AWS S3 Control

{'InstanceScope': 'SELF | ALL'}

{'MatchedInstanceArn': 'string'}

Returns a temporary access credential from S3 Access Grants to the grantee or client application. The temporary credential is an Amazon Web Services STS token that grants them access to the S3 data. By default, S3 Access Grants searches for a matching grant in the instance of the Amazon Web Services account ID in the request. To also search instances shared with the caller through Amazon Web Services Resource Access Manager (RAM), set the InstanceScope parameter to ALL.

Permissions

You must have the s3:GetDataAccess permission to use this operation.

Additional Permissions

The IAM role that S3 Access Grants assumes must have the following permissions specified in the trust policy when registering the location: sts:AssumeRole, for directory users or groups sts:SetContext, and for IAM users or roles sts:SetSourceIdentity.

See also: AWS API Documentation

Request Syntax

client.get_data_access(
    AccountId='string',
    Target='string',
    Permission='READ'|'WRITE'|'READWRITE',
    DurationSeconds=123,
    Privilege='Minimal'|'Default',
    TargetType='Object',
    AuditContext='string',
    InstanceScope='SELF'|'ALL'
)

type AccountId:

string

param AccountId:

[REQUIRED]

The Amazon Web Services account ID of the S3 Access Grants instance.

type Target:

string

param Target:

[REQUIRED]

The S3 URI path of the data to which you are requesting temporary access credentials. If the requesting account has an access grant for this data, S3 Access Grants vends temporary access credentials in the response.

type Permission:

string

param Permission:

[REQUIRED]

The type of permission granted to your S3 data, which can be set to one of the following values:

• READ – Grant read-only access to the S3 data.

• WRITE – Grant write-only access to the S3 data.

• READWRITE – Grant both read and write access to the S3 data.

type DurationSeconds:

integer

param DurationSeconds:

The session duration, in seconds, of the temporary access credential that S3 Access Grants vends to the grantee or client application. The default value is 1 hour, but the grantee can specify a range from 900 seconds (15 minutes) up to 43200 seconds (12 hours). If the grantee requests a value higher than this maximum, the operation fails.

type Privilege:

string

param Privilege:

The scope of the temporary access credential that S3 Access Grants vends to the grantee or client application.

• Default – The scope of the returned temporary access token is the scope of the grant that is closest to the target scope.

• Minimal – The scope of the returned temporary access token is the same as the requested target scope as long as the requested scope is the same as or a subset of the grant scope.

type TargetType:

string

param TargetType:

The type of Target. The only possible value is Object. Pass this value if the target data that you would like to access is a path to an object. Do not pass this value if the target data is a bucket or a bucket and a prefix.

type AuditContext:

string

param AuditContext:

The context to identify the job or query associated with the credential request. This information will be displayed in CloudTrail log in your account.

type InstanceScope:

string

param InstanceScope:

The scope of S3 Access Grants instances to search for a grant matching the requested S3 URI path.

• SELF – Searches only the instance of the Amazon Web Services account ID in the request.

• ALL – Searches the instance of the Amazon Web Services account ID in the request and all instances shared with the caller's account through Amazon Web Services Resource Access Manager (RAM).

rtype:

dict

returns:

Response Syntax

{
    'Credentials': {
        'AccessKeyId': 'string',
        'SecretAccessKey': 'string',
        'SessionToken': 'string',
        'Expiration': datetime(2015, 1, 1)
    },
    'MatchedGrantTarget': 'string',
    'Grantee': {
        'GranteeType': 'DIRECTORY_USER'|'DIRECTORY_GROUP'|'IAM',
        'GranteeIdentifier': 'string'
    },
    'MatchedInstanceArn': 'string'
}

Response Structure

• (dict) --

  • Credentials (dict) --

    The temporary credential token that S3 Access Grants vends.

    • AccessKeyId (string) --

      The unique access key ID of the Amazon Web Services STS temporary credential that S3 Access Grants vends to grantees and client applications.

    • SecretAccessKey (string) --

      The secret access key of the Amazon Web Services STS temporary credential that S3 Access Grants vends to grantees and client applications.

    • SessionToken (string) --

      The Amazon Web Services STS temporary credential that S3 Access Grants vends to grantees and client applications.

    • Expiration (datetime) --

      The expiration date and time of the temporary credential that S3 Access Grants vends to grantees and client applications.

  • MatchedGrantTarget (string) --

    The S3 URI path of the data to which you are being granted temporary access credentials.

  • Grantee (dict) --

    The user, group, or role that was granted access to the S3 location scope. For directory identities, this API also returns the grants of the IAM role used for the identity-aware request. For more information on identity-aware sessions, see Granting permissions to use identity-aware console sessions.

    • GranteeType (string) --

      The type of the grantee to which access has been granted. It can be one of the following values:

      • IAM - An IAM user or role.

      • DIRECTORY_USER - Your corporate directory user. You can use this option if you have added your corporate identity directory to IAM Identity Center and associated the IAM Identity Center instance with your S3 Access Grants instance.

      • DIRECTORY_GROUP - Your corporate directory group. You can use this option if you have added your corporate identity directory to IAM Identity Center and associated the IAM Identity Center instance with your S3 Access Grants instance.

    • GranteeIdentifier (string) --

      The unique identifier of the Grantee. If the grantee type is IAM, the identifier is the IAM Amazon Resource Name (ARN) of the user or role. If the grantee type is a directory user or group, the identifier is 128-bit universally unique identifier (UUID) in the format a1b2c3d4-5678-90ab-cdef-EXAMPLE11111. You can obtain this UUID from your Amazon Web Services IAM Identity Center instance.

  • MatchedInstanceArn (string) --

    The Amazon Resource Name (ARN) of the S3 Access Grants instance containing the grant that matched the requested S3 URI path.

{'InstanceScope': 'SELF | ALL'}

{'CallerAccessGrantsList': {'AccessGrantsInstanceArn': 'string'}}

Use this API to list the access grants that grant the caller access to Amazon S3 data through S3 Access Grants. The caller (grantee) can be an Identity and Access Management (IAM) identity or Amazon Web Services Identity Center corporate directory identity. You must pass the Amazon Web Services account of the S3 data owner (grantor) in the request. By default, S3 Access Grants returns grants from the instance of the Amazon Web Services account ID in the request. To return grants from all instances shared with the caller's account through Amazon Web Services Resource Access Manager (RAM), set the InstanceScope parameter to ALL. You can, optionally, narrow the results by GrantScope, using a fragment of the data's S3 path, and S3 Access Grants will return only the grants with a path that contains the path fragment. You can also pass the AllowedByApplication filter in the request, which returns only the grants authorized for applications, whether the application is the caller's Identity Center application or any other application ( ALL). For more information, see List the caller's access grants in the Amazon S3 User Guide.

Permissions

You must have the s3:ListCallerAccessGrants permission to use this operation.

See also: AWS API Documentation

Request Syntax

client.list_caller_access_grants(
    AccountId='string',
    GrantScope='string',
    NextToken='string',
    MaxResults=123,
    AllowedByApplication=True|False,
    InstanceScope='SELF'|'ALL'
)

type AccountId:

string

param AccountId:

[REQUIRED]

The Amazon Web Services account ID of the S3 Access Grants instance.

type GrantScope:

string

param GrantScope:

The S3 path of the data that you would like to access. Must start with s3://. You can optionally pass only the beginning characters of a path, and S3 Access Grants will search for all applicable grants for the path fragment.

type NextToken:

string

param NextToken:

A pagination token to request the next page of results. Pass this value into a subsequent List Caller Access Grants request in order to retrieve the next page of results.

type MaxResults:

integer

param MaxResults:

The maximum number of access grants that you would like returned in the List Caller Access Grants response. If the results include the pagination token NextToken, make another call using the NextToken to determine if there are more results.

type AllowedByApplication:

boolean

param AllowedByApplication:

If this optional parameter is passed in the request, a filter is applied to the results. The results will include only the access grants for the caller's Identity Center application or for any other applications ( ALL).

type InstanceScope:

string

param InstanceScope:

The scope of S3 Access Grants instances to list grants from.

• SELF – Lists grants from the instance of the Amazon Web Services account ID in the request.

• ALL – Lists grants from the instance of the Amazon Web Services account ID in the request and all instances shared with the caller's account through Amazon Web Services Resource Access Manager (RAM).

rtype:

dict

returns:

Response Syntax

{
    'NextToken': 'string',
    'CallerAccessGrantsList': [
        {
            'Permission': 'READ'|'WRITE'|'READWRITE',
            'GrantScope': 'string',
            'ApplicationArn': 'string',
            'AccessGrantsInstanceArn': 'string'
        },
    ]
}

Response Structure

• (dict) --

  • NextToken (string) --

    A pagination token that you can use to request the next page of results. Pass this value into a subsequent List Caller Access Grants request in order to retrieve the next page of results.

  • CallerAccessGrantsList (list) --

    A list of the caller's access grants that were created using S3 Access Grants and that grant the caller access to the S3 data of the Amazon Web Services account ID that was specified in the request.

    • (dict) --

      Part of ListCallerAccessGrantsResult. Each entry includes the permission level (READ, WRITE, or READWRITE) and the grant scope of the access grant. Each entry also includes the ARN of the S3 Access Grants instance in which the grant was created. If the grant also includes an application ARN, the grantee can only access the S3 data through this application.

      • Permission (string) --

        The type of permission granted, which can be one of the following values:

        • READ - Grants read-only access to the S3 data.

        • WRITE - Grants write-only access to the S3 data.

        • READWRITE - Grants both read and write access to the S3 data.

      • GrantScope (string) --

        The S3 path of the data to which you have been granted access.

      • ApplicationArn (string) --

        The Amazon Resource Name (ARN) of an Amazon Web Services IAM Identity Center application associated with your Identity Center instance. If the grant includes an application ARN, the grantee can only access the S3 data through this application.

      • AccessGrantsInstanceArn (string) --

        The Amazon Resource Name (ARN) of the S3 Access Grants instance in which the grant was created.