s3control

package
v1.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 6, 2026 License: MIT Imports: 23 Imported by: 0

README

S3 Control

Parity grade: A · SDK aws-sdk-go-v2/service/s3control@v1.73.4 · last audited 2026-09-19 (2bc650bf9)

Coverage

Metric Value
PARITY entries audited 44 (44 ok)
Feature families 10 (10 ok)
Known gaps 4
Deferred items 3
Resource leaks fixed
Known gaps
  • "s3control.ErrAlreadyExists dead sentinel (errors.go) REMOVED this pass -- verified unreachable (repo-wide grep, zero call sites) and its real-AWS duplicate-CreateAccessPoint behavior is unverifiable (deserializers.go's awsRestxml_deserializeOpErrorCreateAccessPoint has zero modeled error cases, generic fallback only), so wiring it up would be a guess, not a fix."
  • "2026-09-13 (gopherstack-xhu2t): ListAccessPoints.DataSourceType (real semantics: default lists only S3-bucket-backed access points, 'ALL' lists every data source type) has no observable effect -- AccessPoint (models.go) has no DataSourceType/DataSourceId field and every access point this backend can create is bucket-backed, so both filter values are always byte-identical. Not fixed: a filter that can never change the output is dead plumbing, not a real fix. Needs a non-bucket data-source-type access point (e.g. S3 Tables) modeled first."
  • "2026-09-19: aws_s3control_bucket/_lifecycle_configuration/policy (S3 on Outposts) tried once via real terraform apply and left out. CreateBucket's OutpostsBucket.BucketArn hardcodes a literal op-00000000 outpost segment (bucket.go/arnFmtOutpostsBucket) instead of the caller-supplied outpost_id, and real CreateBucketInput carries no AccountId (already documented on CreateBucket) so the ARN's account segment is whatever accountIDFromRequest resolves to off a header the real op doesn't have -- with skip_requesting_account_id in the test provider that surfaced as literal 'default'. terraform-provider-aws's post-create Read then calls GetBucketTagging, which this backend correctly returns as NoSuchTagSetError (documented real AWS behavior, errors.go), but the provider's own error-handling for that path did not tolerate it in this sandbox and the apply failed with 'operation error S3 Control: GetBucketTagging ... NoSuchTagSetError'. Aws_s3control directory_bucket_access_point_scope (S3 Express One Zone / Local Zone) not attempted: needs a zone-suffixed directory bucket the emulator's S3 side does not model."
  • Unmodeled (2026-10-05): PutBucketVersioning MFA and the MfaDelete member (no MFA device model, and the bucket versioning store tracks Status only), PutBucketPolicy ConfirmRemoveSelfBucketAccess (no policy evaluation to detect a self-lockout), CreateBucket ACL/GrantFullControl/GrantRead/GrantReadACP/GrantWrite/GrantWriteACP/ObjectLockEnabledForBucket (S3 Control has no op that reads them back), ListCallerAccessGrants AllowedByApplication (no caller Identity Center application identity), the access-grant S3PrefixType request member and GetDataAccess TargetType/AuditContext (grant-scope matching against object paths is not modeled), the ListAccessPoints data-source id filter (same gap as the data-source type filter above), the multi-region access point delete and put-policy ClientToken members (no idempotent async-request replay).
Deferred
  • "AccessGrantsInstance / IdentityCenter association flows: state machine correctness beyond basic CRUD (the delete-grants-and-locations-first precondition IS enforced -- see the DeleteAccessGrantsInstance ops row)."
  • "Chaos fault-injection interaction with the fixed routes/leak (ChaosOperations() just echoes GetSupportedOperations(), unaffected)."
  • "GetDataAccess/CreateJob request-side ManifestGenerator (alternative to Manifest, letting a caller point at an S3 Inventory report) is accepted nowhere -- createJobRequestXML has no field for it. Needs a design decision on synthetic manifest generation (no real S3 Inventory data to point at), not a field-diff fix."

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrNilAppContext = errors.New("nil AppContext passed to S3Control Provider.Init")

ErrNilAppContext is returned by Init when a nil AppContext is passed.

View Source 
var ErrNotFound = awserr.New("NoSuchPublicAccessBlockConfiguration", awserr.ErrNotFound)

ErrNotFound is returned when public access block config is not found.

View Source 
var ErrValidation = awserr.New("BadRequestException", awserr.ErrInvalidParameter)

ErrValidation is returned when a required parameter is missing or invalid.

Functions

This section is empty.

Types

type AccessGrant 

type AccessGrant struct {
	AccountID              string `json:"accountID"`
	AccessGrantID          string `json:"accessGrantID"`
	AccessGrantArn         string `json:"accessGrantArn"`
	AccessGrantsLocationID string `json:"accessGrantsLocationID"`
	GrantScope             string `json:"grantScope"`
	Permission             string `json:"permission"`
	GranteeType            string `json:"granteeType"`
	GranteeIdentifier      string `json:"granteeIdentifier"`
	ApplicationArn         string `json:"applicationArn"`
	CreatedAt              string `json:"createdAt"`
}

AccessGrant represents an S3 Access Grants grant.

type AccessGrantsFilter 

type AccessGrantsFilter struct {
	GrantScope        string
	ApplicationArn    string
	GranteeIdentifier string
	GranteeType       string
	Permission        string
}

AccessGrantsFilter holds ListAccessGrants/ListCallerAccessGrants's query filters (s3control@v1.73.4 api_op_ListAccessGrants.go / api_op_ListCallerAccessGrants.go).

type AccessGrantsInstance 

type AccessGrantsInstance struct {
	AccountID                    string `json:"accountID"`
	AccessGrantsInstanceArn      string `json:"accessGrantsInstanceArn"`
	AccessGrantsInstanceID       string `json:"accessGrantsInstanceID"`
	IdentityCenterArn            string `json:"identityCenterArn"`
	IdentityCenterInstanceArn    string `json:"identityCenterInstanceArn"`
	IdentityCenterApplicationArn string `json:"identityCenterApplicationArn"`
	CreatedAt                    string `json:"createdAt"`
}

AccessGrantsInstance represents an S3 Access Grants instance.

type AccessGrantsLocation 

type AccessGrantsLocation struct {
	AccountID               string `json:"accountID"`
	AccessGrantsLocationID  string `json:"accessGrantsLocationID"`
	AccessGrantsLocationArn string `json:"accessGrantsLocationArn"`
	LocationScope           string `json:"locationScope"`
	IAMRoleArn              string `json:"iamRoleArn"`
	CreatedAt               string `json:"createdAt"`
}

AccessGrantsLocation represents an S3 Access Grants location.

type AccessGrantsPolicyMeta 

type AccessGrantsPolicyMeta struct {
	Organization string `json:"organization,omitempty"`
	CreatedAt    string `json:"createdAt,omitempty"`
}

AccessGrantsPolicyMeta is the Organization and creation time recorded by a resource-policy Put.

type AccessPoint 

type AccessPoint struct {
	AccountID       string `json:"accountID"`
	Name            string `json:"name"`
	Bucket          string `json:"bucket"`
	AccessPointArn  string `json:"accessPointArn"`
	Alias           string `json:"alias"`
	VpcID           string `json:"vpcID,omitempty"`
	BucketAccountID string `json:"bucketAccountID,omitempty"`
	NetworkOrigin   string `json:"networkOrigin"`
	CreationDate    string `json:"creationDate,omitempty"`
}

AccessPoint represents an S3 access point.

type BatchJob 

type BatchJob struct {
	Description          string `json:"description,omitempty"`
	TerminationDate      string `json:"terminationDate,omitempty"`
	JobArn               string `json:"jobArn"`
	RoleArn              string `json:"roleArn"`
	Status               string `json:"status"`
	StatusUpdateReason   string `json:"statusUpdateReason,omitempty"`
	Operation            string `json:"operation,omitempty"`
	AccountID            string `json:"accountID"`
	JobID                string `json:"jobID"`
	Report               string `json:"report,omitempty"`
	Manifest             string `json:"manifest,omitempty"`
	CreationTime         string `json:"creationTime,omitempty"`
	Priority             int32  `json:"priority"`
	ConfirmationRequired bool   `json:"confirmationRequired,omitempty"`
}

BatchJob represents an S3 Batch Operations job.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for S3 Control operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new S3 Control handler that serves other regions through lazily built per-region siblings.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this S3 Control instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the S3 Control operation from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the account ID from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported S3 Control operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function. Multi-Region Access Point operations are account-global, so every region is served from the home backend.

func (*Handler) IAMAction 

func (h *Handler) IAMAction(r *http.Request) string

IAMAction returns the IAM action for an S3 Control HTTP request.

func (*Handler) IAMOpFromRequest 

func (h *Handler) IAMOpFromRequest(r *http.Request) string

IAMOpFromRequest extracts the operation name from an HTTP request.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all backend state, including every non-home region.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches S3 Control requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable; other regions ride in an additive "regions" key.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for S3 Control resources.

Every map[string]*T resource field is backed by a *store.Table[T] (see pkgs/store and store_setup.go). "Clean" tables key off fields the value type already carries and are registered on registry, so Reset/Snapshot/ Restore collapse to one registry call each. "Dirty" tables (mrapRequests, accessPointPABs) key off a field with no natural home on the value type and are NOT registered on registry — persistence.go round-trips them through an ephemeral DTO store.Registry instead.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend with default config values.

func NewInMemoryBackendWithConfig 

func NewInMemoryBackendWithConfig(accountID, region string) *InMemoryBackend

NewInMemoryBackendWithConfig creates a new InMemoryBackend with explicit config values.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID configured for this backend.

func (*InMemoryBackend) AddAccessGrantInternal 

func (b *InMemoryBackend) AddAccessGrantInternal(
	accountID, locationID, granteeType, granteeIdentifier, permission string,
) *AccessGrant

AddAccessGrantInternal creates an access grant directly, for seeding test data.

func (*InMemoryBackend) AddAccessGrantsInstanceInternal 

func (b *InMemoryBackend) AddAccessGrantsInstanceInternal(accountID, identityCenterArn string) *AccessGrantsInstance

AddAccessGrantsInstanceInternal creates an access grants instance directly, for seeding test data.

func (*InMemoryBackend) AddAccessPointInternal 

func (b *InMemoryBackend) AddAccessPointInternal(accountID, name, bucket string) *AccessPoint

AddAccessPointInternal creates an access point directly, for seeding test data.

func (*InMemoryBackend) AddBatchJobInternal 

func (b *InMemoryBackend) AddBatchJobInternal(accountID, roleArn string, priority int32) *BatchJob

AddBatchJobInternal creates a batch job directly, for seeding test data.

func (*InMemoryBackend) AddPublicAccessBlockInternal 

func (b *InMemoryBackend) AddPublicAccessBlockInternal(accountID string, block *PublicAccessBlock)

AddPublicAccessBlockInternal stores a public access block directly, for seeding test data.

func (*InMemoryBackend) AssociateAccessGrantsIdentityCenter 

func (b *InMemoryBackend) AssociateAccessGrantsIdentityCenter(accountID, identityCenterArn string)

AssociateAccessGrantsIdentityCenter associates an IAM Identity Center instance with an S3 Access Grants instance.

func (*InMemoryBackend) CreateAccessGrant 

func (b *InMemoryBackend) CreateAccessGrant(
	accountID, locationID, granteeType, granteeIdentifier, permission, applicationArn, s3SubPrefix string,
) (*AccessGrant, error)

CreateAccessGrant creates an access grant for an account. Returns ErrValidation if permission is empty.

func (*InMemoryBackend) CreateAccessGrantsInstance 

func (b *InMemoryBackend) CreateAccessGrantsInstance(accountID, identityCenterArn string) *AccessGrantsInstance

CreateAccessGrantsInstance creates an S3 Access Grants instance for an account.

func (*InMemoryBackend) CreateAccessGrantsLocation 

func (b *InMemoryBackend) CreateAccessGrantsLocation(
	accountID, locationScope, iamRoleArn string,
) *AccessGrantsLocation

CreateAccessGrantsLocation creates an Access Grants location.

func (*InMemoryBackend) CreateAccessPoint 

func (b *InMemoryBackend) CreateAccessPoint(accountID, name, bucket string) *AccessPoint

CreateAccessPoint creates an S3 access point.

func (*InMemoryBackend) CreateAccessPointForObjectLambda 

func (b *InMemoryBackend) CreateAccessPointForObjectLambda(accountID, name string) *ObjectLambdaAccessPoint

CreateAccessPointForObjectLambda creates an Object Lambda access point.

func (*InMemoryBackend) CreateBucket 

func (b *InMemoryBackend) CreateBucket(accountID, bucketName string) *OutpostsBucket

CreateBucket creates an S3 Outposts bucket.

accountID is whatever accountIDFromRequest(c) resolves to (handler_bucket.go) — almost always "default", because real CreateBucketInput carries no AccountId field at all, unlike every other Create* op in this service (CreateAccessPoint, CreateJob, etc., all bind AccountId to the X-Amz-Account-Id header). Real S3 on Outposts uses OutpostId for that role instead: an Outpost belongs to exactly one account, so the bucket's owner is implied by the Outpost, not an explicit request field.

GetBucket/DeleteBucket/ListRegionalBuckets (and every bucket sub-resource op) DO accept AccountId on that header, optionally. Keying this resource by "accountID:bucketName" like every sibling resource would strand a bucket created via the headerless CreateBucket under "default" while a caller's account-bearing Get/Delete/List calls look elsewhere and never find it. Fix: OutpostsBucket identity (outpostsBucketKeyFn, store_setup.go) and its sub-resource state (bucketLifecycle/bucketPolicies/bucketTagging/ bucketVersioning/bucketReplication) are keyed by bucket Name alone. AccountID still flows into BucketArn but isn't part of any lookup key — mirroring real S3's own globally-unique-by-name bucket namespace.

func (*InMemoryBackend) CreateJob 

func (b *InMemoryBackend) CreateJob(accountID, roleArn string, priority int32) (*BatchJob, error)

CreateJob creates an S3 Batch Operations job. Returns ErrValidation if roleArn is empty.

func (*InMemoryBackend) CreateMRAPDeleteRequest 

func (b *InMemoryBackend) CreateMRAPDeleteRequest(accountID, name string) *MultiRegionAccessPointRequest

CreateMRAPDeleteRequest registers an async request record for a DeleteMultiRegionAccessPoint call and returns its token ARN, for the same reason as CreateMRAPPutPolicyRequest: a subsequent DescribeMultiRegionAccessPointOperation poll needs a real stored record.

func (*InMemoryBackend) CreateMRAPPutPolicyRequest 

func (b *InMemoryBackend) CreateMRAPPutPolicyRequest(accountID, name string) *MultiRegionAccessPointRequest

CreateMRAPPutPolicyRequest registers an async request record for a PutMultiRegionAccessPointPolicy call and returns its token ARN, so a subsequent DescribeMultiRegionAccessPointOperation poll against that ARN (the real provider polls every async MRAP mutation to completion) finds a real record instead of a token that was fabricated and never stored.

func (*InMemoryBackend) CreateMultiRegionAccessPoint 

func (b *InMemoryBackend) CreateMultiRegionAccessPoint(
	accountID, name, _ string,
) *MultiRegionAccessPointRequest

CreateMultiRegionAccessPoint creates an async MRAP request and stores the MRAP instance.

func (*InMemoryBackend) CreateStorageLensGroup 

func (b *InMemoryBackend) CreateStorageLensGroup(accountID, name string) *StorageLensGroup

CreateStorageLensGroup creates an S3 Storage Lens group.

func (*InMemoryBackend) DeleteAccessGrant 

func (b *InMemoryBackend) DeleteAccessGrant(accountID, grantID string) error

DeleteAccessGrant removes an access grant and cascade-cleans its generic resource tags.

func (*InMemoryBackend) DeleteAccessGrantsInstance 

func (b *InMemoryBackend) DeleteAccessGrantsInstance(accountID string) error

DeleteAccessGrantsInstance removes the Access Grants instance and cascade-cleans its resource policy and generic resource tags. It does NOT cascade-delete AccessGrants or AccessGrantsLocations — those, plus any Identity Center association, must be cleared first (see errAccessGrantsInstanceNotEmpty); any of the three still present rejects the delete instead of silently succeeding.

func (*InMemoryBackend) DeleteAccessGrantsInstanceResourcePolicy 

func (b *InMemoryBackend) DeleteAccessGrantsInstanceResourcePolicy(accountID string)

DeleteAccessGrantsInstanceResourcePolicy removes the resource policy.

func (*InMemoryBackend) DeleteAccessGrantsLocation 

func (b *InMemoryBackend) DeleteAccessGrantsLocation(accountID, locationID string) error

DeleteAccessGrantsLocation removes an access grants location and cascade-cleans its generic resource tags. Rejects the delete instead of silently succeeding while any access grant still references the location (see errAccessGrantsLocationNotEmpty).

func (*InMemoryBackend) DeleteAccessPoint 

func (b *InMemoryBackend) DeleteAccessPoint(accountID, name string) error

DeleteAccessPoint removes an S3 access point and cascade-cleans every piece of state keyed off it (policy, scope, per-AP PublicAccessBlock, generic resource tags) so a delete/recreate cycle under the same name never resurfaces stale state from the deleted access point.

func (*InMemoryBackend) DeleteAccessPointForObjectLambda 

func (b *InMemoryBackend) DeleteAccessPointForObjectLambda(accountID, name string) error

DeleteAccessPointForObjectLambda removes an Object Lambda access point and cascade-cleans its policy, configuration, and generic resource tags so a delete/recreate cycle under the same name never resurfaces stale state.

func (*InMemoryBackend) DeleteAccessPointPolicy 

func (b *InMemoryBackend) DeleteAccessPointPolicy(accountID, name string) error

DeleteAccessPointPolicy removes the policy for an access point.

func (*InMemoryBackend) DeleteAccessPointPolicyForObjectLambda 

func (b *InMemoryBackend) DeleteAccessPointPolicyForObjectLambda(accountID, name string) error

DeleteAccessPointPolicyForObjectLambda removes the policy from an Object Lambda AP.

func (*InMemoryBackend) DeleteAccessPointPublicAccessBlock 

func (b *InMemoryBackend) DeleteAccessPointPublicAccessBlock(accountID, name string) error

DeleteAccessPointPublicAccessBlock removes the public access block configuration for an access point.

func (*InMemoryBackend) DeleteAccessPointScope 

func (b *InMemoryBackend) DeleteAccessPointScope(accountID, name string) error

DeleteAccessPointScope removes the scope for an access point.

func (*InMemoryBackend) DeleteBucket 

func (b *InMemoryBackend) DeleteBucket(bucketName string) error

DeleteBucket removes an Outposts bucket and cascade-cleans every piece of state keyed off it (lifecycle, policy, tagging, versioning, replication, generic resource tags) so a delete/recreate cycle under the same name never resurfaces stale state from the deleted bucket. See the CreateBucket doc comment above for why lookup is by bucketName alone.

func (*InMemoryBackend) DeleteBucketLifecycleConfiguration 

func (b *InMemoryBackend) DeleteBucketLifecycleConfiguration(bucketName string) error

DeleteBucketLifecycleConfiguration removes lifecycle config from an Outposts bucket.

func (*InMemoryBackend) DeleteBucketPolicy 

func (b *InMemoryBackend) DeleteBucketPolicy(bucketName string) error

DeleteBucketPolicy removes the policy from an Outposts bucket.

func (*InMemoryBackend) DeleteBucketReplication 

func (b *InMemoryBackend) DeleteBucketReplication(bucketName string) error

DeleteBucketReplication removes the replication configuration for an Outposts bucket. Requires the bucket to exist, like DeleteBucketLifecycleConfiguration/DeleteBucketPolicy/DeleteBucketTagging; idempotent when the bucket exists but never had a replication config set, matching those same siblings.

func (*InMemoryBackend) DeleteBucketTagging 

func (b *InMemoryBackend) DeleteBucketTagging(bucketName string) error

DeleteBucketTagging removes all tags from an Outposts bucket.

func (*InMemoryBackend) DeleteJobTagging 

func (b *InMemoryBackend) DeleteJobTagging(accountID, jobID string) error

DeleteJobTagging removes all tags from a batch job.

func (*InMemoryBackend) DeleteMultiRegionAccessPoint 

func (b *InMemoryBackend) DeleteMultiRegionAccessPoint(accountID, name string) error

DeleteMultiRegionAccessPoint removes an MRAP and cascade-cleans its route configuration (policy lives on the MultiRegionAccessPoint value itself via PutMultiRegionAccessPointPolicy, so it goes away with the row). Must actually call b.mraps.Delete(key), not just check b.mraps.Has(key) — omitting the delete leaves a retrievable ghost row that accumulates across repeated create/delete cycles.

func (*InMemoryBackend) DeletePublicAccessBlock 

func (b *InMemoryBackend) DeletePublicAccessBlock(accountID string) error

DeletePublicAccessBlock deletes the public access block configuration for an account.

func (*InMemoryBackend) DeleteStorageLensConfiguration 

func (b *InMemoryBackend) DeleteStorageLensConfiguration(accountID, configName string) error

DeleteStorageLensConfiguration removes a Storage Lens configuration.

func (*InMemoryBackend) DeleteStorageLensConfigurationTagging 

func (b *InMemoryBackend) DeleteStorageLensConfigurationTagging(accountID, configName string) error

DeleteStorageLensConfigurationTagging removes all tags from a Storage Lens configuration.

func (*InMemoryBackend) DeleteStorageLensGroup 

func (b *InMemoryBackend) DeleteStorageLensGroup(accountID, name string) error

DeleteStorageLensGroup removes a Storage Lens group and cascade-cleans its generic resource tags.

func (*InMemoryBackend) DescribeMultiRegionAccessPointOperation 

func (b *InMemoryBackend) DescribeMultiRegionAccessPointOperation(
	accountID, requestToken string,
) (*MultiRegionAccessPointRequest, error)

DescribeMultiRegionAccessPointOperation returns the status of an MRAP async operation.

func (*InMemoryBackend) DissociateAccessGrantsIdentityCenter 

func (b *InMemoryBackend) DissociateAccessGrantsIdentityCenter(accountID string)

DissociateAccessGrantsIdentityCenter removes the identity center association.

func (*InMemoryBackend) GetAccessGrant 

func (b *InMemoryBackend) GetAccessGrant(accountID, grantID string) (*AccessGrant, error)

GetAccessGrant returns an access grant by ID.

func (*InMemoryBackend) GetAccessGrantsInstance 

func (b *InMemoryBackend) GetAccessGrantsInstance(accountID string) (*AccessGrantsInstance, error)

func (*InMemoryBackend) GetAccessGrantsInstanceForPrefix 

func (b *InMemoryBackend) GetAccessGrantsInstanceForPrefix(
	accountID, prefix string,
) (*AccessGrantsInstance, error)

GetAccessGrantsInstanceForPrefix returns the AGI for a given S3 prefix.

func (*InMemoryBackend) GetAccessGrantsInstanceResourcePolicy 

func (b *InMemoryBackend) GetAccessGrantsInstanceResourcePolicy(accountID string) (string, error)

GetAccessGrantsInstanceResourcePolicy returns the resource policy for an AGI.

func (*InMemoryBackend) GetAccessGrantsInstanceResourcePolicyMeta 

func (b *InMemoryBackend) GetAccessGrantsInstanceResourcePolicyMeta(accountID string) AccessGrantsPolicyMeta

GetAccessGrantsInstanceResourcePolicyMeta returns what the last Put recorded for accountID.

func (*InMemoryBackend) GetAccessGrantsLocation 

func (b *InMemoryBackend) GetAccessGrantsLocation(
	accountID, locationID string,
) (*AccessGrantsLocation, error)

GetAccessGrantsLocation returns an access grants location by ID.

func (*InMemoryBackend) GetAccessPoint 

func (b *InMemoryBackend) GetAccessPoint(accountID, name string) (*AccessPoint, error)

GetAccessPoint retrieves an S3 access point by name.

func (*InMemoryBackend) GetAccessPointConfigurationForObjectLambda 

func (b *InMemoryBackend) GetAccessPointConfigurationForObjectLambda(
	accountID, name string,
) (string, error)

GetAccessPointConfigurationForObjectLambda returns the configuration for an Object Lambda AP.

func (*InMemoryBackend) GetAccessPointForObjectLambda 

func (b *InMemoryBackend) GetAccessPointForObjectLambda(
	accountID, name string,
) (*ObjectLambdaAccessPoint, error)

GetAccessPointForObjectLambda returns an Object Lambda access point.

func (*InMemoryBackend) GetAccessPointPolicy 

func (b *InMemoryBackend) GetAccessPointPolicy(accountID, name string) (string, error)

GetAccessPointPolicy retrieves the policy for an access point.

func (*InMemoryBackend) GetAccessPointPolicyForObjectLambda 

func (b *InMemoryBackend) GetAccessPointPolicyForObjectLambda(
	accountID, name string,
) (string, error)

GetAccessPointPolicyForObjectLambda returns the policy for an Object Lambda AP.

func (*InMemoryBackend) GetAccessPointPolicyStatus added in v1.5.0 

func (b *InMemoryBackend) GetAccessPointPolicyStatus(accountID, name string) (bool, error)

GetAccessPointPolicyStatus reports whether an access point has a policy attached, mirroring the ObjectLambda/MRAP siblings' "policy set" heuristic (GetAccessPointPolicyStatusForObjectLambda, GetMultiRegionAccessPointPolicyStatus).

func (*InMemoryBackend) GetAccessPointPolicyStatusForObjectLambda 

func (b *InMemoryBackend) GetAccessPointPolicyStatusForObjectLambda(
	accountID, name string,
) (bool, error)

GetAccessPointPolicyStatusForObjectLambda returns the policy status for an Object Lambda AP.

func (*InMemoryBackend) GetAccessPointPublicAccessBlock 

func (b *InMemoryBackend) GetAccessPointPublicAccessBlock(accountID, name string) (*PublicAccessBlock, error)

GetAccessPointPublicAccessBlock returns the public access block configuration for an access point.

func (*InMemoryBackend) GetAccessPointScope 

func (b *InMemoryBackend) GetAccessPointScope(accountID, name string) (string, error)

GetAccessPointScope returns the scope for an access point.

func (*InMemoryBackend) GetBucket 

func (b *InMemoryBackend) GetBucket(bucketName string) (*OutpostsBucket, error)

GetBucket returns an Outposts bucket. See the CreateBucket doc comment above for why lookup is by bucketName alone, not accountID+bucketName.

func (*InMemoryBackend) GetBucketLifecycleConfiguration 

func (b *InMemoryBackend) GetBucketLifecycleConfiguration(bucketName string) (string, error)

GetBucketLifecycleConfiguration returns lifecycle config for an Outposts bucket.

func (*InMemoryBackend) GetBucketPolicy 

func (b *InMemoryBackend) GetBucketPolicy(bucketName string) (string, error)

GetBucketPolicy returns the policy for an Outposts bucket.

func (*InMemoryBackend) GetBucketReplication 

func (b *InMemoryBackend) GetBucketReplication(bucketName string) (string, error)

GetBucketReplication retrieves the replication configuration for an Outposts bucket. Requires the bucket to exist, like every other bucket sub-resource Get in this file (GetBucketLifecycleConfiguration, GetBucketPolicy, GetBucketTagging, GetBucketVersioning) -- this trio was previously the only bucket sub-resource ops that skipped the check.

func (*InMemoryBackend) GetBucketTagging 

func (b *InMemoryBackend) GetBucketTagging(bucketName string) (TagSet, error)

GetBucketTagging returns tags for an Outposts bucket. A bucket that has never had PutBucketTagging called on it (or had DeleteBucketTagging called since) has no tag set at all, not an empty one -- the real op documents this as its own error (NoSuchTagSetError), not a success with zero tags.

func (*InMemoryBackend) GetBucketVersioning 

func (b *InMemoryBackend) GetBucketVersioning(bucketName string) (string, error)

GetBucketVersioning returns the versioning state for an Outposts bucket.

func (*InMemoryBackend) GetDataAccess 

func (b *InMemoryBackend) GetDataAccess(accountID, target, permission string) (string, error)

GetDataAccess returns a presigned URL for accessing data via access grants.

func (*InMemoryBackend) GetJob 

func (b *InMemoryBackend) GetJob(accountID, jobID string) (*BatchJob, error)

GetJob retrieves a batch job by ID.

func (*InMemoryBackend) GetJobTagging 

func (b *InMemoryBackend) GetJobTagging(accountID, jobID string) (TagSet, error)

GetJobTagging returns tags for a batch job.

func (*InMemoryBackend) GetMultiRegionAccessPoint 

func (b *InMemoryBackend) GetMultiRegionAccessPoint(accountID, name string) (*MultiRegionAccessPoint, error)

GetMultiRegionAccessPoint retrieves an MRAP by name.

func (*InMemoryBackend) GetMultiRegionAccessPointPolicy 

func (b *InMemoryBackend) GetMultiRegionAccessPointPolicy(accountID, name string) (string, error)

GetMultiRegionAccessPointPolicy returns the policy for an MRAP.

func (*InMemoryBackend) GetMultiRegionAccessPointPolicyStatus 

func (b *InMemoryBackend) GetMultiRegionAccessPointPolicyStatus(
	accountID, name string,
) (bool, error)

GetMultiRegionAccessPointPolicyStatus returns whether the MRAP policy is public.

func (*InMemoryBackend) GetMultiRegionAccessPointRoutes 

func (b *InMemoryBackend) GetMultiRegionAccessPointRoutes(accountID, mrap string) (string, error)

GetMultiRegionAccessPointRoutes returns the routing configuration for an MRAP.

func (*InMemoryBackend) GetPublicAccessBlock 

func (b *InMemoryBackend) GetPublicAccessBlock(accountID string) (*PublicAccessBlock, error)

GetPublicAccessBlock retrieves the public access block configuration for an account.

func (*InMemoryBackend) GetStorageLensConfiguration 

func (b *InMemoryBackend) GetStorageLensConfiguration(accountID, configName string) (string, error)

GetStorageLensConfiguration retrieves a Storage Lens configuration.

func (*InMemoryBackend) GetStorageLensConfigurationTagging 

func (b *InMemoryBackend) GetStorageLensConfigurationTagging(accountID, configName string) (TagSet, error)

GetStorageLensConfigurationTagging retrieves tags for a Storage Lens configuration.

func (*InMemoryBackend) GetStorageLensGroup 

func (b *InMemoryBackend) GetStorageLensGroup(accountID, name string) (*StorageLensGroup, error)

GetStorageLensGroup retrieves a Storage Lens group by name.

func (*InMemoryBackend) ListAccessGrants 

func (b *InMemoryBackend) ListAccessGrants(accountID string, filter AccessGrantsFilter) []*AccessGrant

ListAccessGrants returns all access grants for an account matching filter.

func (*InMemoryBackend) ListAccessGrantsInstances 

func (b *InMemoryBackend) ListAccessGrantsInstances(accountID string) []*AccessGrantsInstance

ListAccessGrantsInstances returns all Access Grants instances for the account.

func (*InMemoryBackend) ListAccessGrantsLocations 

func (b *InMemoryBackend) ListAccessGrantsLocations(accountID string) []*AccessGrantsLocation

ListAccessGrantsLocations returns all locations for an account.

func (*InMemoryBackend) ListAccessPoints 

func (b *InMemoryBackend) ListAccessPoints(accountID string) []*AccessPoint

ListAccessPoints returns all access points for an account, sorted by name so the handler's index-based nextToken pagination (s3cPaginate) stays stable across calls -- store.Table.All()'s iteration order is unspecified.

func (*InMemoryBackend) ListAccessPointsForDirectoryBuckets 

func (b *InMemoryBackend) ListAccessPointsForDirectoryBuckets(accountID string) []*AccessPoint

ListAccessPointsForDirectoryBuckets returns access points for directory buckets.

func (*InMemoryBackend) ListAccessPointsForObjectLambda 

func (b *InMemoryBackend) ListAccessPointsForObjectLambda(
	accountID string,
) []*ObjectLambdaAccessPoint

ListAccessPointsForObjectLambda lists Object Lambda access points for an account.

func (*InMemoryBackend) ListAll 

func (b *InMemoryBackend) ListAll() []PublicAccessBlock

ListAll returns all stored public access block configurations.

func (*InMemoryBackend) ListCallerAccessGrants 

func (b *InMemoryBackend) ListCallerAccessGrants(accountID, grantScope string) []*AccessGrant

ListCallerAccessGrants returns access grants visible to the caller, optionally narrowed to grants whose scope begins with grantScope (the input documents a path fragment).

func (*InMemoryBackend) ListJobs 

func (b *InMemoryBackend) ListJobs(accountID string) []*BatchJob

ListJobs returns all batch jobs for an account, sorted by JobID so the handler's index-based nextToken pagination (s3cPaginate) stays stable across calls -- store.Table.All()'s iteration order is unspecified.

func (*InMemoryBackend) ListMultiRegionAccessPoints 

func (b *InMemoryBackend) ListMultiRegionAccessPoints(accountID string) []*MultiRegionAccessPoint

ListMultiRegionAccessPoints returns all MRAPs for an account, sorted by name so the handler's index-based nextToken pagination (s3cPaginate) stays stable across calls -- store.Table.All()'s iteration order is unspecified.

func (*InMemoryBackend) ListRegionalBuckets 

func (b *InMemoryBackend) ListRegionalBuckets() []*OutpostsBucket

ListRegionalBuckets lists every Outposts bucket. Real ListRegionalBucketsInput binds AccountId (optionally) too, but for the same reason GetBucket/ DeleteBucket don't filter/key by it -- see the CreateBucket doc comment above -- there is no reliable per-account partition to filter against, so this returns every bucket regardless of the caller's AccountId header.

func (*InMemoryBackend) ListStorageLensConfigurations 

func (b *InMemoryBackend) ListStorageLensConfigurations(accountID string) []string

ListStorageLensConfigurations returns the names of all Storage Lens configurations for an account, sorted so the handler's index-based nextToken pagination (s3cPaginate) stays stable across calls -- Go map iteration order is unspecified.

func (*InMemoryBackend) ListStorageLensGroups 

func (b *InMemoryBackend) ListStorageLensGroups(accountID string) []*StorageLensGroup

ListStorageLensGroups returns all Storage Lens groups for an account, sorted by name so the handler's index-based nextToken pagination (s3cPaginate) stays stable across calls -- store.Table.All()'s iteration order is unspecified.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(arn string) map[string]string

ListTagsForResource returns all tags for the given ARN.

func (*InMemoryBackend) PutAccessGrantsInstanceResourcePolicy 

func (b *InMemoryBackend) PutAccessGrantsInstanceResourcePolicy(accountID, policy string)

PutAccessGrantsInstanceResourcePolicy sets the resource policy for an AGI.

func (*InMemoryBackend) PutAccessGrantsInstanceResourcePolicyWithOrganization 

func (b *InMemoryBackend) PutAccessGrantsInstanceResourcePolicyWithOrganization(
	accountID, policy, organization string,
) AccessGrantsPolicyMeta

PutAccessGrantsInstanceResourcePolicyWithOrganization sets the policy and records Organization and CreatedAt.

func (*InMemoryBackend) PutAccessPointConfigurationForObjectLambda 

func (b *InMemoryBackend) PutAccessPointConfigurationForObjectLambda(
	accountID, name, config string,
) error

PutAccessPointConfigurationForObjectLambda sets the configuration for an Object Lambda AP.

func (*InMemoryBackend) PutAccessPointPolicy 

func (b *InMemoryBackend) PutAccessPointPolicy(accountID, name, policy string) error

PutAccessPointPolicy stores a policy for an access point.

func (*InMemoryBackend) PutAccessPointPolicyForObjectLambda 

func (b *InMemoryBackend) PutAccessPointPolicyForObjectLambda(
	accountID, name, policy string,
) error

PutAccessPointPolicyForObjectLambda sets the policy for an Object Lambda AP.

func (*InMemoryBackend) PutAccessPointPublicAccessBlock 

func (b *InMemoryBackend) PutAccessPointPublicAccessBlock(accountID, name string, cfg PublicAccessBlock) error

PutAccessPointPublicAccessBlock sets the public access block configuration for an access point.

func (*InMemoryBackend) PutAccessPointScope 

func (b *InMemoryBackend) PutAccessPointScope(accountID, name, scope string) error

PutAccessPointScope sets the scope for an access point.

func (*InMemoryBackend) PutBucketLifecycleConfiguration 

func (b *InMemoryBackend) PutBucketLifecycleConfiguration(bucketName, lifecycleConfig string) error

PutBucketLifecycleConfiguration sets lifecycle config for an Outposts bucket.

func (*InMemoryBackend) PutBucketPolicy 

func (b *InMemoryBackend) PutBucketPolicy(bucketName, policy string) error

PutBucketPolicy sets the policy for an Outposts bucket.

func (*InMemoryBackend) PutBucketReplication 

func (b *InMemoryBackend) PutBucketReplication(bucketName, config string) error

PutBucketReplication stores a replication configuration for an Outposts bucket. Requires the bucket to exist, like PutBucketLifecycleConfiguration/ PutBucketPolicy/PutBucketTagging/PutBucketVersioning.

func (*InMemoryBackend) PutBucketTagging 

func (b *InMemoryBackend) PutBucketTagging(bucketName string, tags TagSet) error

PutBucketTagging sets tags on an Outposts bucket.

func (*InMemoryBackend) PutBucketVersioning 

func (b *InMemoryBackend) PutBucketVersioning(bucketName, status string) error

PutBucketVersioning sets the versioning state for an Outposts bucket.

func (*InMemoryBackend) PutJobTagging 

func (b *InMemoryBackend) PutJobTagging(accountID, jobID string, tags TagSet) error

PutJobTagging sets tags on a batch job.

func (*InMemoryBackend) PutMultiRegionAccessPointPolicy 

func (b *InMemoryBackend) PutMultiRegionAccessPointPolicy(accountID, name, policy string) error

PutMultiRegionAccessPointPolicy stores a policy for an MRAP.

func (*InMemoryBackend) PutPublicAccessBlock 

func (b *InMemoryBackend) PutPublicAccessBlock(cfg PublicAccessBlock)

PutPublicAccessBlock creates or updates the public access block configuration for an account.

func (*InMemoryBackend) PutStorageLensConfiguration 

func (b *InMemoryBackend) PutStorageLensConfiguration(accountID, configName, config string) error

PutStorageLensConfiguration stores a Storage Lens configuration.

func (*InMemoryBackend) PutStorageLensConfigurationTagging 

func (b *InMemoryBackend) PutStorageLensConfigurationTagging(accountID, configName string, tags TagSet) error

PutStorageLensConfigurationTagging sets tags on a Storage Lens configuration.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region configured for this backend.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all stored resources without recreating the backend.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) SetAccessPointVpcConfig 

func (b *InMemoryBackend) SetAccessPointVpcConfig(accountID, name, vpcID, bucketAccountID string) error

SetAccessPointVpcConfig sets VPC configuration fields on an existing access point. NetworkOrigin is set to "VPC" when vpcID is non-empty, else "Internet". Alias is cleared for VPC access points (AWS does not emit an alias for VPC APs).

func (*InMemoryBackend) SetMRAPRegions 

func (b *InMemoryBackend) SetMRAPRegions(accountID, name string, regions []string) error

SetMRAPRegions stores the bucket-region list for an MRAP.

func (*InMemoryBackend) SetObjectLambdaConfigSink 

func (b *InMemoryBackend) SetObjectLambdaConfigSink(sink ObjectLambdaConfigSink)

SetObjectLambdaConfigSink wires the S3 backend that should receive resolved Object Lambda configuration.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) SubmitMultiRegionAccessPointRoutes 

func (b *InMemoryBackend) SubmitMultiRegionAccessPointRoutes(accountID, mrap, routes string) error

SubmitMultiRegionAccessPointRoutes stores routing configuration for an MRAP.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(arn string, tags map[string]string)

TagResource adds or updates tags on the given ARN.

func (*InMemoryBackend) TaggedResources added in v1.3.1 

func (b *InMemoryBackend) TaggedResources() []TaggedEntry

TaggedResources returns every s3control resource with at least one tag, keyed by ARN. Only covers the resource kinds taggable through the generic TagResource/UntagResource/ListTagsForResource ops (access points, Object Lambda access points, multi-region access points, access grants) -- batch job tags and Storage Lens configuration tags live in separate stores behind their own real, dedicated AWS ops (Put/Get/DeleteJobTagging, Put/GetStorageLensConfigurationTagging), not this generic surface.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(arn string, tagKeys []string)

UntagResource removes specific tag keys from the given ARN.

func (*InMemoryBackend) UpdateAccessGrantsLocation 

func (b *InMemoryBackend) UpdateAccessGrantsLocation(
	accountID, locationID, iamRoleArn string,
) (*AccessGrantsLocation, error)

UpdateAccessGrantsLocation updates the IAM role ARN for a location.

func (*InMemoryBackend) UpdateJobDetails 

func (b *InMemoryBackend) UpdateJobDetails(
	accountID, jobID, description, manifest, operation, report string,
	confirmationRequired bool,
) error

UpdateJobDetails persists the extended fields from a CreateJob request to an existing job.

func (*InMemoryBackend) UpdateJobPriority 

func (b *InMemoryBackend) UpdateJobPriority(accountID, jobID string, priority int32) (*BatchJob, error)

UpdateJobPriority changes the priority of a batch job. The non-negative bound is inferred from CreateJob's own check, not stated by this op's doc: both fields are the same JobPriority quantity.

func (*InMemoryBackend) UpdateJobStatus 

func (b *InMemoryBackend) UpdateJobStatus(accountID, jobID, status string) (*BatchJob, error)

UpdateJobStatus changes the status of a batch job.

func (*InMemoryBackend) UpdateJobStatusValidated 

func (b *InMemoryBackend) UpdateJobStatusValidated(
	accountID, jobID, requestedStatus, statusUpdateReason string,
) (*BatchJob, error)

UpdateJobStatusValidated changes the status of a batch job after validating the requested transition.

func (*InMemoryBackend) UpdateStorageLensGroup 

func (b *InMemoryBackend) UpdateStorageLensGroup(accountID, name string) (*StorageLensGroup, error)

UpdateStorageLensGroup updates a Storage Lens group (currently a no-op that confirms existence).

func (*InMemoryBackend) UpdateStorageLensGroupFilter 

func (b *InMemoryBackend) UpdateStorageLensGroupFilter(accountID, name, filter string) error

UpdateStorageLensGroupFilter stores the filter XML for an existing Storage Lens group.

type MultiRegionAccessPoint 

type MultiRegionAccessPoint struct {
	AccountID string   `json:"accountID"`
	Name      string   `json:"name"`
	Alias     string   `json:"alias"`
	Status    string   `json:"status"`
	Policy    string   `json:"policy,omitempty"`
	CreatedAt string   `json:"createdAt,omitempty"`
	Regions   []string `json:"regions,omitempty"`
}

MultiRegionAccessPoint represents a stored MRAP instance.

type MultiRegionAccessPointRequest 

type MultiRegionAccessPointRequest struct {
	AccountID string `json:"accountID"`
	// Token is the bare request token this value is keyed by in the
	// mrapRequests Table (see store_setup.go); RequestTokenARN embeds it but
	// as a full ARN, not a value store.Table's keyFn can use directly.
	// Tagged json:"-" because mrapRequests is a "dirty" table --
	// persistence.go round-trips it through a dedicated DTO that carries
	// Token as a real JSON field, so it survives the round trip despite
	// being excluded here. It must never change after the value is created
	// (store.Table's keyFn purity requirement).
	Token           string `json:"-"`
	RequestTokenARN string `json:"requestTokenARN"`
	Name            string `json:"name"`
}

MultiRegionAccessPointRequest represents an MRAP async request.

type ObjectLambdaAccessPoint 

type ObjectLambdaAccessPoint struct {
	Alias                      *ObjectLambdaAccessPointAlias `json:"alias,omitempty"`
	AccountID                  string                        `json:"accountID"`
	Name                       string                        `json:"name"`
	ObjectLambdaAccessPointArn string                        `json:"objectLambdaAccessPointArn"`
}

ObjectLambdaAccessPoint represents an S3 Object Lambda access point.

type ObjectLambdaAccessPointAlias added in v1.3.4 

type ObjectLambdaAccessPointAlias struct {
	Status string `json:"status,omitempty"`
	Value  string `json:"value,omitempty"`
}

ObjectLambdaAccessPointAlias represents an alias for an Object Lambda access point.

type ObjectLambdaConfigSink 

type ObjectLambdaConfigSink interface {
	SetObjectLambdaConfig(bucket, lambdaARN string)
}

ObjectLambdaConfigSink receives the Lambda ARN configured for an Object Lambda access point's underlying bucket, resolved from PutAccessPointConfigurationForObjectLambda's SupportingAccessPoint, so GetObject through that bucket actually invokes the Lambda transform instead of the config being accepted and never reaching S3 (gopherstack-6o0r).

type OutpostsBucket 

type OutpostsBucket struct {
	AccountID string `json:"accountID"`
	Name      string `json:"name"`
	BucketArn string `json:"bucketArn"`
	Location  string `json:"location"`
}

OutpostsBucket represents an S3 Outposts bucket.

type Provider 

type Provider struct{}

Provider implements service.Provider for S3 Control.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the S3 Control service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type PublicAccessBlock 

type PublicAccessBlock struct {
	AccountID string `json:"accountID"`
	// APName is the access point name this value is keyed by in the
	// accessPointPABs Table (see store_setup.go); it is always empty for
	// entries in the account-level configs Table. Tagged json:"-" because
	// accessPointPABs is a "dirty" table -- persistence.go round-trips it
	// through a dedicated DTO that carries APName as a real JSON field, so
	// it survives the round trip despite being excluded here. It must never
	// change after the value is created (store.Table's keyFn purity
	// requirement).
	APName                string `json:"-"`
	BlockPublicAcls       bool   `json:"blockPublicAcls"`
	IgnorePublicAcls      bool   `json:"ignorePublicAcls"`
	BlockPublicPolicy     bool   `json:"blockPublicPolicy"`
	RestrictPublicBuckets bool   `json:"restrictPublicBuckets"`
}

PublicAccessBlock represents the S3 Control public access block configuration.

This type backs two distinct store.Table instances (see store_setup.go): the account-level "configs" table (keyed by AccountID alone) and the per-access-point "accessPointPABs" table (keyed by AccountID+APName).

type StorageBackend 

type StorageBackend interface {
	PutPublicAccessBlock(cfg PublicAccessBlock)
	GetPublicAccessBlock(accountID string) (*PublicAccessBlock, error)
	DeletePublicAccessBlock(accountID string) error
	ListAll() []PublicAccessBlock

	AssociateAccessGrantsIdentityCenter(accountID, identityCenterArn string)
	CreateAccessGrantsInstance(accountID, identityCenterArn string) *AccessGrantsInstance
	CreateAccessGrant(
		accountID, locationID, granteeType, granteeIdentifier, permission, applicationArn, s3SubPrefix string,
	) (*AccessGrant, error)
	CreateAccessGrantsLocation(accountID, locationScope, iamRoleArn string) *AccessGrantsLocation
	CreateAccessPoint(accountID, name, bucket string) *AccessPoint
	GetAccessPoint(accountID, name string) (*AccessPoint, error)
	DeleteAccessPoint(accountID, name string) error
	ListAccessPoints(accountID string) []*AccessPoint
	PutAccessPointPolicy(accountID, name, policy string) error
	GetAccessPointPolicy(accountID, name string) (string, error)
	DeleteAccessPointPolicy(accountID, name string) error
	GetAccessPointPolicyStatus(accountID, name string) (bool, error)
	CreateAccessPointForObjectLambda(accountID, name string) *ObjectLambdaAccessPoint
	CreateBucket(accountID, bucketName string) *OutpostsBucket
	CreateJob(accountID, roleArn string, priority int32) (*BatchJob, error)
	GetJob(accountID, jobID string) (*BatchJob, error)
	ListJobs(accountID string) []*BatchJob
	UpdateJobPriority(accountID, jobID string, priority int32) (*BatchJob, error)
	UpdateJobStatus(accountID, jobID, status string) (*BatchJob, error)
	CreateMultiRegionAccessPoint(accountID, name, clientToken string) *MultiRegionAccessPointRequest
	GetMultiRegionAccessPoint(accountID, name string) (*MultiRegionAccessPoint, error)
	DeleteMultiRegionAccessPoint(accountID, name string) error
	ListMultiRegionAccessPoints(accountID string) []*MultiRegionAccessPoint
	PutMultiRegionAccessPointPolicy(accountID, name, policy string) error
	CreateMRAPPutPolicyRequest(accountID, name string) *MultiRegionAccessPointRequest
	CreateMRAPDeleteRequest(accountID, name string) *MultiRegionAccessPointRequest
	CreateStorageLensGroup(accountID, name string) *StorageLensGroup

	Reset()
	AccountID() string
	Region() string

	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error

	// Job tagging
	PutJobTagging(accountID, jobID string, tags TagSet) error
	GetJobTagging(accountID, jobID string) (TagSet, error)
	DeleteJobTagging(accountID, jobID string) error

	// Access Grants Instance
	GetAccessGrantsInstance(accountID string) (*AccessGrantsInstance, error)
	DeleteAccessGrantsInstance(accountID string) error
	GetAccessGrantsInstanceResourcePolicy(accountID string) (string, error)
	PutAccessGrantsInstanceResourcePolicy(accountID, policy string)
	PutAccessGrantsInstanceResourcePolicyWithOrganization(accountID, policy, organization string) AccessGrantsPolicyMeta
	GetAccessGrantsInstanceResourcePolicyMeta(accountID string) AccessGrantsPolicyMeta
	DeleteAccessGrantsInstanceResourcePolicy(accountID string)
	DissociateAccessGrantsIdentityCenter(accountID string)
	GetAccessGrantsInstanceForPrefix(accountID, prefix string) (*AccessGrantsInstance, error)

	// Access Grants CRUD
	GetAccessGrant(accountID, grantID string) (*AccessGrant, error)
	DeleteAccessGrant(accountID, grantID string) error
	ListAccessGrants(accountID string, filter AccessGrantsFilter) []*AccessGrant
	ListCallerAccessGrants(accountID, grantScope string) []*AccessGrant
	GetAccessGrantsLocation(accountID, locationID string) (*AccessGrantsLocation, error)
	DeleteAccessGrantsLocation(accountID, locationID string) error
	UpdateAccessGrantsLocation(accountID, locationID, iamRoleArn string) (*AccessGrantsLocation, error)
	ListAccessGrantsLocations(accountID string) []*AccessGrantsLocation
	GetDataAccess(accountID, target, permission string) (string, error)

	// Access Point Scope
	GetAccessPointScope(accountID, name string) (string, error)
	PutAccessPointScope(accountID, name, scope string) error
	DeleteAccessPointScope(accountID, name string) error
	ListAccessPointsForDirectoryBuckets(accountID string) []*AccessPoint

	// Object Lambda Access Points
	GetAccessPointForObjectLambda(accountID, name string) (*ObjectLambdaAccessPoint, error)
	DeleteAccessPointForObjectLambda(accountID, name string) error
	ListAccessPointsForObjectLambda(accountID string) []*ObjectLambdaAccessPoint
	GetAccessPointPolicyForObjectLambda(accountID, name string) (string, error)
	PutAccessPointPolicyForObjectLambda(accountID, name, policy string) error
	DeleteAccessPointPolicyForObjectLambda(accountID, name string) error
	GetAccessPointPolicyStatusForObjectLambda(accountID, name string) (bool, error)
	GetAccessPointConfigurationForObjectLambda(accountID, name string) (string, error)
	PutAccessPointConfigurationForObjectLambda(accountID, name, config string) error

	// Outposts Bucket. Unlike every other resource family in this interface,
	// these are NOT accountID-keyed -- see the CreateBucket doc comment in
	// bucket.go (gopherstack-eje5): the real CreateBucketInput carries no
	// AccountId at all, so bucket identity and its sub-resource state are
	// keyed by bucketName alone.
	GetBucket(bucketName string) (*OutpostsBucket, error)
	DeleteBucket(bucketName string) error
	GetBucketLifecycleConfiguration(bucketName string) (string, error)
	PutBucketLifecycleConfiguration(bucketName, lifecycleConfig string) error
	DeleteBucketLifecycleConfiguration(bucketName string) error
	GetBucketPolicy(bucketName string) (string, error)
	PutBucketPolicy(bucketName, policy string) error
	DeleteBucketPolicy(bucketName string) error
	GetBucketTagging(bucketName string) (TagSet, error)
	PutBucketTagging(bucketName string, tags TagSet) error
	DeleteBucketTagging(bucketName string) error
	GetBucketVersioning(bucketName string) (string, error)
	PutBucketVersioning(bucketName, status string) error
	ListRegionalBuckets() []*OutpostsBucket

	// MRAP
	DescribeMultiRegionAccessPointOperation(accountID, requestToken string) (*MultiRegionAccessPointRequest, error)
	GetMultiRegionAccessPointPolicy(accountID, name string) (string, error)
	GetMultiRegionAccessPointPolicyStatus(accountID, name string) (bool, error)
	GetMultiRegionAccessPointRoutes(accountID, mrap string) (string, error)

	// Bucket Replication. Same bucketName-only keying as the Outposts Bucket
	// group above.
	GetBucketReplication(bucketName string) (string, error)
	PutBucketReplication(bucketName, config string) error
	DeleteBucketReplication(bucketName string) error

	// MRAP routes (submit)
	SubmitMultiRegionAccessPointRoutes(accountID, mrap, routes string) error

	// Storage Lens Configuration
	GetStorageLensConfiguration(accountID, configName string) (string, error)
	PutStorageLensConfiguration(accountID, configName, config string) error
	DeleteStorageLensConfiguration(accountID, configName string) error
	GetStorageLensConfigurationTagging(accountID, configName string) (TagSet, error)
	PutStorageLensConfigurationTagging(accountID, configName string, tags TagSet) error
	DeleteStorageLensConfigurationTagging(accountID, configName string) error
	ListStorageLensConfigurations(accountID string) []string

	// Storage Lens Groups (additional CRUD)
	GetStorageLensGroup(accountID, name string) (*StorageLensGroup, error)
	UpdateStorageLensGroup(accountID, name string) (*StorageLensGroup, error)
	DeleteStorageLensGroup(accountID, name string) error
	ListStorageLensGroups(accountID string) []*StorageLensGroup

	// Resource Tags
	ListTagsForResource(arn string) map[string]string
	TagResource(arn string, tags map[string]string)
	UntagResource(arn string, tagKeys []string)

	// AccessPoint VPC configuration
	SetAccessPointVpcConfig(accountID, name, vpcID, bucketAccountID string) error

	// AccessPoint per-AP public access block. NOT separate AWS operations --
	// aws-sdk-go-v2/service/s3control has no Get/Put/DeleteAccessPoint
	// PublicAccessBlock ops. These back the PublicAccessBlockConfiguration
	// field that travels inline on CreateAccessPoint/GetAccessPoint instead
	// (see handler_access_points.go); do not route them as standalone ops.
	GetAccessPointPublicAccessBlock(accountID, name string) (*PublicAccessBlock, error)
	PutAccessPointPublicAccessBlock(accountID, name string, cfg PublicAccessBlock) error
	DeleteAccessPointPublicAccessBlock(accountID, name string) error

	// BatchJob extended fields
	UpdateJobDetails(accountID, jobID, description, manifest, operation, report string, confirmationRequired bool) error
	UpdateJobStatusValidated(accountID, jobID, requestedStatus, statusUpdateReason string) (*BatchJob, error)

	// MRAP regions
	SetMRAPRegions(accountID, name string, regions []string) error

	// StorageLensGroup filter
	UpdateStorageLensGroupFilter(accountID, name, filter string) error
}

StorageBackend defines the interface for S3 Control backend implementations. All mutating methods must be safe for concurrent use.

type StorageLensGroup 

type StorageLensGroup struct {
	AccountID           string `json:"accountID"`
	Name                string `json:"name"`
	StorageLensGroupArn string `json:"storageLensGroupArn"`
	Filter              string `json:"filter,omitempty"`
	CreatedAt           string `json:"createdAt,omitempty"`
}

StorageLensGroup represents an S3 Storage Lens group.

type TagSet 

type TagSet map[string]string

TagSet represents a key-value tag map.

type TaggedEntry added in v1.3.1 

type TaggedEntry struct {
	Tags map[string]string
	ARN  string
}

TaggedEntry pairs a resource ARN with its tag set, for the Resource Groups Tagging API's GetResources (see cli.go's wireTaggingS3Control).

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.