@aws-sdk/client-s3

import { S3ClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../S3Client"; import { PutObjectAclOutput, PutObjectAclRequest } from "../models/models_0"; import { deserializeAws_restXmlPutObjectAclCommand, serializeAws_restXmlPutObjectAclCommand, } from "../protocols/Aws_restXml"; import { getBucketEndpointPlugin } from "@aws-sdk/middleware-bucket-endpoint"; import { getSerdePlugin } from "@aws-sdk/middleware-serde"; import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@aws-sdk/protocol-http"; import { Command as $Command } from "@aws-sdk/smithy-client"; import { FinalizeHandlerArguments, Handler, HandlerExecutionContext, MiddlewareStack, HttpHandlerOptions as __HttpHandlerOptions, MetadataBearer as __MetadataBearer, SerdeContext as __SerdeContext, } from "@aws-sdk/types"; export type PutObjectAclCommandInput = PutObjectAclRequest; export type PutObjectAclCommandOutput = PutObjectAclOutput & __MetadataBearer; /** * Uses the <code>acl</code> subresource to set the access control list (ACL) permissions * for a new or existing object in an S3 bucket. You must have <code>WRITE_ACP</code> * permission to set the ACL of an object. For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions">What * permissions can I grant?</a> in the Amazon Simple Storage Service Developer Guide. * This action is not supported by Amazon S3 on Outposts. * Depending on your application needs, you can choose to set * the ACL on an object using either the request body or the headers. For example, if you have * an existing application that updates a bucket ACL using the request body, you can continue * to use that approach. For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html">Access Control List (ACL) Overview</a> in the Amazon S3 Developer * Guide. * * * * * Access Permissions * * You can set access permissions using one of the following methods: * <ul> * <li> * Specify a canned ACL with the <code>x-amz-acl</code> request header. Amazon S3 supports * a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set * of grantees and permissions. Specify the canned ACL name as the value of * <code>x-amz-ac</code>l. If you use this header, you cannot use other access * control-specific headers in your request. For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#CannedACL">Canned ACL</a>. * </li> * <li> * Specify access permissions explicitly with the <code>x-amz-grant-read</code>, * <code>x-amz-grant-read-acp</code>, <code>x-amz-grant-write-acp</code>, and * <code>x-amz-grant-full-control</code> headers. When using these headers, you * specify explicit access permissions and grantees (AWS accounts or Amazon S3 groups) who * will receive the permission. If you use these ACL-specific headers, you cannot use * <code>x-amz-acl</code> header to set a canned ACL. These parameters map to the set * of permissions that Amazon S3 supports in an ACL. For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html">Access Control List (ACL) * Overview</a>. * * You specify each grantee as a type=value pair, where the type is one of the * following: * <ul> * <li> * * <code>id</code> – if the value specified is the canonical user ID of an AWS * account * </li> * <li> * * <code>uri</code> – if you are granting permissions to a predefined * group * </li> * <li> * * <code>emailAddress</code> – if the value specified is the email address of * an AWS account * <note> * Using email addresses to specify a grantee is only supported in the following AWS Regions: * <ul> * <li> * US East (N. Virginia) * </li> * <li> * US West (N. California) * </li> * <li> * US West (Oregon) * </li> * <li> * Asia Pacific (Singapore) * </li> * <li> * Asia Pacific (Sydney) * </li> * <li> * Asia Pacific (Tokyo) * </li> * <li> * Europe (Ireland) * </li> * <li> * South America (São Paulo) * </li> * </ul> * For a list of all the Amazon S3 supported Regions and endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region">Regions and Endpoints</a> in the AWS General Reference. * </note> * </li> * </ul> * For example, the following <code>x-amz-grant-read</code> header grants list * objects permission to the two AWS accounts identified by their email * addresses. * * <code>x-amz-grant-read: emailAddress="xyz@amazon.com", * emailAddress="abc@amazon.com" </code> * * * </li> * </ul> * You can use either a canned ACL or specify access permissions explicitly. You cannot do * both. * * Grantee Values * * You can specify the person (grantee) to whom you're assigning access rights (using * request elements) in the following ways: * <ul> * <li> * By the person's ID: * * <code><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" * xsi:type="CanonicalUser"><ID><>ID<></ID><DisplayName><>GranteesEmail<></DisplayName> * </Grantee></code> * * DisplayName is optional and ignored in the request. * </li> * <li> * By URI: * * <code><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" * xsi:type="Group"><URI><>http://acs.amazonaws.com/groups/global/AuthenticatedUsers<></URI></Grantee></code> * * </li> * <li> * By Email address: * * <code><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" * xsi:type="AmazonCustomerByEmail"><EmailAddress><>Grantees@email.com<></EmailAddress>lt;/Grantee></code> * * The grantee is resolved to the CanonicalUser and, in a response to a GET Object * acl request, appears as the CanonicalUser. * <note> * Using email addresses to specify a grantee is only supported in the following AWS Regions: * <ul> * <li> * US East (N. Virginia) * </li> * <li> * US West (N. California) * </li> * <li> * US West (Oregon) * </li> * <li> * Asia Pacific (Singapore) * </li> * <li> * Asia Pacific (Sydney) * </li> * <li> * Asia Pacific (Tokyo) * </li> * <li> * Europe (Ireland) * </li> * <li> * South America (São Paulo) * </li> * </ul> * For a list of all the Amazon S3 supported Regions and endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region">Regions and Endpoints</a> in the AWS General Reference. * </note> * </li> * </ul> * * Versioning * * The ACL of an object is set at the object version level. By default, PUT sets the ACL of * the current version of an object. To set the ACL of a different version, use the * <code>versionId</code> subresource. * * Related Resources * * <ul> * <li> * * <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html">CopyObject</a> * * </li> * <li> * * <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html">GetObject</a> * * </li> * </ul> */ export class PutObjectAclCommand extends $Command< PutObjectAclCommandInput, PutObjectAclCommandOutput, S3ClientResolvedConfig > { // Start section: command_properties // End section: command_properties constructor(readonly input: PutObjectAclCommandInput) { // Start section: command_constructor super(); // End section: command_constructor } /** * @internal */ resolveMiddleware( clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>, configuration: S3ClientResolvedConfig, options?: __HttpHandlerOptions ): Handler<PutObjectAclCommandInput, PutObjectAclCommandOutput> { this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize)); this.middlewareStack.use(getBucketEndpointPlugin(configuration)); const stack = clientStack.concat(this.middlewareStack); const { logger } = configuration; const clientName = "S3Client"; const commandName = "PutObjectAclCommand"; const handlerExecutionContext: HandlerExecutionContext = { logger, clientName, commandName, inputFilterSensitiveLog: PutObjectAclRequest.filterSensitiveLog, outputFilterSensitiveLog: PutObjectAclOutput.filterSensitiveLog, }; const { requestHandler } = configuration; return stack.resolve( (request: FinalizeHandlerArguments<any>) => requestHandler.handle(request.request as __HttpRequest, options || {}), handlerExecutionContext ); } private serialize(input: PutObjectAclCommandInput, context: __SerdeContext): Promise<__HttpRequest> { return serializeAws_restXmlPutObjectAclCommand(input, context); } private deserialize(output: __HttpResponse, context: __SerdeContext): Promise<PutObjectAclCommandOutput> { return deserializeAws_restXmlPutObjectAclCommand(output, context); } // Start section: command_body_extra // End section: command_body_extra }