s3control

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 21 Imported by: 0

README

S3 Control

Parity grade: A · SDK aws-sdk-go-v2/service/s3control@v1.68.2 · last audited 2026-07-23 (8ec3c0f8)

Coverage

Metric Value
Operations audited 45 (45 ok)
Feature families 1 (1 ok)
Known gaps 4
Deferred items 3
Resource leaks fixed
Known gaps
  • The synchronous "DELETE /v20180820/mrap/instances/{Name}" route mapped to DeleteMultiRegionAccessPoint does not exist in the real API (only the async POST variant does). Dead code from a real client's perspective; low-risk cleanup deferred (unlike the fabricated PublicAccessBlock ops, DeleteMultiRegionAccessPoint IS a real op name -- only this one extra HTTP-verb/path combination for it is fake -- so this was judged lower-priority than deleting an entirely invented operation family).
  • s3control.ErrAlreadyExists (errors.go) wraps a generic "BucketAlreadyExists" code but is never actually returned by any backend method (verified via repo-wide grep) -- unused/dead sentinel, not a live bug, but worth removing or wiring up correctly if AlreadyExists semantics are ever needed for e.g. CreateAccessPoint on a duplicate name.
  • DeleteAccessGrantsInstance does not enforce the real API's documented precondition ("You must first delete the access grants and locations before S3 Access Grants can delete the instance") -- gopherstack allows deleting an instance that still has grants/locations attached, which a real AWS account would reject. Not fixed this pass: the correct AWS error code for this specific conflict is not present anywhere in aws-sdk-go-v2/service/s3control's typed exceptions (S3 Control largely returns untyped/generic errors), so guessing a code risked introducing an unverified wire-shape bug rather than fixing one. See items_still_open.
  • Only a modestly larger sample of response XML shapes were spot-checked against deserializers.go this pass (GetAccessPoint -- including the newly-added inline PublicAccessBlockConfiguration --, CreateAccessGrant, DescribeJob) on top of the prior pass's sample (GetAccessPoint, CreateJob, CreateMultiRegionAccessPoint, GetBucketPolicy/Tagging/Versioning). The remaining response types were not individually diffed field-by-field against the SDK deserializers -- see deferred.
Deferred
  • Full field-by-field wire-shape diff of every response XML struct against deserializers.go (this pass prioritized the leak, the two error-code bug classes, the ghost-map-row cascade-delete class, and the persistence-gap class, all of which had wide blast radius across many ops; response-body field audits remain sampled, not exhaustive).
  • AccessGrantsInstance / IdentityCenter association flows (state machine correctness beyond basic CRUD), including the un-enforced delete-grants-and-locations-first precondition noted under gaps.
  • Chaos fault-injection interaction with the fixed routes/leak (ChaosOperations() just echoes GetSupportedOperations(), unaffected by this pass).

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrAlreadyExists = awserr.New("BucketAlreadyExists", awserr.ErrAlreadyExists)

ErrAlreadyExists is returned when a resource already exists.

View Source 
var ErrNilAppContext = errors.New("nil AppContext passed to S3Control Provider.Init")

ErrNilAppContext is returned by Init when a nil AppContext is passed.

View Source 
var ErrNotFound = awserr.New("NoSuchPublicAccessBlockConfiguration", awserr.ErrNotFound)

ErrNotFound is returned when public access block config is not found.

View Source 
var ErrValidation = awserr.New("BadRequestException", awserr.ErrInvalidParameter)

ErrValidation is returned when a required parameter is missing or invalid.

Functions

This section is empty.

Types

type AccessGrant 

type AccessGrant struct {
	AccountID              string `json:"accountID"`
	AccessGrantID          string `json:"accessGrantID"`
	AccessGrantArn         string `json:"accessGrantArn"`
	AccessGrantsLocationID string `json:"accessGrantsLocationID"`
	GrantScope             string `json:"grantScope"`
	Permission             string `json:"permission"`
	GranteeType            string `json:"granteeType"`
	GranteeIdentifier      string `json:"granteeIdentifier"`
	ApplicationArn         string `json:"applicationArn"`
	CreatedAt              string `json:"createdAt"`
}

AccessGrant represents an S3 Access Grants grant.

type AccessGrantsInstance 

type AccessGrantsInstance struct {
	AccountID                    string `json:"accountID"`
	AccessGrantsInstanceArn      string `json:"accessGrantsInstanceArn"`
	AccessGrantsInstanceID       string `json:"accessGrantsInstanceID"`
	IdentityCenterArn            string `json:"identityCenterArn"`
	IdentityCenterInstanceArn    string `json:"identityCenterInstanceArn"`
	IdentityCenterApplicationArn string `json:"identityCenterApplicationArn"`
	CreatedAt                    string `json:"createdAt"`
}

AccessGrantsInstance represents an S3 Access Grants instance.

type AccessGrantsLocation 

type AccessGrantsLocation struct {
	AccountID               string `json:"accountID"`
	AccessGrantsLocationID  string `json:"accessGrantsLocationID"`
	AccessGrantsLocationArn string `json:"accessGrantsLocationArn"`
	LocationScope           string `json:"locationScope"`
	IAMRoleArn              string `json:"iamRoleArn"`
	CreatedAt               string `json:"createdAt"`
}

AccessGrantsLocation represents an S3 Access Grants location.

type AccessPoint 

type AccessPoint struct {
	AccountID       string `json:"accountID"`
	Name            string `json:"name"`
	Bucket          string `json:"bucket"`
	AccessPointArn  string `json:"accessPointArn"`
	Alias           string `json:"alias"`
	VpcID           string `json:"vpcID,omitempty"`
	BucketAccountID string `json:"bucketAccountID,omitempty"`
	NetworkOrigin   string `json:"networkOrigin"`
	CreationDate    string `json:"creationDate,omitempty"`
}

AccessPoint represents an S3 access point.

type BatchJob 

type BatchJob struct {
	Description          string `json:"description,omitempty"`
	TerminationDate      string `json:"terminationDate,omitempty"`
	JobArn               string `json:"jobArn"`
	RoleArn              string `json:"roleArn"`
	Status               string `json:"status"`
	StatusUpdateReason   string `json:"statusUpdateReason,omitempty"`
	Operation            string `json:"operation,omitempty"`
	AccountID            string `json:"accountID"`
	JobID                string `json:"jobID"`
	Report               string `json:"report,omitempty"`
	Manifest             string `json:"manifest,omitempty"`
	CreationTime         string `json:"creationTime,omitempty"`
	Priority             int32  `json:"priority"`
	ConfirmationRequired bool   `json:"confirmationRequired,omitempty"`
}

BatchJob represents an S3 Batch Operations job.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
}

Handler is the Echo HTTP handler for S3 Control operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new S3 Control handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this S3 Control instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the S3 Control operation from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the account ID from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported S3 Control operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all backend state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches S3 Control requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for S3 Control resources.

Phase 3.3 datalayer refactor: every map[string]*T resource field is backed by a *store.Table[T] (see pkgs/store and store_setup.go). "Clean" tables key off fields the value type already carries and are registered on registry, so Reset/Snapshot/Restore collapse to one registry call each. "Dirty" tables (mrapRequests, accessPointPABs) key off a field with no natural home on the value type and are NOT registered on registry -- persistence.go instead round-trips them through an ephemeral DTO store.Registry. See store_setup.go's file doc comment for the full breakdown.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend with default config values.

func NewInMemoryBackendWithConfig 

func NewInMemoryBackendWithConfig(accountID, region string) *InMemoryBackend

NewInMemoryBackendWithConfig creates a new InMemoryBackend with explicit config values.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID configured for this backend.

func (*InMemoryBackend) AddAccessGrantInternal 

func (b *InMemoryBackend) AddAccessGrantInternal(
	accountID, locationID, granteeType, granteeIdentifier, permission string,
) *AccessGrant

AddAccessGrantInternal creates an access grant directly, for seeding test data.

func (*InMemoryBackend) AddAccessGrantsInstanceInternal 

func (b *InMemoryBackend) AddAccessGrantsInstanceInternal(accountID, identityCenterArn string) *AccessGrantsInstance

AddAccessGrantsInstanceInternal creates an access grants instance directly, for seeding test data.

func (*InMemoryBackend) AddAccessPointInternal 

func (b *InMemoryBackend) AddAccessPointInternal(accountID, name, bucket string) *AccessPoint

AddAccessPointInternal creates an access point directly, for seeding test data.

func (*InMemoryBackend) AddBatchJobInternal 

func (b *InMemoryBackend) AddBatchJobInternal(accountID, roleArn string, priority int32) *BatchJob

AddBatchJobInternal creates a batch job directly, for seeding test data.

func (*InMemoryBackend) AddPublicAccessBlockInternal 

func (b *InMemoryBackend) AddPublicAccessBlockInternal(accountID string, block *PublicAccessBlock)

AddPublicAccessBlockInternal stores a public access block directly, for seeding test data.

func (*InMemoryBackend) AssociateAccessGrantsIdentityCenter 

func (b *InMemoryBackend) AssociateAccessGrantsIdentityCenter(accountID, identityCenterArn string)

AssociateAccessGrantsIdentityCenter associates an IAM Identity Center instance with an S3 Access Grants instance.

func (*InMemoryBackend) CreateAccessGrant 

func (b *InMemoryBackend) CreateAccessGrant(
	accountID, locationID, granteeType, granteeIdentifier, permission, applicationArn string,
) (*AccessGrant, error)

CreateAccessGrant creates an access grant for an account. Returns ErrValidation if permission is empty.

func (*InMemoryBackend) CreateAccessGrantsInstance 

func (b *InMemoryBackend) CreateAccessGrantsInstance(accountID, identityCenterArn string) *AccessGrantsInstance

CreateAccessGrantsInstance creates an S3 Access Grants instance for an account.

func (*InMemoryBackend) CreateAccessGrantsLocation 

func (b *InMemoryBackend) CreateAccessGrantsLocation(
	accountID, locationScope, iamRoleArn string,
) *AccessGrantsLocation

CreateAccessGrantsLocation creates an Access Grants location.

func (*InMemoryBackend) CreateAccessPoint 

func (b *InMemoryBackend) CreateAccessPoint(accountID, name, bucket string) *AccessPoint

CreateAccessPoint creates an S3 access point.

func (*InMemoryBackend) CreateAccessPointForObjectLambda 

func (b *InMemoryBackend) CreateAccessPointForObjectLambda(accountID, name string) *ObjectLambdaAccessPoint

CreateAccessPointForObjectLambda creates an Object Lambda access point.

func (*InMemoryBackend) CreateBucket 

func (b *InMemoryBackend) CreateBucket(accountID, bucketName string) *OutpostsBucket

CreateBucket creates an S3 Outposts bucket.

accountID here is whatever accountIDFromRequest(c) resolves to (see handler_bucket.go) -- almost always the literal "default", because a real aws-sdk-go-v2 CreateBucket request carries no AccountId at all. Confirmed against the installed aws-sdk-go-v2/service/s3control's CreateBucketInput: its members are Bucket/ACL/CreateBucketConfiguration/GrantFullControl/ GrantRead/GrantReadACP/GrantWrite/GrantWriteACP/ObjectLockEnabledForBucket/ OutpostId -- nothing account-related, unlike EVERY other Create* op in this service (CreateAccessPoint, CreateJob, CreateMultiRegionAccessPoint, CreateAccessGrant*, CreateStorageLensGroup, ... all bind AccountId to the X-Amz-Account-Id header). Real S3 on Outposts substitutes OutpostId for that role: an Outpost is provisioned to, and always addressed as belonging to, exactly one AWS account, so the bucket's owner is implied by which Outpost it's created on rather than by an explicit request field.

GetBucket/DeleteBucket/ListRegionalBuckets (and every bucket sub-resource op: lifecycle/policy/tagging/versioning/replication) DO bind an AccountId to that same header -- but it's optional, and a real caller that configures one consistently across their whole session has no way to supply that same value on CreateBucket, since the field doesn't exist there. Storing this resource keyed by "accountID:bucketName" (as every sibling resource in this service correctly does, since their Create ops really do carry AccountId) would mean a bucket created via the real, headerless CreateBucket shape lands under the "default" partition while the same client's real, account-bearing Get/Delete/List calls look elsewhere and never find it -- see gopherstack-eje5.

The fix: OutpostsBucket identity (outpostsBucketKeyFn, store_setup.go) and every piece of its sub-resource state (bucketLifecycle/bucketPolicies/ bucketTagging/bucketVersioning/bucketReplication, all below) are keyed by bucket Name ALONE. AccountID is still recorded on the struct (it flows into BucketArn) but is no longer part of any lookup key in this file -- it cannot be, without inventing a persistent OutpostId->account registry this service has no other reason to carry. This mirrors real S3's own bucket namespace, which is likewise globally unique by name rather than partitioned per caller.

func (*InMemoryBackend) CreateJob 

func (b *InMemoryBackend) CreateJob(accountID, roleArn string, priority int32) (*BatchJob, error)

CreateJob creates an S3 Batch Operations job. Returns ErrValidation if roleArn is empty.

func (*InMemoryBackend) CreateMultiRegionAccessPoint 

func (b *InMemoryBackend) CreateMultiRegionAccessPoint(
	accountID, name, _ string,
) *MultiRegionAccessPointRequest

CreateMultiRegionAccessPoint creates an async MRAP request and stores the MRAP instance.

func (*InMemoryBackend) CreateStorageLensGroup 

func (b *InMemoryBackend) CreateStorageLensGroup(accountID, name string) *StorageLensGroup

CreateStorageLensGroup creates an S3 Storage Lens group.

func (*InMemoryBackend) DeleteAccessGrant 

func (b *InMemoryBackend) DeleteAccessGrant(accountID, grantID string) error

DeleteAccessGrant removes an access grant and cascade-cleans its generic resource tags.

func (*InMemoryBackend) DeleteAccessGrantsInstance 

func (b *InMemoryBackend) DeleteAccessGrantsInstance(accountID string) error

DeleteAccessGrantsInstance removes the Access Grants instance and cascade-cleans its resource policy and generic resource tags. Per the real API's documented behavior, this does NOT cascade-delete AccessGrants or AccessGrantsLocations -- AWS requires those to be deleted individually first, and it also requires any associated IAM Identity Center instance to be dissociated first (see errAccessGrantsInstanceNotEmpty for the exact doc text). All three preconditions are enforced here: deleting an instance that still has any grant, any location, or a live Identity Center association is rejected with errAccessGrantsInstanceNotEmpty instead of silently succeeding.

func (*InMemoryBackend) DeleteAccessGrantsInstanceResourcePolicy 

func (b *InMemoryBackend) DeleteAccessGrantsInstanceResourcePolicy(accountID string)

DeleteAccessGrantsInstanceResourcePolicy removes the resource policy.

func (*InMemoryBackend) DeleteAccessGrantsLocation 

func (b *InMemoryBackend) DeleteAccessGrantsLocation(accountID, locationID string) error

DeleteAccessGrantsLocation removes an access grants location and cascade-cleans its generic resource tags.

func (*InMemoryBackend) DeleteAccessPoint 

func (b *InMemoryBackend) DeleteAccessPoint(accountID, name string) error

DeleteAccessPoint removes an S3 access point and cascade-cleans every piece of state keyed off it (policy, scope, per-AP PublicAccessBlock, generic resource tags) so a delete/recreate cycle under the same name never resurfaces stale state from the deleted access point.

func (*InMemoryBackend) DeleteAccessPointForObjectLambda 

func (b *InMemoryBackend) DeleteAccessPointForObjectLambda(accountID, name string) error

DeleteAccessPointForObjectLambda removes an Object Lambda access point and cascade-cleans its policy, configuration, and generic resource tags so a delete/recreate cycle under the same name never resurfaces stale state.

func (*InMemoryBackend) DeleteAccessPointPolicy 

func (b *InMemoryBackend) DeleteAccessPointPolicy(accountID, name string) error

DeleteAccessPointPolicy removes the policy for an access point.

func (*InMemoryBackend) DeleteAccessPointPolicyForObjectLambda 

func (b *InMemoryBackend) DeleteAccessPointPolicyForObjectLambda(accountID, name string) error

DeleteAccessPointPolicyForObjectLambda removes the policy from an Object Lambda AP.

func (*InMemoryBackend) DeleteAccessPointPublicAccessBlock 

func (b *InMemoryBackend) DeleteAccessPointPublicAccessBlock(accountID, name string) error

DeleteAccessPointPublicAccessBlock removes the public access block configuration for an access point.

func (*InMemoryBackend) DeleteAccessPointScope 

func (b *InMemoryBackend) DeleteAccessPointScope(accountID, name string) error

DeleteAccessPointScope removes the scope for an access point.

func (*InMemoryBackend) DeleteBucket 

func (b *InMemoryBackend) DeleteBucket(bucketName string) error

DeleteBucket removes an Outposts bucket and cascade-cleans every piece of state keyed off it (lifecycle, policy, tagging, versioning, replication, generic resource tags) so a delete/recreate cycle under the same name never resurfaces stale state from the deleted bucket. See the CreateBucket doc comment above for why lookup is by bucketName alone.

func (*InMemoryBackend) DeleteBucketLifecycleConfiguration 

func (b *InMemoryBackend) DeleteBucketLifecycleConfiguration(bucketName string) error

DeleteBucketLifecycleConfiguration removes lifecycle config from an Outposts bucket.

func (*InMemoryBackend) DeleteBucketPolicy 

func (b *InMemoryBackend) DeleteBucketPolicy(bucketName string) error

DeleteBucketPolicy removes the policy from an Outposts bucket.

func (*InMemoryBackend) DeleteBucketReplication 

func (b *InMemoryBackend) DeleteBucketReplication(bucketName string) error

DeleteBucketReplication removes the replication configuration for an Outposts bucket.

func (*InMemoryBackend) DeleteBucketTagging 

func (b *InMemoryBackend) DeleteBucketTagging(bucketName string) error

DeleteBucketTagging removes all tags from an Outposts bucket.

func (*InMemoryBackend) DeleteJobTagging 

func (b *InMemoryBackend) DeleteJobTagging(accountID, jobID string) error

DeleteJobTagging removes all tags from a batch job.

func (*InMemoryBackend) DeleteMultiRegionAccessPoint 

func (b *InMemoryBackend) DeleteMultiRegionAccessPoint(accountID, name string) error

DeleteMultiRegionAccessPoint removes an MRAP and cascade-cleans its route configuration (policy lives on the MultiRegionAccessPoint value itself via PutMultiRegionAccessPointPolicy, so it goes away with the row).

LEAK FIX: this previously only checked b.mraps.Has(key) and returned nil without ever calling b.mraps.Delete(key) -- a deleted MRAP was never actually removed from the backing table. Both the synchronous DELETE /v20180820/mrap/instances/{Name} route and the async POST /v20180820/async-requests/mrap/delete route call this same method, so every DeleteMultiRegionAccessPoint call (sync or async) was a silent no-op: the MRAP stayed retrievable via GetMultiRegionAccessPoint / ListMultiRegionAccessPoints forever, and repeated create/delete cycles under new names accumulated unbounded ghost rows in b.mraps. No existing test caught this because the table-driven "delete_mrap" case only asserted err == nil, never that the resource was actually gone.

func (*InMemoryBackend) DeletePublicAccessBlock 

func (b *InMemoryBackend) DeletePublicAccessBlock(accountID string) error

DeletePublicAccessBlock deletes the public access block configuration for an account.

func (*InMemoryBackend) DeleteStorageLensConfiguration 

func (b *InMemoryBackend) DeleteStorageLensConfiguration(accountID, configName string) error

DeleteStorageLensConfiguration removes a Storage Lens configuration.

func (*InMemoryBackend) DeleteStorageLensConfigurationTagging 

func (b *InMemoryBackend) DeleteStorageLensConfigurationTagging(accountID, configName string) error

DeleteStorageLensConfigurationTagging removes all tags from a Storage Lens configuration.

func (*InMemoryBackend) DeleteStorageLensGroup 

func (b *InMemoryBackend) DeleteStorageLensGroup(accountID, name string) error

DeleteStorageLensGroup removes a Storage Lens group and cascade-cleans its generic resource tags.

func (*InMemoryBackend) DescribeMultiRegionAccessPointOperation 

func (b *InMemoryBackend) DescribeMultiRegionAccessPointOperation(
	accountID, requestToken string,
) (*MultiRegionAccessPointRequest, error)

DescribeMultiRegionAccessPointOperation returns the status of an MRAP async operation.

func (*InMemoryBackend) DissociateAccessGrantsIdentityCenter 

func (b *InMemoryBackend) DissociateAccessGrantsIdentityCenter(accountID string)

DissociateAccessGrantsIdentityCenter removes the identity center association.

func (*InMemoryBackend) GetAccessGrant 

func (b *InMemoryBackend) GetAccessGrant(accountID, grantID string) (*AccessGrant, error)

GetAccessGrant returns an access grant by ID.

func (*InMemoryBackend) GetAccessGrantsInstance 

func (b *InMemoryBackend) GetAccessGrantsInstance(accountID string) (*AccessGrantsInstance, error)

func (*InMemoryBackend) GetAccessGrantsInstanceForPrefix 

func (b *InMemoryBackend) GetAccessGrantsInstanceForPrefix(
	accountID, prefix string,
) (*AccessGrantsInstance, error)

GetAccessGrantsInstanceForPrefix returns the AGI for a given S3 prefix.

func (*InMemoryBackend) GetAccessGrantsInstanceResourcePolicy 

func (b *InMemoryBackend) GetAccessGrantsInstanceResourcePolicy(accountID string) (string, error)

GetAccessGrantsInstanceResourcePolicy returns the resource policy for an AGI.

func (*InMemoryBackend) GetAccessGrantsLocation 

func (b *InMemoryBackend) GetAccessGrantsLocation(
	accountID, locationID string,
) (*AccessGrantsLocation, error)

GetAccessGrantsLocation returns an access grants location by ID.

func (*InMemoryBackend) GetAccessPoint 

func (b *InMemoryBackend) GetAccessPoint(accountID, name string) (*AccessPoint, error)

GetAccessPoint retrieves an S3 access point by name.

func (*InMemoryBackend) GetAccessPointConfigurationForObjectLambda 

func (b *InMemoryBackend) GetAccessPointConfigurationForObjectLambda(
	accountID, name string,
) (string, error)

GetAccessPointConfigurationForObjectLambda returns the configuration for an Object Lambda AP.

func (*InMemoryBackend) GetAccessPointForObjectLambda 

func (b *InMemoryBackend) GetAccessPointForObjectLambda(
	accountID, name string,
) (*ObjectLambdaAccessPoint, error)

GetAccessPointForObjectLambda returns an Object Lambda access point.

func (*InMemoryBackend) GetAccessPointPolicy 

func (b *InMemoryBackend) GetAccessPointPolicy(accountID, name string) (string, error)

GetAccessPointPolicy retrieves the policy for an access point.

func (*InMemoryBackend) GetAccessPointPolicyForObjectLambda 

func (b *InMemoryBackend) GetAccessPointPolicyForObjectLambda(
	accountID, name string,
) (string, error)

GetAccessPointPolicyForObjectLambda returns the policy for an Object Lambda AP.

func (*InMemoryBackend) GetAccessPointPolicyStatusForObjectLambda 

func (b *InMemoryBackend) GetAccessPointPolicyStatusForObjectLambda(
	accountID, name string,
) (bool, error)

GetAccessPointPolicyStatusForObjectLambda returns the policy status for an Object Lambda AP.

func (*InMemoryBackend) GetAccessPointPublicAccessBlock 

func (b *InMemoryBackend) GetAccessPointPublicAccessBlock(accountID, name string) (*PublicAccessBlock, error)

GetAccessPointPublicAccessBlock returns the public access block configuration for an access point.

func (*InMemoryBackend) GetAccessPointScope 

func (b *InMemoryBackend) GetAccessPointScope(accountID, name string) (string, error)

GetAccessPointScope returns the scope for an access point.

func (*InMemoryBackend) GetBucket 

func (b *InMemoryBackend) GetBucket(bucketName string) (*OutpostsBucket, error)

GetBucket returns an Outposts bucket. See the CreateBucket doc comment above for why lookup is by bucketName alone, not accountID+bucketName.

func (*InMemoryBackend) GetBucketLifecycleConfiguration 

func (b *InMemoryBackend) GetBucketLifecycleConfiguration(bucketName string) (string, error)

GetBucketLifecycleConfiguration returns lifecycle config for an Outposts bucket.

func (*InMemoryBackend) GetBucketPolicy 

func (b *InMemoryBackend) GetBucketPolicy(bucketName string) (string, error)

GetBucketPolicy returns the policy for an Outposts bucket.

func (*InMemoryBackend) GetBucketReplication 

func (b *InMemoryBackend) GetBucketReplication(bucketName string) (string, error)

GetBucketReplication retrieves the replication configuration for an Outposts bucket.

func (*InMemoryBackend) GetBucketTagging 

func (b *InMemoryBackend) GetBucketTagging(bucketName string) (TagSet, error)

GetBucketTagging returns tags for an Outposts bucket.

func (*InMemoryBackend) GetBucketVersioning 

func (b *InMemoryBackend) GetBucketVersioning(bucketName string) (string, error)

GetBucketVersioning returns the versioning state for an Outposts bucket.

func (*InMemoryBackend) GetDataAccess 

func (b *InMemoryBackend) GetDataAccess(accountID, target, permission string) (string, error)

GetDataAccess returns a presigned URL for accessing data via access grants.

func (*InMemoryBackend) GetJob 

func (b *InMemoryBackend) GetJob(accountID, jobID string) (*BatchJob, error)

GetJob retrieves a batch job by ID.

func (*InMemoryBackend) GetJobTagging 

func (b *InMemoryBackend) GetJobTagging(accountID, jobID string) (TagSet, error)

GetJobTagging returns tags for a batch job.

func (*InMemoryBackend) GetMultiRegionAccessPoint 

func (b *InMemoryBackend) GetMultiRegionAccessPoint(accountID, name string) (*MultiRegionAccessPoint, error)

GetMultiRegionAccessPoint retrieves an MRAP by name.

func (*InMemoryBackend) GetMultiRegionAccessPointPolicy 

func (b *InMemoryBackend) GetMultiRegionAccessPointPolicy(accountID, name string) (string, error)

GetMultiRegionAccessPointPolicy returns the policy for an MRAP.

func (*InMemoryBackend) GetMultiRegionAccessPointPolicyStatus 

func (b *InMemoryBackend) GetMultiRegionAccessPointPolicyStatus(
	accountID, name string,
) (bool, error)

GetMultiRegionAccessPointPolicyStatus returns whether the MRAP policy is public.

func (*InMemoryBackend) GetMultiRegionAccessPointRoutes 

func (b *InMemoryBackend) GetMultiRegionAccessPointRoutes(accountID, mrap string) (string, error)

GetMultiRegionAccessPointRoutes returns the routing configuration for an MRAP.

func (*InMemoryBackend) GetPublicAccessBlock 

func (b *InMemoryBackend) GetPublicAccessBlock(accountID string) (*PublicAccessBlock, error)

GetPublicAccessBlock retrieves the public access block configuration for an account.

func (*InMemoryBackend) GetStorageLensConfiguration 

func (b *InMemoryBackend) GetStorageLensConfiguration(accountID, configName string) (string, error)

GetStorageLensConfiguration retrieves a Storage Lens configuration.

func (*InMemoryBackend) GetStorageLensConfigurationTagging 

func (b *InMemoryBackend) GetStorageLensConfigurationTagging(accountID, configName string) (TagSet, error)

GetStorageLensConfigurationTagging retrieves tags for a Storage Lens configuration.

func (*InMemoryBackend) GetStorageLensGroup 

func (b *InMemoryBackend) GetStorageLensGroup(accountID, name string) (*StorageLensGroup, error)

GetStorageLensGroup retrieves a Storage Lens group by name.

func (*InMemoryBackend) ListAccessGrants 

func (b *InMemoryBackend) ListAccessGrants(accountID, locationScope string) []*AccessGrant

ListAccessGrants returns all access grants for an account, optionally filtered by locationScope.

func (*InMemoryBackend) ListAccessGrantsInstances 

func (b *InMemoryBackend) ListAccessGrantsInstances(accountID string) []*AccessGrantsInstance

ListAccessGrantsInstances returns all Access Grants instances for the account.

func (*InMemoryBackend) ListAccessGrantsLocations 

func (b *InMemoryBackend) ListAccessGrantsLocations(accountID string) []*AccessGrantsLocation

ListAccessGrantsLocations returns all locations for an account.

func (*InMemoryBackend) ListAccessPoints 

func (b *InMemoryBackend) ListAccessPoints(accountID string) []*AccessPoint

ListAccessPoints returns all access points for an account.

func (*InMemoryBackend) ListAccessPointsForDirectoryBuckets 

func (b *InMemoryBackend) ListAccessPointsForDirectoryBuckets(accountID string) []*AccessPoint

ListAccessPointsForDirectoryBuckets returns access points for directory buckets.

func (*InMemoryBackend) ListAccessPointsForObjectLambda 

func (b *InMemoryBackend) ListAccessPointsForObjectLambda(
	accountID string,
) []*ObjectLambdaAccessPoint

ListAccessPointsForObjectLambda lists Object Lambda access points for an account.

func (*InMemoryBackend) ListAll 

func (b *InMemoryBackend) ListAll() []PublicAccessBlock

ListAll returns all stored public access block configurations.

func (*InMemoryBackend) ListCallerAccessGrants 

func (b *InMemoryBackend) ListCallerAccessGrants(accountID string) []*AccessGrant

ListCallerAccessGrants returns access grants visible to the caller.

func (*InMemoryBackend) ListJobs 

func (b *InMemoryBackend) ListJobs(accountID string) []*BatchJob

ListJobs returns all batch jobs for an account.

func (*InMemoryBackend) ListMultiRegionAccessPoints 

func (b *InMemoryBackend) ListMultiRegionAccessPoints(accountID string) []*MultiRegionAccessPoint

ListMultiRegionAccessPoints returns all MRAPs for an account.

func (*InMemoryBackend) ListRegionalBuckets 

func (b *InMemoryBackend) ListRegionalBuckets() []*OutpostsBucket

ListRegionalBuckets lists every Outposts bucket. Real ListRegionalBucketsInput binds AccountId (optionally) too, but for the same reason GetBucket/ DeleteBucket don't filter/key by it -- see the CreateBucket doc comment above -- there is no reliable per-account partition to filter against, so this returns every bucket regardless of the caller's AccountId header.

func (*InMemoryBackend) ListStorageLensConfigurations 

func (b *InMemoryBackend) ListStorageLensConfigurations(accountID string) []string

ListStorageLensConfigurations returns the names of all Storage Lens configurations for an account.

func (*InMemoryBackend) ListStorageLensGroups 

func (b *InMemoryBackend) ListStorageLensGroups(accountID string) []*StorageLensGroup

ListStorageLensGroups returns all Storage Lens groups for an account.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(arn string) map[string]string

ListTagsForResource returns all tags for the given ARN.

func (*InMemoryBackend) PutAccessGrantsInstanceResourcePolicy 

func (b *InMemoryBackend) PutAccessGrantsInstanceResourcePolicy(accountID, policy string)

PutAccessGrantsInstanceResourcePolicy sets the resource policy for an AGI.

func (*InMemoryBackend) PutAccessPointConfigurationForObjectLambda 

func (b *InMemoryBackend) PutAccessPointConfigurationForObjectLambda(
	accountID, name, config string,
) error

PutAccessPointConfigurationForObjectLambda sets the configuration for an Object Lambda AP.

func (*InMemoryBackend) PutAccessPointPolicy 

func (b *InMemoryBackend) PutAccessPointPolicy(accountID, name, policy string) error

PutAccessPointPolicy stores a policy for an access point.

func (*InMemoryBackend) PutAccessPointPolicyForObjectLambda 

func (b *InMemoryBackend) PutAccessPointPolicyForObjectLambda(
	accountID, name, policy string,
) error

PutAccessPointPolicyForObjectLambda sets the policy for an Object Lambda AP.

func (*InMemoryBackend) PutAccessPointPublicAccessBlock 

func (b *InMemoryBackend) PutAccessPointPublicAccessBlock(accountID, name string, cfg PublicAccessBlock) error

PutAccessPointPublicAccessBlock sets the public access block configuration for an access point.

func (*InMemoryBackend) PutAccessPointScope 

func (b *InMemoryBackend) PutAccessPointScope(accountID, name, scope string) error

PutAccessPointScope sets the scope for an access point.

func (*InMemoryBackend) PutBucketLifecycleConfiguration 

func (b *InMemoryBackend) PutBucketLifecycleConfiguration(bucketName, lifecycleConfig string) error

PutBucketLifecycleConfiguration sets lifecycle config for an Outposts bucket.

func (*InMemoryBackend) PutBucketPolicy 

func (b *InMemoryBackend) PutBucketPolicy(bucketName, policy string) error

PutBucketPolicy sets the policy for an Outposts bucket.

func (*InMemoryBackend) PutBucketReplication 

func (b *InMemoryBackend) PutBucketReplication(bucketName, config string) error

PutBucketReplication stores a replication configuration for an Outposts bucket.

func (*InMemoryBackend) PutBucketTagging 

func (b *InMemoryBackend) PutBucketTagging(bucketName string, tags TagSet) error

PutBucketTagging sets tags on an Outposts bucket.

func (*InMemoryBackend) PutBucketVersioning 

func (b *InMemoryBackend) PutBucketVersioning(bucketName, status string) error

PutBucketVersioning sets the versioning state for an Outposts bucket.

func (*InMemoryBackend) PutJobTagging 

func (b *InMemoryBackend) PutJobTagging(accountID, jobID string, tags TagSet) error

PutJobTagging sets tags on a batch job.

func (*InMemoryBackend) PutMultiRegionAccessPointPolicy 

func (b *InMemoryBackend) PutMultiRegionAccessPointPolicy(accountID, name, policy string) error

PutMultiRegionAccessPointPolicy stores a policy for an MRAP.

func (*InMemoryBackend) PutPublicAccessBlock 

func (b *InMemoryBackend) PutPublicAccessBlock(cfg PublicAccessBlock)

PutPublicAccessBlock creates or updates the public access block configuration for an account.

func (*InMemoryBackend) PutStorageLensConfiguration 

func (b *InMemoryBackend) PutStorageLensConfiguration(accountID, configName, config string) error

PutStorageLensConfiguration stores a Storage Lens configuration.

func (*InMemoryBackend) PutStorageLensConfigurationTagging 

func (b *InMemoryBackend) PutStorageLensConfigurationTagging(accountID, configName string, tags TagSet) error

PutStorageLensConfigurationTagging sets tags on a Storage Lens configuration.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region configured for this backend.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all stored resources without recreating the backend.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) SetAccessPointVpcConfig 

func (b *InMemoryBackend) SetAccessPointVpcConfig(accountID, name, vpcID, bucketAccountID string) error

SetAccessPointVpcConfig sets VPC configuration fields on an existing access point. NetworkOrigin is set to "VPC" when vpcID is non-empty, else "Internet". Alias is cleared for VPC access points (AWS does not emit an alias for VPC APs).

func (*InMemoryBackend) SetMRAPRegions 

func (b *InMemoryBackend) SetMRAPRegions(accountID, name string, regions []string) error

SetMRAPRegions stores the bucket-region list for an MRAP.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) SubmitMultiRegionAccessPointRoutes 

func (b *InMemoryBackend) SubmitMultiRegionAccessPointRoutes(accountID, mrap, routes string) error

SubmitMultiRegionAccessPointRoutes stores routing configuration for an MRAP.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(arn string, tags map[string]string)

TagResource adds or updates tags on the given ARN.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(arn string, tagKeys []string)

UntagResource removes specific tag keys from the given ARN.

func (*InMemoryBackend) UpdateAccessGrantsLocation 

func (b *InMemoryBackend) UpdateAccessGrantsLocation(
	accountID, locationID, iamRoleArn string,
) (*AccessGrantsLocation, error)

UpdateAccessGrantsLocation updates the IAM role ARN for a location.

func (*InMemoryBackend) UpdateJobDetails 

func (b *InMemoryBackend) UpdateJobDetails(
	accountID, jobID, description, manifest, operation, report string,
	confirmationRequired bool,
) error

UpdateJobDetails persists the extended fields from a CreateJob request to an existing job.

func (*InMemoryBackend) UpdateJobPriority 

func (b *InMemoryBackend) UpdateJobPriority(accountID, jobID string, priority int32) (*BatchJob, error)

UpdateJobPriority changes the priority of a batch job.

func (*InMemoryBackend) UpdateJobStatus 

func (b *InMemoryBackend) UpdateJobStatus(accountID, jobID, status string) (*BatchJob, error)

UpdateJobStatus changes the status of a batch job.

func (*InMemoryBackend) UpdateJobStatusValidated 

func (b *InMemoryBackend) UpdateJobStatusValidated(
	accountID, jobID, requestedStatus, statusUpdateReason string,
) (*BatchJob, error)

UpdateJobStatusValidated changes the status of a batch job after validating the requested transition.

func (*InMemoryBackend) UpdateStorageLensGroup 

func (b *InMemoryBackend) UpdateStorageLensGroup(accountID, name string) (*StorageLensGroup, error)

UpdateStorageLensGroup updates a Storage Lens group (currently a no-op that confirms existence).

func (*InMemoryBackend) UpdateStorageLensGroupFilter 

func (b *InMemoryBackend) UpdateStorageLensGroupFilter(accountID, name, filter string) error

UpdateStorageLensGroupFilter stores the filter XML for an existing Storage Lens group.

type MultiRegionAccessPoint 

type MultiRegionAccessPoint struct {
	AccountID string   `json:"accountID"`
	Name      string   `json:"name"`
	Alias     string   `json:"alias"`
	Status    string   `json:"status"`
	Policy    string   `json:"policy,omitempty"`
	CreatedAt string   `json:"createdAt,omitempty"`
	Regions   []string `json:"regions,omitempty"`
}

MultiRegionAccessPoint represents a stored MRAP instance.

type MultiRegionAccessPointRequest 

type MultiRegionAccessPointRequest struct {
	AccountID string `json:"accountID"`
	// Token is the bare request token this value is keyed by in the
	// mrapRequests Table (see store_setup.go); RequestTokenARN embeds it but
	// as a full ARN, not a value store.Table's keyFn can use directly.
	// Tagged json:"-" because mrapRequests is a "dirty" table --
	// persistence.go round-trips it through a dedicated DTO that carries
	// Token as a real JSON field, so it survives the round trip despite
	// being excluded here. It must never change after the value is created
	// (store.Table's keyFn purity requirement).
	Token           string `json:"-"`
	RequestTokenARN string `json:"requestTokenARN"`
	Name            string `json:"name"`
}

MultiRegionAccessPointRequest represents an MRAP async request.

type ObjectLambdaAccessPoint 

type ObjectLambdaAccessPoint struct {
	AccountID                  string `json:"accountID"`
	Name                       string `json:"name"`
	ObjectLambdaAccessPointArn string `json:"objectLambdaAccessPointArn"`
}

ObjectLambdaAccessPoint represents an S3 Object Lambda access point.

type OutpostsBucket 

type OutpostsBucket struct {
	AccountID string `json:"accountID"`
	Name      string `json:"name"`
	BucketArn string `json:"bucketArn"`
	Location  string `json:"location"`
}

OutpostsBucket represents an S3 Outposts bucket.

type Provider 

type Provider struct{}

Provider implements service.Provider for S3 Control.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the S3 Control service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type PublicAccessBlock 

type PublicAccessBlock struct {
	AccountID string `json:"accountID"`
	// APName is the access point name this value is keyed by in the
	// accessPointPABs Table (see store_setup.go); it is always empty for
	// entries in the account-level configs Table. Tagged json:"-" because
	// accessPointPABs is a "dirty" table -- persistence.go round-trips it
	// through a dedicated DTO that carries APName as a real JSON field, so
	// it survives the round trip despite being excluded here. It must never
	// change after the value is created (store.Table's keyFn purity
	// requirement).
	APName                string `json:"-"`
	BlockPublicAcls       bool   `json:"blockPublicAcls"`
	IgnorePublicAcls      bool   `json:"ignorePublicAcls"`
	BlockPublicPolicy     bool   `json:"blockPublicPolicy"`
	RestrictPublicBuckets bool   `json:"restrictPublicBuckets"`
}

PublicAccessBlock represents the S3 Control public access block configuration.

This type backs two distinct store.Table instances (see store_setup.go): the account-level "configs" table (keyed by AccountID alone) and the per-access-point "accessPointPABs" table (keyed by AccountID+APName).

type StorageBackend 

type StorageBackend interface {
	PutPublicAccessBlock(cfg PublicAccessBlock)
	GetPublicAccessBlock(accountID string) (*PublicAccessBlock, error)
	DeletePublicAccessBlock(accountID string) error
	ListAll() []PublicAccessBlock

	AssociateAccessGrantsIdentityCenter(accountID, identityCenterArn string)
	CreateAccessGrantsInstance(accountID, identityCenterArn string) *AccessGrantsInstance
	CreateAccessGrant(
		accountID, locationID, granteeType, granteeIdentifier, permission, applicationArn string,
	) (*AccessGrant, error)
	CreateAccessGrantsLocation(accountID, locationScope, iamRoleArn string) *AccessGrantsLocation
	CreateAccessPoint(accountID, name, bucket string) *AccessPoint
	GetAccessPoint(accountID, name string) (*AccessPoint, error)
	DeleteAccessPoint(accountID, name string) error
	ListAccessPoints(accountID string) []*AccessPoint
	PutAccessPointPolicy(accountID, name, policy string) error
	GetAccessPointPolicy(accountID, name string) (string, error)
	DeleteAccessPointPolicy(accountID, name string) error
	CreateAccessPointForObjectLambda(accountID, name string) *ObjectLambdaAccessPoint
	CreateBucket(accountID, bucketName string) *OutpostsBucket
	CreateJob(accountID, roleArn string, priority int32) (*BatchJob, error)
	GetJob(accountID, jobID string) (*BatchJob, error)
	ListJobs(accountID string) []*BatchJob
	UpdateJobPriority(accountID, jobID string, priority int32) (*BatchJob, error)
	UpdateJobStatus(accountID, jobID, status string) (*BatchJob, error)
	CreateMultiRegionAccessPoint(accountID, name, clientToken string) *MultiRegionAccessPointRequest
	GetMultiRegionAccessPoint(accountID, name string) (*MultiRegionAccessPoint, error)
	DeleteMultiRegionAccessPoint(accountID, name string) error
	ListMultiRegionAccessPoints(accountID string) []*MultiRegionAccessPoint
	PutMultiRegionAccessPointPolicy(accountID, name, policy string) error
	CreateStorageLensGroup(accountID, name string) *StorageLensGroup

	Reset()
	AccountID() string
	Region() string

	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error

	// Job tagging
	PutJobTagging(accountID, jobID string, tags TagSet) error
	GetJobTagging(accountID, jobID string) (TagSet, error)
	DeleteJobTagging(accountID, jobID string) error

	// Access Grants Instance
	GetAccessGrantsInstance(accountID string) (*AccessGrantsInstance, error)
	DeleteAccessGrantsInstance(accountID string) error
	GetAccessGrantsInstanceResourcePolicy(accountID string) (string, error)
	PutAccessGrantsInstanceResourcePolicy(accountID, policy string)
	DeleteAccessGrantsInstanceResourcePolicy(accountID string)
	DissociateAccessGrantsIdentityCenter(accountID string)
	GetAccessGrantsInstanceForPrefix(accountID, prefix string) (*AccessGrantsInstance, error)

	// Access Grants CRUD
	GetAccessGrant(accountID, grantID string) (*AccessGrant, error)
	DeleteAccessGrant(accountID, grantID string) error
	ListAccessGrants(accountID, locationScope string) []*AccessGrant
	ListCallerAccessGrants(accountID string) []*AccessGrant
	GetAccessGrantsLocation(accountID, locationID string) (*AccessGrantsLocation, error)
	DeleteAccessGrantsLocation(accountID, locationID string) error
	UpdateAccessGrantsLocation(accountID, locationID, iamRoleArn string) (*AccessGrantsLocation, error)
	ListAccessGrantsLocations(accountID string) []*AccessGrantsLocation
	GetDataAccess(accountID, target, permission string) (string, error)

	// Access Point Scope
	GetAccessPointScope(accountID, name string) (string, error)
	PutAccessPointScope(accountID, name, scope string) error
	DeleteAccessPointScope(accountID, name string) error
	ListAccessPointsForDirectoryBuckets(accountID string) []*AccessPoint

	// Object Lambda Access Points
	GetAccessPointForObjectLambda(accountID, name string) (*ObjectLambdaAccessPoint, error)
	DeleteAccessPointForObjectLambda(accountID, name string) error
	ListAccessPointsForObjectLambda(accountID string) []*ObjectLambdaAccessPoint
	GetAccessPointPolicyForObjectLambda(accountID, name string) (string, error)
	PutAccessPointPolicyForObjectLambda(accountID, name, policy string) error
	DeleteAccessPointPolicyForObjectLambda(accountID, name string) error
	GetAccessPointPolicyStatusForObjectLambda(accountID, name string) (bool, error)
	GetAccessPointConfigurationForObjectLambda(accountID, name string) (string, error)
	PutAccessPointConfigurationForObjectLambda(accountID, name, config string) error

	// Outposts Bucket. Unlike every other resource family in this interface,
	// these are NOT accountID-keyed -- see the CreateBucket doc comment in
	// bucket.go (gopherstack-eje5): the real CreateBucketInput carries no
	// AccountId at all, so bucket identity and its sub-resource state are
	// keyed by bucketName alone.
	GetBucket(bucketName string) (*OutpostsBucket, error)
	DeleteBucket(bucketName string) error
	GetBucketLifecycleConfiguration(bucketName string) (string, error)
	PutBucketLifecycleConfiguration(bucketName, lifecycleConfig string) error
	DeleteBucketLifecycleConfiguration(bucketName string) error
	GetBucketPolicy(bucketName string) (string, error)
	PutBucketPolicy(bucketName, policy string) error
	DeleteBucketPolicy(bucketName string) error
	GetBucketTagging(bucketName string) (TagSet, error)
	PutBucketTagging(bucketName string, tags TagSet) error
	DeleteBucketTagging(bucketName string) error
	GetBucketVersioning(bucketName string) (string, error)
	PutBucketVersioning(bucketName, status string) error
	ListRegionalBuckets() []*OutpostsBucket

	// MRAP
	DescribeMultiRegionAccessPointOperation(accountID, requestToken string) (*MultiRegionAccessPointRequest, error)
	GetMultiRegionAccessPointPolicy(accountID, name string) (string, error)
	GetMultiRegionAccessPointPolicyStatus(accountID, name string) (bool, error)
	GetMultiRegionAccessPointRoutes(accountID, mrap string) (string, error)

	// Bucket Replication. Same bucketName-only keying as the Outposts Bucket
	// group above.
	GetBucketReplication(bucketName string) (string, error)
	PutBucketReplication(bucketName, config string) error
	DeleteBucketReplication(bucketName string) error

	// MRAP routes (submit)
	SubmitMultiRegionAccessPointRoutes(accountID, mrap, routes string) error

	// Storage Lens Configuration
	GetStorageLensConfiguration(accountID, configName string) (string, error)
	PutStorageLensConfiguration(accountID, configName, config string) error
	DeleteStorageLensConfiguration(accountID, configName string) error
	GetStorageLensConfigurationTagging(accountID, configName string) (TagSet, error)
	PutStorageLensConfigurationTagging(accountID, configName string, tags TagSet) error
	DeleteStorageLensConfigurationTagging(accountID, configName string) error
	ListStorageLensConfigurations(accountID string) []string

	// Storage Lens Groups (additional CRUD)
	GetStorageLensGroup(accountID, name string) (*StorageLensGroup, error)
	UpdateStorageLensGroup(accountID, name string) (*StorageLensGroup, error)
	DeleteStorageLensGroup(accountID, name string) error
	ListStorageLensGroups(accountID string) []*StorageLensGroup

	// Resource Tags
	ListTagsForResource(arn string) map[string]string
	TagResource(arn string, tags map[string]string)
	UntagResource(arn string, tagKeys []string)

	// AccessPoint VPC configuration
	SetAccessPointVpcConfig(accountID, name, vpcID, bucketAccountID string) error

	// AccessPoint per-AP public access block. NOT separate AWS operations --
	// aws-sdk-go-v2/service/s3control has no Get/Put/DeleteAccessPoint
	// PublicAccessBlock ops. These back the PublicAccessBlockConfiguration
	// field that travels inline on CreateAccessPoint/GetAccessPoint instead
	// (see handler_access_points.go); do not route them as standalone ops.
	GetAccessPointPublicAccessBlock(accountID, name string) (*PublicAccessBlock, error)
	PutAccessPointPublicAccessBlock(accountID, name string, cfg PublicAccessBlock) error
	DeleteAccessPointPublicAccessBlock(accountID, name string) error

	// BatchJob extended fields
	UpdateJobDetails(accountID, jobID, description, manifest, operation, report string, confirmationRequired bool) error
	UpdateJobStatusValidated(accountID, jobID, requestedStatus, statusUpdateReason string) (*BatchJob, error)

	// MRAP regions
	SetMRAPRegions(accountID, name string, regions []string) error

	// StorageLensGroup filter
	UpdateStorageLensGroupFilter(accountID, name, filter string) error
}

StorageBackend defines the interface for S3 Control backend implementations. All mutating methods must be safe for concurrent use.

type StorageLensGroup 

type StorageLensGroup struct {
	AccountID           string `json:"accountID"`
	Name                string `json:"name"`
	StorageLensGroupArn string `json:"storageLensGroupArn"`
	Filter              string `json:"filter,omitempty"`
	CreatedAt           string `json:"createdAt,omitempty"`
}

StorageLensGroup represents an S3 Storage Lens group.

type TagSet 

type TagSet map[string]string

TagSet represents a key-value tag map.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.