# Simple Storage Service (S3)

Source: /aws/services/s3/

## Introduction

Simple Storage Service (S3) is an object storage service that provides a highly scalable and durable solution for storing and retrieving data.
In S3, a bucket represents a directory, while an object corresponds to a file.
Each object or file within S3 encompasses essential attributes such as a unique key denoting its name, the actual content it holds, a version ID for versioning support, and accompanying metadata.
S3 can store unlimited objects, allowing you to store, retrieve, and manage your data in a highly adaptable and reliable manner.

LocalStack allows you to use the S3 APIs in your local environment to create new buckets, manage your S3 objects, and test your S3 configurations locally.
The supported APIs are available on the API coverage section for [S3](#api-coverage) and [S3 Control](#api-coverage-s3-control), which provides information on the extent of S3's integration with LocalStack.

## Getting started

This guide is designed for users new to S3 and assumes basic knowledge of the AWS CLI and our [`lstk aws`](/aws/developer-tools/running-localstack/lstk/cloud-and-iac-commands/#aws) command.

Start your LocalStack container using your preferred method.
We will demonstrate how you can create an S3 bucket, manage S3 objects, and generate pre-signed URLs for S3 objects.

### Create an S3 bucket

You can create an S3 bucket using the [`CreateBucket`](https://docs.aws.amazon.com/cli/latest/reference/s3api/create-bucket.html) API.
Run the following command to create an S3 bucket named `sample-bucket`:

```bash
lstk aws s3api create-bucket --bucket sample-bucket
```

You can list your S3 buckets using the [`ListBuckets`](https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html) API.
Run the following command to list your S3 buckets:

```bash
lstk aws s3api list-buckets
```

```bash title="Output"
{
    "Buckets": [
        {
            "Name": "sample-bucket",
            "CreationDate": "2023-07-18T06:36:25+00:00"
        }
    ],
    "Owner": {
        "DisplayName": "webfile",
        "ID": "75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a"
    }
}
```

### Managing S3 objects

To upload a file to your S3 bucket, you can use the [`PutObject`](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-object.html) API.
Download a random image from the internet and save it as `image.jpg`.
Run the following command to upload the file to your S3 bucket:

```bash
lstk aws s3api put-object \
  --bucket sample-bucket \
  --key image.jpg \
  --body image.jpg
```

You can list the objects in your S3 bucket using the [`ListObjects`](https://docs.aws.amazon.com/cli/latest/reference/s3api/list-objects.html) API.
Run the following command to list the objects in your S3 bucket:

```bash
lstk aws s3api list-objects \
  --bucket sample-bucket
```

If your image has been uploaded successfully, you will see the following output:

```bash title="Output"
{
    "Contents": [
        {
            "Key": "image.jpg",
            "LastModified": "2023-07-18T06:40:07+00:00",
            "ETag": "\"d41d8cd98f00b204e9800998ecf8427e\"",
            "Size": 0,
            "StorageClass": "STANDARD",
            "Owner": {
                "DisplayName": "webfile",
                "ID": "75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a"
            }
        }
    ]
}
```

Run the following command to upload a file named `index.html` to your S3 bucket:

```bash
lstk aws s3api put-object --bucket sample-bucket --key index.html --body index.html
```

```bash title="Output"
{
    "ETag": "\"d41d8cd98f00b204e9800998ecf8427e\""
}
```

### Generate a pre-signed URL for S3 object

You can generate a pre-signed URL for your S3 object using the [`presign`](https://docs.aws.amazon.com/cli/latest/reference/s3/presign.html) command.
Pre-signed URL allows anyone to retrieve the S3 object with an HTTP GET request.

Run the following command to generate a pre-signed URL for your S3 object:

```bash
lstk aws s3 presign s3://sample-bucket/image.jpg
```

You will see a generated pre-signed URL for your S3 object.
You can use [curl](https://curl.se/) or [`wget`](https://www.gnu.org/software/wget/) to retrieve the S3 object using the pre-signed URL.

By default, LocalStack does not validate the signature or the expiration of pre-signed URLs.
Check out the [Signature validation](#signature-validation) section to enable it.

## Configuring S3 Endpoint

LocalStack supports both [Virtual-Hosted style and Path style](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html) S3 requests.
AWS recommends Virtual-Hosted style addressing, and some AWS regions do not support path-style requests at all.
LocalStack follows this recommendation: **Virtual-Hosted style is the default and recommended approach**.

### Recommended: Using AWS_ENDPOINT_URL_S3

The simplest way to configure your application to use LocalStack's S3 endpoint is with the `AWS_ENDPOINT_URL_S3` environment variable.
This approach works with modern AWS SDKs and tools without requiring code changes:

```bash
export AWS_ENDPOINT_URL_S3=http://s3.localhost.localstack.cloud:4566
```

This environment variable is supported by:
- **AWS CLI v2**: All `aws s3` and `aws s3api` commands automatically use this endpoint
- **boto3** (Python SDK) with botocore >= 1.29: `boto3.client("s3")` resolves the endpoint automatically
- **Terraform** with terraform-provider-aws >= 5.x: No `endpoints {}` block needed in your configuration

See AWS's [service-specific endpoint SDK compatibility matrix](https://docs.aws.amazon.com/sdkref/latest/guide/feature-ss-endpoints.html#ss-endpoints-sdk-compat) for the complete, up-to-date list of SDKs and minimum versions that support this variable.

With this variable set, your application code remains unchanged and can run against both LocalStack and real AWS by simply changing the environment.

### Virtual-Hosted Style Requests

A **Virtual-Hosted style** request includes the bucket name as part of the `Host` header.
For LocalStack to parse the bucket name correctly, your endpoint must be prefixed with `s3.`, like `s3.localhost.localstack.cloud`:

```bash
http://<bucket-name>.s3.localhost.localstack.cloud:4566/<key-name>
```

This is the format that `AWS_ENDPOINT_URL_S3` uses, and it's what most modern AWS SDKs use by default.

### Path Style Requests (Fallback)

**Path style** requests include the bucket as part of the URL path instead of the hostname:

```bash
http://s3.localhost.localstack.cloud:4566/<bucket-name>/<key-name>
```

You can combine path-style addressing with the `s3.`-prefixed endpoint, as shown above, or with a bare endpoint (`http://localhost:4566/<bucket-name>/<key-name>`).

You should only use path-style requests if you have a specific reason:
- Your bucket names contain periods. A period is a valid, DNS-compliant character, but the TLS certificate used for virtual-hosted-style buckets doesn't cover names with an extra dot in them, so virtual-hosted-style addressing over HTTPS breaks. See the [bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html) for the full list of naming restrictions.
- You're using an older SDK or tool that doesn't support virtual-hosted style.
- You're connecting to LocalStack from another container, for example in **Docker Compose**, using the LocalStack service's container name (such as `http://localstack:4566`). Wildcard subdomains like `<bucket-name>.localstack` are not resolvable in that case, so path-style addressing is required. This is one of the most common reasons users need path-style requests.

:::tip
To enable path-style requests in [AWS SDKs](https://aws.amazon.com/developer/tools/#SDKs), set the `ForcePathStyle` parameter to `true` in your S3 client configuration.
The parameter name varies by SDK:
- Python (boto3): `s3={'addressing_style': 'path'}` in the Session config, or `S3ForcePathStyle=true` in the Config
- JavaScript: `forcePathStyle: true`
- Go: `WithS3ForcePathStyle(true)`
- Terraform: `s3_use_path_style = true`
- PHP: `use_path_style_endpoint => true`

Check our [SDK documentation](/aws/connecting/aws-sdks/) for language-specific examples.
:::

### Endpoint URL Formats

LocalStack recognizes the following endpoint formats:

```bash
# Virtual-Hosted style (recommended)
http://<bucket-name>.s3.localhost.localstack.cloud:4566/<key-name>
http://<bucket-name>.s3.<region>.localhost.localstack.cloud:4566/<key-name>

# Path style (fallback)
http://s3.localhost.localstack.cloud:4566/<bucket-name>/<key-name>
http://s3.<region>.localhost.localstack.cloud:4566/<bucket-name>/<key-name>
http://localhost:4566/<bucket-name>/<key-name>
```

For detailed configuration instructions for specific SDKs and tools, see our [SDK documentation](/aws/customization/integrations/localstack-sdks/) and [Infrastructure as Code guides](/aws/connecting/infrastructure-as-code/).

## Signature validation

Like AWS, S3 in LocalStack can validate the signature of incoming requests and reject requests signed with invalid credentials.
Signature validation is disabled by default, so that S3 accepts requests signed with any credentials.

Two independent configuration options control signature validation:

- [`S3_SKIP_SIGNATURE_VALIDATION=0`](/aws/customization/configuration-options/#s3) validates [pre-signed URLs](#pre-signed-urls).
- [`S3_VALIDATE_SIGNATURES=1`](/aws/customization/configuration-options/#s3) validates regular, [SigV4-signed requests](#sigv4-validation).

### Credentials

When signature validation is enabled, requests must be signed with credentials that are valid in LocalStack.
The following credentials pass validation:

- **Default credentials**: the default `test` access key ID with the `test` secret access key, which works out of the box.
- **IAM user credentials**: access keys created for an IAM user with [`CreateAccessKey`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html).
  Check out the [IAM documentation](/aws/services/iam/#getting-started) to learn how to create a user and its access keys.
- **Temporary credentials**: credentials returned by the STS [`AssumeRole`](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) or [`GetSessionToken`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html) APIs, used together with their session token.

For example, after [creating a role](/aws/services/sts/#create-an-iam-role), you can retrieve temporary credentials for it using the `AssumeRole` API:

```bash
lstk aws sts assume-role \
    --role-arn arn:aws:iam::000000000000:role/localstack-role \
    --role-session-name localstack-session
```

```bash title="Output"
{
    "Credentials": {
        "AccessKeyId": "ACCESS_KEY_ID",
        "SecretAccessKey": "SECRET_ACCESS_KEY",
        "SessionToken": "SESSION_TOKEN",
        "Expiration": "TIMESTAMP"
    },
    ...
}
```

Export the returned credentials and use the AWS CLI or your SDK as usual — requests are now signed with the temporary credentials and pass validation:

```bash
export AWS_ACCESS_KEY_ID=ACCESS_KEY_ID
export AWS_SECRET_ACCESS_KEY=SECRET_ACCESS_KEY
export AWS_SESSION_TOKEN=SESSION_TOKEN

lstk aws s3api list-buckets
```

:::note
An access key ID that was not issued by LocalStack through IAM or STS is expected to be paired with the `test` secret access key.
Signing a request with such an access key ID and a different secret access key results in a `SignatureDoesNotMatch` error.

One exception is a 12-digit account ID used as access key ID for [multi-account namespacing](/aws/customization/advanced/multi-account-setups/), which cannot pass signature validation.
To send signed requests to another account than the default, use the credentials of an IAM user created in that account, or temporary credentials of a role assumed in it.
:::

Signature validation authenticates a request, but does not authorize it: by default, LocalStack does not check whether the credentials are allowed to perform the operation.
Authorization is handled by [IAM policy enforcement](/aws/developer-tools/security-testing/iam-policy-enforcement/), which can be enabled independently and combined with signature validation for the closest behavior to AWS.

### Pre-signed URLs

A pre-signed URL grants time-limited access to an S3 object: anyone with the URL can access the object without providing credentials.
You can generate a pre-signed URL as shown in the [Getting started](#generate-a-pre-signed-url-for-s3-object) section.

Presigning is a purely client-side operation: the SDK or the CLI computes the pre-signed URL locally with the credentials it is configured with, without contacting LocalStack.
The signature is only checked when the pre-signed URL is used.
For the validation to pass, the URL must therefore be generated with valid [credentials](#credentials).

By default, LocalStack accepts pre-signed URLs with an invalid signature or an expired date.
Start LocalStack with `S3_SKIP_SIGNATURE_VALIDATION=0` to validate pre-signed URLs like AWS does:

- The signature must match the request. Both SigV2 and SigV4 pre-signed URLs are supported.
- The URL must not be expired.
- All `x-amz-*` headers sent with the request must be signed in the URL.

Requests that fail validation are rejected with a `403` error, such as `SignatureDoesNotMatch` for an invalid signature, or `AccessDenied` for an expired URL.

### SigV4 validation

By default, LocalStack accepts regular S3 requests signed with any credentials.
Start LocalStack with `S3_VALIDATE_SIGNATURES=1` to validate [SigV4-signed requests](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) like AWS does.
LocalStack validates the signature in the `Authorization` header, as well as the integrity of the payload declared in the `x-amz-content-sha256` header, including streamed `aws-chunked` uploads.

If your SDK or CLI is configured with valid [credentials](#credentials), validation is fully transparent and does not require any change.
Requests that fail validation are rejected with the same errors as AWS, such as `SignatureDoesNotMatch` for a signature computed with the wrong secret access key, or `XAmzContentSHA256Mismatch` for a payload that does not match its declared checksum.

:::note
`S3_VALIDATE_SIGNATURES` only applies to SigV4-signed requests.
Anonymous requests, such as requests to public buckets or static S3 websites, and CORS preflight requests are not affected.
Pre-signed URL validation is exclusively controlled by `S3_SKIP_SIGNATURE_VALIDATION`.
:::

## Configuring Cross-Origin Resource Sharing on S3

You can configure Cross-Origin Resource Sharing (CORS) on a LocalStack S3 bucket using AWS Command Line Interface (CLI).
It would allow your local application to communicate directly with an S3 bucket in LocalStack.
By default, LocalStack will apply specific CORS rules to all requests to allow you to display and access your resources through [LocalStack Web Application](https://app.localstack.cloud).
If no CORS rules are configured for your S3 bucket, LocalStack will apply default rules unless specified otherwise.

To configure CORS rules for your S3 bucket, you can use the `lstk aws` command.
Optionally, you can run a local web application on [localhost:3000](http://localhost:3000).
You can emulate the same behaviour with an AWS SDK or an integration you use.
Follow this step-by-step guide to configure CORS rules on your S3 bucket.

Run the following command on your terminal to create your S3 bucket:

```bash
lstk aws s3api create-bucket --bucket cors-bucket
```

```bash title="Output"
{
    "Location": "/cors-bucket"
}
```

Next, create a JSON file with the CORS configuration.
The file should have the following format:

```json title="cors-config.json" showLineNumbers
{
  "CORSRules": [
    {
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["GET", "POST", "PUT"],
      "AllowedOrigins": ["http://localhost:3000"],
      "ExposeHeaders": ["ETag"]
    }
  ]
}
```

:::note
Note that this configuration is a sample, and you can tailor it to fit your needs better, for example, restricting the **AllowedHeaders** to specific ones.
:::

Save the file locally with a name of your choice, for example, `cors-config.json`.
Run the following command to apply the CORS configuration to your S3 bucket:

```bash
lstk aws s3api put-bucket-cors --bucket cors-bucket --cors-configuration file://cors-config.json
```

You can further verify that the CORS configuration was applied successfully by running the following command:

```bash
lstk aws s3api get-bucket-cors --bucket cors-bucket
```

On applying the configuration successfully, you should see the same JSON configuration file you created earlier.
Your S3 bucket is configured to allow cross-origin resource sharing, and if you try to send requests from your local application running on [localhost:3000](http://localhost:3000), they should be successful.

However, if you try to access your bucket from [LocalStack Web Application](https://app.localstack.cloud), you'll see errors, and your bucket won't be accessible anymore.
We can edit the JSON file `cors-config.json` you created earlier with the following configuration and save it:

```json title="cors-config.json" showLineNumbers
{
  "CORSRules": [
    {
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["GET", "POST", "PUT", "HEAD", "DELETE"],
      "AllowedOrigins": [
        "http://localhost:3000",
        "https://app.localstack.cloud",
        "http://app.localstack.cloud"
      ],
      "ExposeHeaders": ["ETag"]
    }
  ]
}
```

You can now run the same steps as before to update the CORS configuration and verify if it is applied correctly:

```bash
lstk aws s3api put-bucket-cors --bucket cors-bucket --cors-configuration file://cors-config.json
lstk aws s3api get-bucket-cors --bucket cors-bucket
```

You can try again to upload files in your bucket from the [LocalStack Web Application](https://app.localstack.cloud) and it should work.

## SSE-C Encryption

SSE-C (Server-Side Encryption with Customer-Provided Keys) is an Amazon S3 encryption method where customers provide their own encryption keys for securing objects.
AWS handles the encryption and decryption, but the keys are managed entirely by the customer.

LocalStack supports SSE-C parameter validation for the following S3 APIs:

- [`PutObject`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html)
- [`GetObject`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html)
- [`HeadObject`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html)
- [`GetObjectAttributes`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAttributes.html)
- [`CopyObject`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html)
- [`CreateMultipartUpload`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html)
- [`UploadPart`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPart.html)

However, LocalStack does not support the actual encryption and decryption of objects using SSE-C.

## S3 Replication

S3 Replication allows you to automatically copy objects from a source bucket to one or more destination buckets.
Replication can occur within the same region or across regions, and across different accounts.

LocalStack supports the following replication configurations:

- **One-way replication**: Objects are replicated from a source bucket to a destination bucket. You can scope replication using prefix-based or tag-based filtering, and optionally override the storage class for objects written to the destination bucket.
- **Two-way replication**: Both buckets are configured as source and destination for each other, and replication is configured to work in both directions.

### IAM enforcement

LocalStack supports IAM enforcement for S3 replication.
IAM permissions are evaluated in the context of each replication task using the IAM engine directly, which mirrors how AWS itself handles replication permissions.

### Metadata replication

LocalStack supports replication of object metadata, specifically tags and Object Lock settings. Metadata replication operates in two modes:

- **Default metadata replication**: When a source object's metadata is modified, those changes are automatically propagated to all of its replicas. This behavior is enabled by default and requires no additional configuration.
- **Replica metadata synchronization**: When enabled on the destination bucket, metadata changes made directly to a replica are synced back to the source object. This applies only when two-way replication is configured. See [Replication for metadata changes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-for-metadata-changes.html) in the AWS documentation for more details.

### ReplicationStatus

Replicated objects are assigned a `ReplicationStatus` field, which you can inspect with `GetObject` or `HeadObject`.
The possible values follow AWS semantics:

| Status | Meaning |
|---|---|
| `PENDING` | Replication has been queued but not yet completed |
| `COMPLETED` | Object was successfully replicated to the destination |
| `FAILED` | Replication could not be completed |
| `REPLICA` | This object is itself a copy created by replication |

:::note
The following replication features are not yet supported in LocalStack and will be available in a future release:

- **`s3:ReplicateTags` deny evaluation**: Explicitly denying `s3:ReplicateTags` will not cause replication to be denied if the object has tags.
- **KMS-encrypted object replication**: Objects encrypted with customer-provided KMS keys are not replicated, even when replication of KMS-encrypted objects is explicitly configured. See [Replicating objects created with server-side encryption using AWS KMS keys](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html#replications) in the AWS documentation for more details.
- **ACL replication**: Replication of Access Control Lists is not currently supported.
:::

## Resource Browser

The LocalStack Web Application provides a [Resource Browser](/aws/connecting/console/resource-browser) for managing S3 buckets & configurations.
You can access the Resource Browser by opening the LocalStack Web Application in your browser, navigating to the **Resources** section, and then clicking on **S3** under the **Storage** section.

![S3 Resource Browser](/images/aws/s3-resource-browser.png)

The Resource Browser allows you to perform the following actions:

- **Create Bucket**: Create a new S3 bucket by specifying a **Bucket Name**, **Bucket Configuration**, **ACL**, **Object Ownership**, and more.
- **Objects & Permissions**: View, upload, download, and delete objects in your S3 buckets.
  You can also view and edit the permissions, like the CORS Configuration for the bucket.
- **Create Folder**: Create a new folder in your S3 bucket by clicking on the **Create Folder** button and specifying a **Folder Name**.
- **Delete Bucket**: Delete an S3 bucket by selecting the S3 bucket and clicking on **Actions** button and clicking on **Remove Selected**.

## Examples

The following code snippets and sample applications provide practical examples of how to use S3 in LocalStack for various use cases:

- [Full-Stack application with Lambda, DynamoDB & S3 for shipment validation](https://github.com/localstack-samples/sample-shipment-list-demo-lambda-dynamodb-s3).
- [Serverless Transcription application using Transcribe, S3, Lambda, SQS, and SES](https://github.com/localstack/sample-transcribe-app)
- [Query data in S3 Bucket with Amazon Athena, Glue Catalog & CloudFormation](https://github.com/localstack/query-data-s3-athena-glue-sample)
- [Serverless Image Resizer with Lambda, S3, SNS, and SES](https://github.com/localstack/serverless-image-resizer)
- [Host a static website locally using Simple Storage Service (S3) and Terraform with LocalStack](https://docs.localstack.cloud/aws/tutorials/s3-static-website-terraform/)

## API Coverage


### Simple Storage Service API coverage

Source service: `s3`. 100 of 116 tracked operations are implemented.

Service documentation: /aws/services/s3/
License availability: available starting with the Hobby plan. See /aws/licensing/ for current plan details.

| Operation | Status |
| --- | --- |
| AbortMultipartUpload | Implemented |
| CompleteMultipartUpload | Implemented |
| CopyObject | Implemented |
| CreateBucket | Implemented |
| CreateBucketMetadataConfiguration | Not implemented |
| CreateBucketMetadataTableConfiguration | Not implemented |
| CreateMultipartUpload | Implemented |
| CreateSession | Not implemented |
| DeleteBucket | Implemented |
| DeleteBucketAnalyticsConfiguration | Implemented |
| DeleteBucketCors | Implemented |
| DeleteBucketEncryption | Implemented |
| DeleteBucketIntelligentTieringConfiguration | Implemented |
| DeleteBucketInventoryConfiguration | Implemented |
| DeleteBucketLifecycle | Implemented |
| DeleteBucketMetadataConfiguration | Not implemented |
| DeleteBucketMetadataTableConfiguration | Not implemented |
| DeleteBucketMetricsConfiguration | Implemented |
| DeleteBucketOwnershipControls | Implemented |
| DeleteBucketPolicy | Implemented |
| DeleteBucketReplication | Implemented |
| DeleteBucketTagging | Implemented |
| DeleteBucketWebsite | Implemented |
| DeleteObject | Implemented |
| DeleteObjectAnnotation | Not implemented |
| DeleteObjectTagging | Implemented |
| DeleteObjects | Implemented |
| DeletePublicAccessBlock | Implemented |
| GetBucketAbac | Implemented |
| GetBucketAccelerateConfiguration | Implemented |
| GetBucketAcl | Implemented |
| GetBucketAnalyticsConfiguration | Implemented |
| GetBucketCors | Implemented |
| GetBucketEncryption | Implemented |
| GetBucketIntelligentTieringConfiguration | Implemented |
| GetBucketInventoryConfiguration | Implemented |
| GetBucketLifecycle | Implemented |
| GetBucketLifecycleConfiguration | Implemented |
| GetBucketLocation | Implemented |
| GetBucketLogging | Implemented |
| GetBucketMetadataConfiguration | Not implemented |
| GetBucketMetadataTableConfiguration | Not implemented |
| GetBucketMetricsConfiguration | Implemented |
| GetBucketNotification | Implemented |
| GetBucketNotificationConfiguration | Implemented |
| GetBucketOwnershipControls | Implemented |
| GetBucketPolicy | Implemented |
| GetBucketPolicyStatus | Implemented |
| GetBucketReplication | Implemented |
| GetBucketRequestPayment | Implemented |
| GetBucketTagging | Implemented |
| GetBucketVersioning | Implemented |
| GetBucketWebsite | Implemented |
| GetObject | Implemented |
| GetObjectAcl | Implemented |
| GetObjectAnnotation | Not implemented |
| GetObjectAttributes | Implemented |
| GetObjectLegalHold | Implemented |
| GetObjectLockConfiguration | Implemented |
| GetObjectRetention | Implemented |
| GetObjectTagging | Implemented |
| GetObjectTorrent | Implemented |
| GetPublicAccessBlock | Implemented |
| HeadBucket | Implemented |
| HeadObject | Implemented |
| ListBucketAnalyticsConfigurations | Implemented |
| ListBucketIntelligentTieringConfigurations | Implemented |
| ListBucketInventoryConfigurations | Implemented |
| ListBucketMetricsConfigurations | Implemented |
| ListBuckets | Implemented |
| ListDirectoryBuckets | Implemented |
| ListMultipartUploads | Implemented |
| ListObjectAnnotations | Not implemented |
| ListObjectVersions | Implemented |
| ListObjects | Implemented |
| ListObjectsV2 | Implemented |
| ListParts | Implemented |
| PutBucketAbac | Implemented |
| PutBucketAccelerateConfiguration | Implemented |
| PutBucketAcl | Implemented |
| PutBucketAnalyticsConfiguration | Implemented |
| PutBucketCors | Implemented |
| PutBucketEncryption | Implemented |
| PutBucketIntelligentTieringConfiguration | Implemented |
| PutBucketInventoryConfiguration | Implemented |
| PutBucketLifecycle | Implemented |
| PutBucketLifecycleConfiguration | Implemented |
| PutBucketLogging | Implemented |
| PutBucketMetricsConfiguration | Implemented |
| PutBucketNotification | Implemented |
| PutBucketNotificationConfiguration | Implemented |
| PutBucketOwnershipControls | Implemented |
| PutBucketPolicy | Implemented |
| PutBucketReplication | Implemented |
| PutBucketRequestPayment | Implemented |
| PutBucketTagging | Implemented |
| PutBucketVersioning | Implemented |
| PutBucketWebsite | Implemented |
| PutObject | Implemented |
| PutObjectAcl | Implemented |
| PutObjectAnnotation | Not implemented |
| PutObjectLegalHold | Implemented |
| PutObjectLockConfiguration | Implemented |
| PutObjectRetention | Implemented |
| PutObjectTagging | Implemented |
| PutPublicAccessBlock | Implemented |
| RenameObject | Implemented |
| RestoreObject | Implemented |
| SelectObjectContent | Implemented |
| UpdateBucketMetadataAnnotationTableConfiguration | Not implemented |
| UpdateBucketMetadataInventoryTableConfiguration | Not implemented |
| UpdateBucketMetadataJournalTableConfiguration | Not implemented |
| UpdateObjectEncryption | Not implemented |
| UploadPart | Implemented |
| UploadPartCopy | Implemented |
| WriteGetObjectResponse | Not implemented |

## API Coverage (S3 Control)


### Simple Storage Service Control API coverage

Source service: `s3control`. 32 of 97 tracked operations are implemented.

Service documentation: /aws/services/s3/
License availability: available starting with the Hobby plan. See /aws/licensing/ for current plan details.

| Operation | Status |
| --- | --- |
| AssociateAccessGrantsIdentityCenter | Not implemented |
| CreateAccessGrant | Not implemented |
| CreateAccessGrantsInstance | Not implemented |
| CreateAccessGrantsLocation | Not implemented |
| CreateAccessPoint | Implemented |
| CreateAccessPointForObjectLambda | Not implemented |
| CreateBucket | Not implemented |
| CreateJob | Not implemented |
| CreateMultiRegionAccessPoint | Implemented |
| CreateStorageLensGroup | Not implemented |
| DeleteAccessGrant | Not implemented |
| DeleteAccessGrantsInstance | Not implemented |
| DeleteAccessGrantsInstanceResourcePolicy | Not implemented |
| DeleteAccessGrantsLocation | Not implemented |
| DeleteAccessPoint | Implemented |
| DeleteAccessPointForObjectLambda | Not implemented |
| DeleteAccessPointPolicy | Implemented |
| DeleteAccessPointPolicyForObjectLambda | Not implemented |
| DeleteAccessPointScope | Not implemented |
| DeleteBucket | Not implemented |
| DeleteBucketLifecycleConfiguration | Not implemented |
| DeleteBucketPolicy | Not implemented |
| DeleteBucketReplication | Not implemented |
| DeleteBucketTagging | Not implemented |
| DeleteJobTagging | Not implemented |
| DeleteMultiRegionAccessPoint | Implemented |
| DeletePublicAccessBlock | Implemented |
| DeleteStorageLensConfiguration | Implemented |
| DeleteStorageLensConfigurationTagging | Not implemented |
| DeleteStorageLensGroup | Not implemented |
| DescribeJob | Not implemented |
| DescribeMultiRegionAccessPointOperation | Implemented |
| DissociateAccessGrantsIdentityCenter | Not implemented |
| GetAccessGrant | Not implemented |
| GetAccessGrantsInstance | Not implemented |
| GetAccessGrantsInstanceForPrefix | Not implemented |
| GetAccessGrantsInstanceResourcePolicy | Not implemented |
| GetAccessGrantsLocation | Not implemented |
| GetAccessPoint | Implemented |
| GetAccessPointConfigurationForObjectLambda | Not implemented |
| GetAccessPointForObjectLambda | Not implemented |
| GetAccessPointPolicy | Implemented |
| GetAccessPointPolicyForObjectLambda | Not implemented |
| GetAccessPointPolicyStatus | Implemented |
| GetAccessPointPolicyStatusForObjectLambda | Not implemented |
| GetAccessPointScope | Implemented |
| GetBucket | Not implemented |
| GetBucketLifecycleConfiguration | Not implemented |
| GetBucketPolicy | Not implemented |
| GetBucketReplication | Not implemented |
| GetBucketTagging | Not implemented |
| GetBucketVersioning | Not implemented |
| GetDataAccess | Not implemented |
| GetJobTagging | Not implemented |
| GetMultiRegionAccessPoint | Implemented |
| GetMultiRegionAccessPointPolicy | Implemented |
| GetMultiRegionAccessPointPolicyStatus | Implemented |
| GetMultiRegionAccessPointRoutes | Not implemented |
| GetPublicAccessBlock | Implemented |
| GetStorageLensConfiguration | Implemented |
| GetStorageLensConfigurationTagging | Implemented |
| GetStorageLensGroup | Not implemented |
| ListAccessGrants | Not implemented |
| ListAccessGrantsInstances | Not implemented |
| ListAccessGrantsLocations | Not implemented |
| ListAccessPoints | Implemented |
| ListAccessPointsForDirectoryBuckets | Implemented |
| ListAccessPointsForObjectLambda | Not implemented |
| ListCallerAccessGrants | Not implemented |
| ListJobs | Not implemented |
| ListMultiRegionAccessPoints | Implemented |
| ListRegionalBuckets | Not implemented |
| ListStorageLensConfigurations | Implemented |
| ListStorageLensGroups | Not implemented |
| ListTagsForResource | Implemented |
| PutAccessGrantsInstanceResourcePolicy | Not implemented |
| PutAccessPointConfigurationForObjectLambda | Not implemented |
| PutAccessPointPolicy | Implemented |
| PutAccessPointPolicyForObjectLambda | Not implemented |
| PutAccessPointScope | Implemented |
| PutBucketLifecycleConfiguration | Implemented |
| PutBucketPolicy | Not implemented |
| PutBucketReplication | Not implemented |
| PutBucketTagging | Not implemented |
| PutBucketVersioning | Not implemented |
| PutJobTagging | Not implemented |
| PutMultiRegionAccessPointPolicy | Implemented |
| PutPublicAccessBlock | Implemented |
| PutStorageLensConfiguration | Implemented |
| PutStorageLensConfigurationTagging | Implemented |
| SubmitMultiRegionAccessPointRoutes | Not implemented |
| TagResource | Implemented |
| UntagResource | Implemented |
| UpdateAccessGrantsLocation | Not implemented |
| UpdateJobPriority | Not implemented |
| UpdateJobStatus | Not implemented |
| UpdateStorageLensGroup | Not implemented |