access_grants_locations

Creates, updates, deletes, gets or lists an access_grants_locations resource.

Overview

Name	access_grants_locations
Type	Resource
Id	aws.s3control.access_grants_locations

Fields

The following fields are returned by SELECT queries:

get_access_grants_location

Name	Datatype	Description
access_grants_location_arn	string	The Amazon Resource Name (ARN) of the registered location.
access_grants_location_id	string	The ID of the registered location to which you are granting access. S3 Access Grants assigns this ID when you register the location. S3 Access Grants assigns the ID default to the default location s3:​// and assigns an auto-generated ID to other locations that you register.
created_at	string	The date and time when you registered the location.
iam_role_arn	string	The Amazon Resource Name (ARN) of the IAM role for the registered location. S3 Access Grants assumes this role to manage access to the registered location.
location_scope	string	The S3 URI path to the registered location. The location scope can be the default S3 location s3:​//, the S3 path to a bucket, or the S3 path to a bucket and prefix. A prefix in S3 is a string of characters at the beginning of an object key name used to organize the objects that you store in your S3 buckets. For example, object key names that start with the engineering/ prefix or object key names that start with the marketing/campaigns/ prefix.

list_access_grants_locations

Name	Datatype	Description
access_grants_location_arn	string	The Amazon Resource Name (ARN) of the registered location.
access_grants_location_id	string	The ID of the registered location to which you are granting access. S3 Access Grants assigns this ID when you register the location. S3 Access Grants assigns the ID default to the default location s3:​// and assigns an auto-generated ID to other locations that you register.
created_at	string	The date and time when you registered the location.
iam_role_arn	string	The Amazon Resource Name (ARN) of the IAM role for the registered location. S3 Access Grants assumes this role to manage access to the registered location.
location_scope	string	The S3 path to the location that you are registering. The location scope can be the default S3 location s3:​//, the S3 path to a bucket s3:​//<bucket>, or the S3 path to a bucket and prefix s3:​//<bucket>/<prefix>. A prefix in S3 is a string of characters at the beginning of an object key name used to organize the objects that you store in your S3 buckets. For example, object key names that start with the engineering/ prefix or object key names that start with the marketing/campaigns/ prefix.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_access_grants_location	select	x-amz-account-id, id, region		Retrieves the details of a particular location registered in your S3 Access Grants instance. Permissions You must have the s3:GetAccessGrantsLocation permission to use this operation.
list_access_grants_locations	select	x-amz-account-id, region	nextToken, maxResults, locationscope	Returns a list of the locations registered in your S3 Access Grants instance. Permissions You must have the s3:ListAccessGrantsLocations permission to use this operation.
create_access_grants_location	insert	x-amz-account-id, region, LocationScope, IAMRoleArn		The S3 data location that you would like to register in your S3 Access Grants instance. Your S3 data must be in the same Region as your S3 Access Grants instance. The location can be one of the following: The default S3 location s3:​// A bucket - S3:​//<bucket-name> A bucket and prefix - S3:​//<bucket-name>/<prefix> When you register a location, you must include the IAM role that has permission to manage the S3 location that you are registering. Give S3 Access Grants permission to assume this role using a policy. S3 Access Grants assumes this role to manage access to the location and to vend temporary credentials to grantees or client applications. Permissions You must have the s3:CreateAccessGrantsLocation permission to use this operation. Additional Permissions You must also have the following permission for the specified IAM role: iam:PassRole
update_access_grants_location	update	x-amz-account-id, id, region, IAMRoleArn		Updates the IAM role of a registered location in your S3 Access Grants instance. Permissions You must have the s3:UpdateAccessGrantsLocation permission to use this operation. Additional Permissions You must also have the following permission: iam:PassRole
delete_access_grants_location	delete	x-amz-account-id, id, region		Deregisters a location from your S3 Access Grants instance. You can only delete a location registration from an S3 Access Grants instance if there are no grants associated with this location. See Delete a grant for information on how to delete grants. You need to have at least one registered location in your S3 Access Grants instance in order to create access grants. Permissions You must have the s3:DeleteAccessGrantsLocation permission to use this operation.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
id	string	The ID of the registered location that you are deregistering from your S3 Access Grants instance. S3 Access Grants assigned this ID when you registered the location. S3 Access Grants assigns the ID default to the default location s3:​// and assigns an auto-generated ID to other locations that you register.
region	string	AWS region (default: us-east-1)
x-amz-account-id	string	The Amazon Web Services account ID of the S3 Access Grants instance.
locationscope	string	The S3 path to the location that you are registering. The location scope can be the default S3 location s3:​//, the S3 path to a bucket s3:​//<bucket>, or the S3 path to a bucket and prefix s3:​//<bucket>/<prefix>. A prefix in S3 is a string of characters at the beginning of an object key name used to organize the objects that you store in your S3 buckets. For example, object key names that start with the engineering/ prefix or object key names that start with the marketing/campaigns/ prefix.
maxResults	integer	The maximum number of access grants that you would like returned in the List Access Grants response. If the results include the pagination token NextToken, make another call using the NextToken to determine if there are more results.
nextToken	string	A pagination token to request the next page of results. Pass this value into a subsequent List Access Grants Locations request in order to retrieve the next page of results.

SELECT examples

get_access_grants_location

Retrieves the details of a particular location registered in your S3 Access Grants instance. Permissions You must have the s3:GetAccessGrantsLocation permission to use this operation.

SELECT
access_grants_location_arn,
access_grants_location_id,
created_at,
iam_role_arn,
location_scope
FROM aws.s3control.access_grants_locations
WHERE `x-amz-account-id` = '{{ x-amz-account-id }}' -- required
AND id = '{{ id }}' -- required
AND region = '{{ region }}' -- required
;

list_access_grants_locations

Returns a list of the locations registered in your S3 Access Grants instance. Permissions You must have the s3:ListAccessGrantsLocations permission to use this operation.

SELECT
access_grants_location_arn,
access_grants_location_id,
created_at,
iam_role_arn,
location_scope
FROM aws.s3control.access_grants_locations
WHERE `x-amz-account-id` = '{{ x-amz-account-id }}' -- required
AND region = '{{ region }}' -- required
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
AND locationscope = '{{ locationscope }}'
;

INSERT examples

create_access_grants_location

The S3 data location that you would like to register in your S3 Access Grants instance. Your S3 data must be in the same Region as your S3 Access Grants instance. The location can be one of the following: The default S3 location s3:​// A bucket - S3:​//<bucket-name> A bucket and prefix - S3:​//<bucket-name>/<prefix> When you register a location, you must include the IAM role that has permission to manage the S3 location that you are registering. Give S3 Access Grants permission to assume this role using a policy. S3 Access Grants assumes this role to manage access to the location and to vend temporary credentials to grantees or client applications. Permissions You must have the s3:CreateAccessGrantsLocation permission to use this operation. Additional Permissions You must also have the following permission for the specified IAM role: iam:PassRole

INSERT INTO aws.s3control.access_grants_locations (
LocationScope,
IAMRoleArn,
Tags,
`x-amz-account-id`,
region
)
SELECT 
'{{ LocationScope }}' /* required */,
'{{ IAMRoleArn }}' /* required */,
'{{ Tags }}',
'{{ x-amz-account-id }}',
'{{ region }}'
RETURNING
access_grants_location_arn,
access_grants_location_id,
created_at,
iam_role_arn,
location_scope
;

Manifest

# Description fields are for documentation purposes
- name: access_grants_locations
props:
  - name: x-amz-account-id
    value: "{{ x-amz-account-id }}"
    description: Required parameter for the access_grants_locations resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the access_grants_locations resource.
  - name: LocationScope
    value: "{{ LocationScope }}"
  - name: IAMRoleArn
    value: "{{ IAMRoleArn }}"
  - name: Tags
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"

UPDATE examples

update_access_grants_location

Updates the IAM role of a registered location in your S3 Access Grants instance. Permissions You must have the s3:UpdateAccessGrantsLocation permission to use this operation. Additional Permissions You must also have the following permission: iam:PassRole

UPDATE aws.s3control.access_grants_locations
SET 
IAMRoleArn = '{{ IAMRoleArn }}'
WHERE 
`x-amz-account-id` = '{{ x-amz-account-id }}' --required
AND id = '{{ id }}' --required
AND region = '{{ region }}' --required
AND IAMRoleArn = '{{ IAMRoleArn }}' --required
RETURNING
access_grants_location_arn,
access_grants_location_id,
created_at,
iam_role_arn,
location_scope;

DELETE examples

delete_access_grants_location

Deregisters a location from your S3 Access Grants instance. You can only delete a location registration from an S3 Access Grants instance if there are no grants associated with this location. See Delete a grant for information on how to delete grants. You need to have at least one registered location in your S3 Access Grants instance in order to create access grants. Permissions You must have the s3:DeleteAccessGrantsLocation permission to use this operation.

DELETE FROM aws.s3control.access_grants_locations
WHERE `x-amz-account-id` = '{{ x-amz-account-id }}' --required
AND id = '{{ id }}' --required
AND region = '{{ region }}' --required
;