@@ -50,9 +50,9 @@ final class CopyObjectRequest extends Input
50
50
* **Directory buckets** - When you use this operation with a directory bucket, you must use virtual-hosted-style
51
51
* requests in the format `*Bucket-name*.s3express-*zone-id*.*region-code*.amazonaws.com`. Path-style requests are not
52
52
* supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names
53
- * must follow the format `*bucket-base-name*--*zone-id*--x-s3` (for example, `*DOC-EXAMPLE-BUCKET*--*usw2-az1*--x-s3`).
54
- * For information about bucket naming restrictions, see Directory bucket naming rules [^1] in the *Amazon S3 User
55
- * Guide*.
53
+ * must follow the format `*bucket-base-name*--*zone-id*--x-s3` (for example,
54
+ * `*amzn-s3-demo-bucket*--*usw2-az1*--x-s3`). For information about bucket naming restrictions, see Directory bucket
55
+ * naming rules [^1] in the *Amazon S3 User Guide*.
56
56
*
57
57
* > Copying objects across different Amazon Web Services Regions isn't supported when the source or destination bucket
58
58
* > is in Amazon Web Services Local Zones. The source and destination buckets must have the same parent Amazon Web
@@ -67,11 +67,14 @@ final class CopyObjectRequest extends Input
67
67
*
68
68
* > Access points and Object Lambda access points are not supported by directory buckets.
69
69
*
70
- * **S3 on Outposts** - When you use this action with Amazon S3 on Outposts, you must direct requests to the S3 on
71
- * Outposts hostname. The S3 on Outposts hostname takes the form
72
- * `*AccessPointName*-*AccountId*.*outpostID*.s3-outposts.*Region*.amazonaws.com`. When you use this action with S3 on
73
- * Outposts through the Amazon Web Services SDKs, you provide the Outposts access point ARN in place of the bucket name.
74
- * For more information about S3 on Outposts ARNs, see What is S3 on Outposts? [^3] in the *Amazon S3 User Guide*.
70
+ * **S3 on Outposts** - When you use this action with S3 on Outposts, you must use the Outpost bucket access point ARN
71
+ * or the access point alias for the destination bucket. You can only copy objects within the same Outpost bucket. It's
72
+ * not supported to copy objects across different Amazon Web Services Outposts, between buckets on the same Outposts, or
73
+ * between Outposts buckets and any other bucket types. For more information about S3 on Outposts, see What is S3 on
74
+ * Outposts? [^3] in the *S3 on Outposts guide*. When you use this action with S3 on Outposts through the REST API, you
75
+ * must direct requests to the S3 on Outposts hostname, in the format
76
+ * `*AccessPointName*-*AccountId*.*outpostID*.s3-outposts.*Region*.amazonaws.com`. The hostname isn't required when you
77
+ * use the Amazon Web Services CLI or SDKs.
75
78
*
76
79
* [^1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-bucket-naming-rules.html
77
80
* [^2]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-access-points.html
@@ -510,14 +513,12 @@ final class CopyObjectRequest extends Input
510
513
* any of the officially supported Amazon Web Services SDKs and Amazon Web Services CLI, see Specifying the Signature
511
514
* Version in Request Authentication [^1] in the *Amazon S3 User Guide*.
512
515
*
513
- * **Directory buckets** - If you specify `x-amz-server-side-encryption` with `aws:kms`, the `
514
- * x-amz-server-side-encryption-aws-kms-key-id` header is implicitly assigned the ID of the KMS symmetric encryption
515
- * customer managed key that's configured for your directory bucket's default encryption setting. If you want to specify
516
- * the ` x-amz-server-side-encryption-aws-kms-key-id` header explicitly, you can only specify it with the ID (Key ID or
517
- * Key ARN) of the KMS customer managed key that's configured for your directory bucket's default encryption setting.
518
- * Otherwise, you get an HTTP `400 Bad Request` error. Only use the key ID or key ARN. The key alias format of the KMS
519
- * key isn't supported. Your SSE-KMS configuration can only support 1 customer managed key [^2] per directory bucket for
520
- * the lifetime of the bucket. The Amazon Web Services managed key [^3] (`aws/s3`) isn't supported.
516
+ * **Directory buckets** - To encrypt data using SSE-KMS, it's recommended to specify the `x-amz-server-side-encryption`
517
+ * header to `aws:kms`. Then, the `x-amz-server-side-encryption-aws-kms-key-id` header implicitly uses the bucket's
518
+ * default KMS customer managed key ID. If you want to explicitly set the ` x-amz-server-side-encryption-aws-kms-key-id`
519
+ * header, it must match the bucket's default customer managed key (using key ID or ARN, not alias). Your SSE-KMS
520
+ * configuration can only support 1 customer managed key [^2] per directory bucket's lifetime. The Amazon Web Services
521
+ * managed key [^3] (`aws/s3`) isn't supported. Incorrect key specification results in an HTTP `400 Bad Request` error.
521
522
*
522
523
* [^1]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version
523
524
* [^2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
0 commit comments