sharing.s3.query

Sent on sharing.s3 changes.

Type: object

ADDED

SharingS3AddedEvent

Type: object
No Additional Properties

id Required

Id

Type: integer

fields Required

SharingS3Entry

Type: object
No Additional Properties

id Required

Id

Type: integer

Unique identifier for the bucket.

name Required

Name

Type: string

Bucket name, following the S3 rules. Three to 63 characters of lowercase letters, digits, dots and hyphens, starting and ending with a letter or digit, no adjacent dots, and never an IPv4 address.

Must match regular expression: ^[a-z0-9][a-z0-9.-]*[a-z0-9]$

Must be at least 3 characters long

Must be at most 63 characters long

dataset Required

Dataset

Type: string

The ZFS dataset the bucket is. Created by sharing.s3.create and owned by it. Objects live in the s3data directory under its mount point, which the S3 service creates on its next start, owned by owner. Under the S3 and MULTIPROTOCOL permissions models every object is written under the account that put it, so a grantee other than the owner can write only where that directory's permissions allow; set an ACL on it as for any share, or choose S3_BUCKET_OWNER_ENFORCED.

Must be at least 1 characters long

enabled

Enabled

Type: boolean Default: true

Whether the bucket is served. Toggling restarts the S3 service.

owner Required

Owner

Type: string

Account that owns the bucket and bypasses its grants, owns the s3data directory when the S3 service creates it, and owns every object under the S3_BUCKET_OWNER_ENFORCED permissions model. Given by name, held by uid: the name is resolved when set and again whenever the bucket is read, so a renamed account reads as its new name, a reused name never inherits the bucket, and an account that no longer exists reads as its uid. Changing the owner later moves the grants, not the directory.

Must be at least 1 characters long

owner_uid Required

Owner Uid

Type: integer

The uid that owns the bucket.

grants

Grants

Type: array of object Default: []

Who may access the bucket and how, beyond its owner.

No Additional Items

Each item of this array must be:

S3GrantEntry

Type: object
No Additional Properties

principal_type Required

Principal Type

Type: enum (of string)

Who the grant applies to. A user, a group, or everyone with a valid access key.

Must be one of:

• "USER"
• "GROUP"
• "EVERYONE"

xid

Xid

Default: null

The uid of the user or the gid of the group. Required for USER and GROUP, forbidden for EVERYONE.

Any of

• Option 1
• Option 2

Type: integer

Type: null

access Required

Access

Type: enum (of string)

What the grant allows. READONLY, WRITEONLY and READWRITE allow the matching operations. DENY refuses every operation for the principal and outranks the bucket owner.

Must be one of:

• "READONLY"
• "WRITEONLY"
• "READWRITE"
• "DENY"

name Required

Name

Type: string

Name of the user or group the grant applies to, resolved for display. Empty for EVERYONE.

permissions_model

Permissions Model

Type: enum (of string) Default: "S3"

Whose account the S3 service touches the dataset under. S3 when only the S3 service writes it: the grants alone decide a read, and every object is written under the account that put it. MULTIPROTOCOL when other protocols share the tree: a read is also subject to the file permissions those protocols set. S3_BUCKET_OWNER_ENFORCED when only the S3 service writes it and every object is to be owner's: every read and write runs as the owner, so the grants are the whole of the bucket's access control and a grantee needs no permissions on the s3data directory. A request is still authorized and audited as the account that made it.

Must be one of:

• "S3"
• "MULTIPROTOCOL"
• "S3_BUCKET_OWNER_ENFORCED"

versioning

Versioning

Type: enum (of string) Default: "OFF"

Bucket versioning state.

Must be one of:

• "OFF"
• "ENABLED"
• "SUSPENDED"

snapshot_versions

Snapshot Versions

Type: array of string Default: []

Patterns over the names of the bucket dataset's ZFS snapshots, * and ? the only metacharacters, each matched against a whole name. Every snapshot a pattern selects serves each object's state frozen in it as a read-only version: listed by ListObjectVersions and read by its version id. Empty serves none. Requires versioning to be ENABLED or SUSPENDED.

No Additional Items

Each item of this array must be:

Type: string

Must be at least 1 characters long

snapshot_versions_max

Snapshot Versions Max

Type: integer Default: 64

How many of the newest selected snapshots one ListObjectVersions listing consults. Bounds the listing alone: a selected snapshot beyond it still serves by its version id.

Value must be greater or equal to 1 and lesser or equal to 4294967295

multipart_etag

Multipart Etag

Type: enum (of string) Default: "COMPOSITE"

What the ETag of an object assembled from a multipart upload is. COMPOSITE is the S3 construction: each part's ETag is the MD5 of its bytes and the object's is the MD5 of those digests with the part count appended, which costs an MD5 pass over every part. MINTED skips that pass for a part whose upload carried no Content-MD5 and gives the object an opaque token instead. Choose it only where nothing writing the bucket reads its ETags, such as a backup target that declares its own checksums: a client that recomputes the composite to verify or resume an upload sees a value it cannot match.

Must be one of:

• "COMPOSITE"
• "MINTED"

object_lock

Object Lock

Type: boolean Default: false

Whether object lock is enabled. Requires versioning to be ENABLED and a permissions model other than MULTIPROTOCOL: a locked bucket is the S3 service's alone.

object_lock_default_mode

Object Lock Default Mode

Default: null

Retention mode of the default object lock rule, or null for no default rule.

Any of

• Option 1
• Option 2

Type: enum (of string)

Must be one of:

• "GOVERNANCE"
• "COMPLIANCE"

Type: null

object_lock_default_days

Object Lock Default Days

Default: null

Retention period of the default object lock rule in days, up to 36500 (a hundred years).

Any of

• Option 1
• Option 2

Type: integer

Value must be greater or equal to 1 and lesser or equal to 36500

Type: null

audit

Audit

Default: null

Actions audited on this bucket, ALL, or an empty list to audit nothing. null inherits the service's default_audit. Requires an Enterprise license.

Any of

• Option 1
• Option 2
• Option 3

Type: array of enum (of string)
No Additional Items

Each item of this array must be:

Type: enum (of string)

Must be one of:

• "GetObject"
• "PutObject"
• "DeleteObject"
• "GetObjectTagging"
• "PutObjectTagging"
• "DeleteObjectTagging"
• "ListBucket"
• "GetBucketLocation"
• "ListBucketMultipartUploads"
• "ListMultipartUploadParts"
• "AbortMultipartUpload"
• "PutObjectRetention"
• "PutObjectLegalHold"
• "ListAllMyBuckets"

Type: const
Specific value: "ALL"

Type: null

audit_overflow

Audit Overflow

Default: null

Overflow behavior for this bucket's audit records, or null to inherit the service's default.

Any of

• Option 1
• Option 2

Type: enum (of string)

Must be one of:

• "DROP"
• "BACKPRESSURE"

Type: null

locked

Locked

Default: null

Whether the bucket's dataset is locked. Read only.

Any of

• Option 1
• Option 2

Type: boolean

Type: null

CHANGED

SharingS3ChangedEvent

Type: object
No Additional Properties

id Required

Id

Type: integer

fields Required

SharingS3Entry

Type: object
No Additional Properties

id Required

Id

Type: integer

Unique identifier for the bucket.

name Required

Name

Type: string

Bucket name, following the S3 rules. Three to 63 characters of lowercase letters, digits, dots and hyphens, starting and ending with a letter or digit, no adjacent dots, and never an IPv4 address.

Must match regular expression: ^[a-z0-9][a-z0-9.-]*[a-z0-9]$

Must be at least 3 characters long

Must be at most 63 characters long

dataset Required

Dataset

Type: string

The ZFS dataset the bucket is. Created by sharing.s3.create and owned by it. Objects live in the s3data directory under its mount point, which the S3 service creates on its next start, owned by owner. Under the S3 and MULTIPROTOCOL permissions models every object is written under the account that put it, so a grantee other than the owner can write only where that directory's permissions allow; set an ACL on it as for any share, or choose S3_BUCKET_OWNER_ENFORCED.

Must be at least 1 characters long

enabled

Enabled

Type: boolean Default: true

Whether the bucket is served. Toggling restarts the S3 service.

owner Required

Owner

Type: string

Account that owns the bucket and bypasses its grants, owns the s3data directory when the S3 service creates it, and owns every object under the S3_BUCKET_OWNER_ENFORCED permissions model. Given by name, held by uid: the name is resolved when set and again whenever the bucket is read, so a renamed account reads as its new name, a reused name never inherits the bucket, and an account that no longer exists reads as its uid. Changing the owner later moves the grants, not the directory.

Must be at least 1 characters long

owner_uid Required

Owner Uid

Type: integer

The uid that owns the bucket.

grants

Grants

Type: array of object Default: []

Who may access the bucket and how, beyond its owner.

No Additional Items

Each item of this array must be:

S3GrantEntry

Type: object
No Additional Properties

principal_type Required

Principal Type

Type: enum (of string)

Who the grant applies to. A user, a group, or everyone with a valid access key.

Must be one of:

• "USER"
• "GROUP"
• "EVERYONE"

xid

Xid

Default: null

The uid of the user or the gid of the group. Required for USER and GROUP, forbidden for EVERYONE.

Any of

• Option 1
• Option 2

Type: integer

Type: null

access Required

Access

Type: enum (of string)

What the grant allows. READONLY, WRITEONLY and READWRITE allow the matching operations. DENY refuses every operation for the principal and outranks the bucket owner.

Must be one of:

• "READONLY"
• "WRITEONLY"
• "READWRITE"
• "DENY"

name Required

Name

Type: string

Name of the user or group the grant applies to, resolved for display. Empty for EVERYONE.

permissions_model

Permissions Model

Type: enum (of string) Default: "S3"

Whose account the S3 service touches the dataset under. S3 when only the S3 service writes it: the grants alone decide a read, and every object is written under the account that put it. MULTIPROTOCOL when other protocols share the tree: a read is also subject to the file permissions those protocols set. S3_BUCKET_OWNER_ENFORCED when only the S3 service writes it and every object is to be owner's: every read and write runs as the owner, so the grants are the whole of the bucket's access control and a grantee needs no permissions on the s3data directory. A request is still authorized and audited as the account that made it.

Must be one of:

• "S3"
• "MULTIPROTOCOL"
• "S3_BUCKET_OWNER_ENFORCED"

versioning

Versioning

Type: enum (of string) Default: "OFF"

Bucket versioning state.

Must be one of:

• "OFF"
• "ENABLED"
• "SUSPENDED"

snapshot_versions

Snapshot Versions

Type: array of string Default: []

Patterns over the names of the bucket dataset's ZFS snapshots, * and ? the only metacharacters, each matched against a whole name. Every snapshot a pattern selects serves each object's state frozen in it as a read-only version: listed by ListObjectVersions and read by its version id. Empty serves none. Requires versioning to be ENABLED or SUSPENDED.

No Additional Items

Each item of this array must be:

Type: string

Must be at least 1 characters long

snapshot_versions_max

Snapshot Versions Max

Type: integer Default: 64

How many of the newest selected snapshots one ListObjectVersions listing consults. Bounds the listing alone: a selected snapshot beyond it still serves by its version id.

Value must be greater or equal to 1 and lesser or equal to 4294967295

multipart_etag

Multipart Etag

Type: enum (of string) Default: "COMPOSITE"

What the ETag of an object assembled from a multipart upload is. COMPOSITE is the S3 construction: each part's ETag is the MD5 of its bytes and the object's is the MD5 of those digests with the part count appended, which costs an MD5 pass over every part. MINTED skips that pass for a part whose upload carried no Content-MD5 and gives the object an opaque token instead. Choose it only where nothing writing the bucket reads its ETags, such as a backup target that declares its own checksums: a client that recomputes the composite to verify or resume an upload sees a value it cannot match.

Must be one of:

• "COMPOSITE"
• "MINTED"

object_lock

Object Lock

Type: boolean Default: false

Whether object lock is enabled. Requires versioning to be ENABLED and a permissions model other than MULTIPROTOCOL: a locked bucket is the S3 service's alone.

object_lock_default_mode

Object Lock Default Mode

Default: null

Retention mode of the default object lock rule, or null for no default rule.

Any of

• Option 1
• Option 2

Type: enum (of string)

Must be one of:

• "GOVERNANCE"
• "COMPLIANCE"

Type: null

object_lock_default_days

Object Lock Default Days

Default: null

Retention period of the default object lock rule in days, up to 36500 (a hundred years).

Any of

• Option 1
• Option 2

Type: integer

Value must be greater or equal to 1 and lesser or equal to 36500

Type: null

audit

Audit

Default: null

Actions audited on this bucket, ALL, or an empty list to audit nothing. null inherits the service's default_audit. Requires an Enterprise license.

Any of

• Option 1
• Option 2
• Option 3

Type: array of enum (of string)
No Additional Items

Each item of this array must be:

Type: enum (of string)

Must be one of:

• "GetObject"
• "PutObject"
• "DeleteObject"
• "GetObjectTagging"
• "PutObjectTagging"
• "DeleteObjectTagging"
• "ListBucket"
• "GetBucketLocation"
• "ListBucketMultipartUploads"
• "ListMultipartUploadParts"
• "AbortMultipartUpload"
• "PutObjectRetention"
• "PutObjectLegalHold"
• "ListAllMyBuckets"

Type: const
Specific value: "ALL"

Type: null

audit_overflow

Audit Overflow

Default: null

Overflow behavior for this bucket's audit records, or null to inherit the service's default.

Any of

• Option 1
• Option 2

Type: enum (of string)

Must be one of:

• "DROP"
• "BACKPRESSURE"

Type: null

locked

Locked

Default: null

Whether the bucket's dataset is locked. Read only.

Any of

• Option 1
• Option 2

Type: boolean

Type: null

REMOVED

SharingS3RemovedEvent

Type: object
No Additional Properties

id Required

Id

Type: integer

Required roles: SHARING_S3_READ