 1 Jul 2030";

COMPLIANCE モードの retain until date を 2020 年 1 月 15 日に延長する

以下の例では、COMPLIANCE モードの retain until date を 2025 年 1 月 15 日に延長します。

export AWS_PROFILE='aws-user' export AWS_DEFAULT_REGION='us-west-2' export ACCOUNT_ID=123456789012 export ROLE_ARN='arn:aws:iam::123456789012:role/bops-objectlock' read -d '' OPERATION <<EOF { "S3PutObjectRetention": { "Retention": { "RetainUntilDate":"2025-01-15T00:00:00", "Mode":"COMPLIANCE" } } } EOF read -d '' MANIFEST <<EOF { "Spec": { "Format": "S3BatchOperations_CSV_20180820", "Fields": [ "Bucket", "Key" ] }, "Location": { "ObjectArn": "arn:aws:s3:::ManifestBucket/compliance-objects-manifest.csv", "ETag": "Your-manifest-ETag" } } EOF read -d '' REPORT <<EOF { "Bucket": "arn:aws:s3:::ReportBucket", "Format": "Report_CSV_20180820", "Enabled": true, "Prefix": "reports/compliance-objects-bops", "ReportScope": "AllTasks" } EOF aws \ s3control create-job \ --account-id "${ACCOUNT_ID}" \ --manifest "${MANIFEST//$'\n'}" \ --operation "${OPERATION//$'\n'/}" \ --report "${REPORT//$'\n'}" \ --priority 10 \ --role-arn "${ROLE_ARN}" \ --client-request-token "$(uuidgen)" \ --region "${AWS_DEFAULT_REGION}" \ --description "Extend compliance retention to 15 Jan 2020";

例 保持モードを「コンプライアンス」に設定し、保持期間を 2020 年 1 月 1 日にします。

public String createComplianceRetentionJob(final AWSS3ControlClient awss3ControlClient) throws ParseException { final String manifestObjectArn = "arn:aws:s3:::ManifestBucket/compliance-objects-manifest.csv"; final String manifestObjectVersionId = "your-object-version-Id"; final JobManifestLocation manifestLocation = new JobManifestLocation() .withObjectArn(manifestObjectArn) .withETag(manifestObjectVersionId); final JobManifestSpec manifestSpec = new JobManifestSpec() .withFormat(JobManifestFormat.S3BatchOperations_CSV_20180820) .withFields("Bucket", "Key"); final JobManifest manifestToPublicApi = new JobManifest() .withLocation(manifestLocation) .withSpec(manifestSpec); final String jobReportBucketArn = "arn:aws:s3:::ReportBucket"; final String jobReportPrefix = "reports/compliance-objects-bops"; final JobReport jobReport = new JobReport() .withEnabled(true) .withReportScope(JobReportScope.AllTasks) .withBucket(jobReportBucketArn) .withPrefix(jobReportPrefix) .withFormat(JobReportFormat.Report_CSV_20180820); final SimpleDateFormat format = new SimpleDateFormat("dd/MM/yyyy"); final Date janFirst = format.parse("01/01/2020"); final JobOperation jobOperation = new JobOperation() .withS3PutObjectRetention(new S3SetObjectRetentionOperation() .withRetention(new S3Retention() .withMode(S3ObjectLockRetentionMode.COMPLIANCE) .withRetainUntilDate(janFirst))); final String roleArn = "arn:aws:iam::123456789012:role/bops-object-lock"; final Boolean requiresConfirmation = true; final int priority = 10; final CreateJobRequest request = new CreateJobRequest() .withAccountId("123456789012") .withDescription("Set compliance retain-until to 1 Jan 2020") .withManifest(manifestToPublicApi) .withOperation(jobOperation) .withPriority(priority) .withRoleArn(roleArn) .withReport(jobReport) .withConfirmationRequired(requiresConfirmation); final CreateJobResult result = awss3ControlClient.createJob(request); return result.getJobId(); }

COMPLIANCE モードの retain until date の延長

以下の例では、COMPLIANCE モードの retain until date を 2020 年 1 月 15 日に延長します。

public String createExtendComplianceRetentionJob(final AWSS3ControlClient awss3ControlClient) throws ParseException { final String manifestObjectArn = "arn:aws:s3:::ManifestBucket/compliance-objects-manifest.csv"; final String manifestObjectVersionId = "15ad5ba069e6bbc465c77bf83d541385"; final JobManifestLocation manifestLocation = new JobManifestLocation() .withObjectArn(manifestObjectArn) .withETag(manifestObjectVersionId); final JobManifestSpec manifestSpec = new JobManifestSpec() .withFormat(JobManifestFormat.S3BatchOperations_CSV_20180820) .withFields("Bucket", "Key"); final JobManifest manifestToPublicApi = new JobManifest() .withLocation(manifestLocation) .withSpec(manifestSpec); final String jobReportBucketArn = "arn:aws:s3:::ReportBucket"; final String jobReportPrefix = "reports/compliance-objects-bops"; final JobReport jobReport = new JobReport() .withEnabled(true) .withReportScope(JobReportScope.AllTasks) .withBucket(jobReportBucketArn) .withPrefix(jobReportPrefix) .withFormat(JobReportFormat.Report_CSV_20180820); final SimpleDateFormat format = new SimpleDateFormat("dd/MM/yyyy"); final Date jan15th = format.parse("15/01/2020"); final JobOperation jobOperation = new JobOperation() .withS3PutObjectRetention(new S3SetObjectRetentionOperation() .withRetention(new S3Retention() .withMode(S3ObjectLockRetentionMode.COMPLIANCE) .withRetainUntilDate(jan15th))); final String roleArn = "arn:aws:iam::123456789012:role/bops-object-lock"; final Boolean requiresConfirmation = true; final int priority = 10; final CreateJobRequest request = new CreateJobRequest() .withAccountId("123456789012") .withDescription("Extend compliance retention to 15 Jan 2020") .withManifest(manifestToPublicApi) .withOperation(jobOperation) .withPriority(priority) .withRoleArn(roleArn) .withReport(jobReport) .withConfirmationRequired(requiresConfirmation); final CreateJobResult result = awss3ControlClient.createJob(request); return result.getJobId(); }