S3 / Client / get_bucket_encryption

get_bucket_encryption#

S3.Client.get_bucket_encryption(**kwargs)#

Returns the default encryption configuration for an Amazon S3 bucket. By default, all buckets have a default encryption configuration that uses server-side encryption with Amazon S3 managed keys (SSE-S3).

Note

Permissions

  • General purpose bucket permissions - The s3:GetEncryptionConfiguration permission is required in a policy. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Operations and Managing Access Permissions to Your Amazon S3 Resources.

  • Directory bucket permissions - To grant access to this API operation, you must have the s3express:GetEncryptionConfiguration permission in an IAM identity-based policy instead of a bucket policy. Cross-account access to this API operation isn’t supported. This operation can only be performed by the Amazon Web Services account that owns the resource. For more information about directory bucket policies and permissions, see Amazon Web Services Identity and Access Management (IAM) for S3 Express One Zone in the Amazon S3 User Guide.

    HTTP Host header syntax

Directory buckets - The HTTP Host header syntax is s3express-control.region.amazonaws.com.

The following operations are related to GetBucketEncryption:

See also: AWS API Documentation

Request Syntax

response = client.get_bucket_encryption(
    Bucket='string',
    ExpectedBucketOwner='string'
)
Parameters:

  • Bucket (string) –

    [REQUIRED]

    The name of the bucket from which the server-side encryption configuration is retrieved.

    Directory buckets - When you use this operation with a directory bucket, you must use path-style requests in the format https://s3express-control.region_code.amazonaws.com/bucket-name ``. Virtual-hosted-style requests aren't supported. Directory bucket names must be unique in the chosen Availability Zone. Bucket names must also follow the format ``bucket_base_name--az_id--x-s3 (for example, DOC-EXAMPLE-BUCKET--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide

  • ExpectedBucketOwner (string) –

    The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).

    Note

    For directory buckets, this header is not supported in this API operation. If you specify this header, the request fails with the HTTP status code 501 Not Implemented.

Return type:

dict

Returns:

Response Syntax

{
    'ServerSideEncryptionConfiguration': {
        'Rules': [
            {
                'ApplyServerSideEncryptionByDefault': {
                    'SSEAlgorithm': 'AES256'|'aws:kms'|'aws:kms:dsse',
                    'KMSMasterKeyID': 'string'
                },
                'BucketKeyEnabled': True|False
            },
        ]
    }
}

Response Structure

  • (dict) –

    • ServerSideEncryptionConfiguration (dict) –

      Specifies the default server-side-encryption configuration.

      • Rules (list) –

        Container for information about a particular server-side encryption configuration rule.

        • (dict) –

          Specifies the default server-side encryption configuration.

          Note

          • General purpose buckets - If you’re specifying a customer managed KMS key, we recommend using a fully qualified KMS key ARN. If you use a KMS key alias instead, then KMS resolves the key within the requester’s account. This behavior can result in data that’s encrypted with a KMS key that belongs to the requester, and not the bucket owner.

          • Directory buckets - When you specify an KMS customer managed key for encryption in your directory bucket, only use the key ID or key ARN. The key alias format of the KMS key isn’t supported.

          • ApplyServerSideEncryptionByDefault (dict) –

            Specifies the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn’t specify any server-side encryption, this default encryption will be applied.

            • SSEAlgorithm (string) –

              Server-side encryption algorithm to use for the default encryption.

              Note

              For directory buckets, there are only two supported values for server-side encryption: AES256 and aws:kms.

            • KMSMasterKeyID (string) –

              Amazon Web Services Key Management Service (KMS) customer managed key ID to use for the default encryption.

              Note

              • General purpose buckets - This parameter is allowed if and only if SSEAlgorithm is set to aws:kms or aws:kms:dsse.

              • Directory buckets - This parameter is allowed if and only if SSEAlgorithm is set to aws:kms.

              You can specify the key ID, key alias, or the Amazon Resource Name (ARN) of the KMS key.

              • Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

              • Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

              • Key Alias: alias/alias-name

              If you are using encryption with cross-account or Amazon Web Services service operations, you must use a fully qualified KMS key ARN. For more information, see Using encryption for cross-account operations.

              Note

              • General purpose buckets - If you’re specifying a customer managed KMS key, we recommend using a fully qualified KMS key ARN. If you use a KMS key alias instead, then KMS resolves the key within the requester’s account. This behavior can result in data that’s encrypted with a KMS key that belongs to the requester, and not the bucket owner. Also, if you use a key ID, you can run into a LogDestination undeliverable error when creating a VPC flow log.

              • Directory buckets - When you specify an KMS customer managed key for encryption in your directory bucket, only use the key ID or key ARN. The key alias format of the KMS key isn’t supported.

              Warning

              Amazon S3 only supports symmetric encryption KMS keys. For more information, see Asymmetric keys in Amazon Web Services KMS in the Amazon Web Services Key Management Service Developer Guide.

          • BucketKeyEnabled (boolean) –

            Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket. Existing objects are not affected. Setting the BucketKeyEnabled element to true causes Amazon S3 to use an S3 Bucket Key.

            Note

            • General purpose buckets - By default, S3 Bucket Key is not enabled. For more information, see Amazon S3 Bucket Keys in the Amazon S3 User Guide.

            • Directory buckets - S3 Bucket Keys are always enabled for GET and PUT operations in a directory bucket and can’t be disabled. S3 Bucket Keys aren’t supported, when you copy SSE-KMS encrypted objects from general purpose buckets to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through CopyObject, UploadPartCopy, the Copy operation in Batch Operations, or the import jobs. In this case, Amazon S3 makes a call to KMS every time a copy request is made for a KMS-encrypted object.