category: IT Services
provider: Amazon
sectionorder:
- Connect
- Collect
commonfields:
  id: AWS - S3
  version: -1
configuration:
- display: Role Arn
  name: roleArn
  type: 0
  section: Connect
  required: false
- display: Role Session Name
  name: roleSessionName
  type: 0
  section: Connect
  required: false
- display: AWS Default Region
  name: defaultRegion
  options:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - ca-central-1
  - eu-west-1
  - eu-central-1
  - eu-west-2
  - ap-northeast-1
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-south-1
  - sa-east-1
  - eu-north-1
  - eu-west-3
  - us-gov-east-1
  - us-gov-west-1
  type: 15
  section: Connect
  advanced: true
  required: true
- display: Role Session Duration
  name: sessionDuration
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  section: Connect
  required: false
- display: Access Key
  name: access_key
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Secret Key
  name: secret_key
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Timeout
  name: timeout
  additionalinfo: The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 second will be used.
  defaultvalue: 60,10
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Retries
  name: retries
  defaultvalue: 5
  additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time."
  type: 0
  section: Connect
  advanced: true
  required: false
- display: PrivateLink service URL.
  name: endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: STS PrivateLink URL.
  name: sts_endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Bucket
  name: bucket
  type: 0
  section: Connect
  advanced: true
  required: false
  additionalinfo: Bucket used for network connectivity testing.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Amazon Web Services Simple Storage Service (S3).
display: AWS - S3
name: AWS - S3
script:
  commands:
  - arguments:
    - description: The name of S3 bucket to create (in lowercase).
      name: bucket
      required: true
    - auto: PREDEFINED
      description: ACL for S3 bucket.
      name: acl
      predefined:
      - private
      - public-read
      - public-read-write
      - authenticated-read
    - description: Specifies the region where the bucket will be created. If you don't specify a region, the bucket will be created in US Standard.
      name: locationConstraint
    - description: Allows grantee the read, write, read ACP, and write ACP permissions on the bucket.
      name: grantFullControl
    - description: Allows grantee to list the objects in the bucket.
      name: grantRead
    - description: Allows grantee to read the bucket ACL.
      name: grantReadACP
    - description: Allows grantee to create, overwrite, and delete any object in the bucket.
      name: grantWrite
    - description: Allows grantee to write the ACL for the applicable bucket.
      name: grantWriteACP
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Create AWS S3 bucket.
    name: aws-s3-create-bucket
    outputs:
    - contextPath: AWS.S3.Buckets.BucketName
      description: The name of the bucket that was created.
      type: string
    - contextPath: AWS.S3.Buckets.Location
      description: The AWS Region the bucket was created.
      type: string
  - arguments:
    - description: Name of S3 bucket to delete.
      name: bucket
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Delete AWS S3 bucket.
    name: aws-s3-delete-bucket
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: List all S3 buckets in AWS account.
    name: aws-s3-list-buckets
    outputs:
    - contextPath: AWS.S3.Buckets.BucketName
      description: The name of the bucket.
      type: string
    - contextPath: AWS.S3.Buckets.CreationDate
      description: Date the bucket was created.
      type: date
  - arguments:
    - description: Name of bucket.
      name: bucket
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Get AWS S3 Bucket Policy.
    name: aws-s3-get-bucket-policy
    outputs:
    - contextPath: AWS.S3.Buckets.Policy.Version
      description: S3 Bucket Policy Version.
      type: string
    - contextPath: AWS.S3.Buckets.Policy.PolicyId
      description: S3 Bucket Policy ID.
      type: string
    - contextPath: AWS.S3.Buckets.Policy.Sid
      description: S3 Bucket Policy Statment ID.
      type: string
    - contextPath: AWS.S3.Buckets.Policy.Action
      description: S3 Bucket Policy Statment Action.
      type: string
    - contextPath: AWS.S3.Buckets.Policy.Principal
      description: S3 Bucket Policy Statment Principal.
      type: string
    - contextPath: AWS.S3.Buckets.Policy.Resource
      description: S3 Bucket Policy Statment Resource.
      type: string
    - contextPath: AWS.S3.Buckets.Policy.Effect
      description: S3 Bucket Policy Statment Effect.
      type: string
    - contextPath: AWS.S3.Buckets.Policy.Json
      description: AWS S3 Policy Json output.
      type: string
    - contextPath: AWS.S3.Buckets.Policy.BucketName
      description: S3 Bucket Name.
      type: string
  - arguments:
    - description: Name of S3 bucket.
      name: bucket
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the policy from the bucket.
    name: aws-s3-delete-bucket-policy
  - arguments:
    - description: The name of S3 bucket.
      name: bucket
    - description: The S3 object key to download.
      name: key
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Download a file from S3 bucket to war room.
    name: aws-s3-download-file
  - arguments:
    - description: The name of S3 bucket.
      name: bucket
      required: true
    - description: A delimiter is a character you use to group keys.
      name: delimiter
    - description: Limits the response to keys that begin with the specified prefix.
      name: prefix
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: List object in S3 bucket.
    name: aws-s3-list-bucket-objects
    outputs:
    - contextPath: AWS.S3.Buckets.Objects.Key
      description: The name of S3 object.
      type: Unknown
    - contextPath: AWS.S3.Buckets.Objects.Size
      description: Object size.
      type: Unknown
    - contextPath: AWS.S3.Buckets.Objects.LastModified
      description: Last date object was modified.
      type: Unknown
  - arguments:
    - description: Name of S3 bucket.
      name: bucket
      required: true
    - description: The bucket policy to apply in json format.
      name: policy
      required: true
    - auto: PREDEFINED
      description: Set this parameter to true to confirm that you want to remove your permissions to change this bucket policy in the future.
      name: confirmRemoveSelfBucketAccess
      predefined:
      - 'True'
      - 'False'
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Replaces a policy on a bucket. If the bucket already has a policy, the one in this request completely replaces it.
    name: aws-s3-put-bucket-policy
  - arguments:
    - description: The name of the bucket from which the server-side encryption configuration is retrieved.
      name: bucket
      required: true
    - description: The account ID of the exepcted bucket owner.
      name: expectedBucketOwner
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Get AWS S3 Bucket Encryption.
    name: aws-s3-get-bucket-encryption
    outputs:
    - contextPath: AWS.S3.Buckets.BucketName.ServerSideEncryptionConfiguration.Rules.ApplyServerSideEncryptionByDefault.SSEAlgorithm
      description: S3 Bucket Encryption SSE Algorithm.
      type: string
    - contextPath: AWS.S3.Buckets.BucketName.ServerSideEncryptionConfiguration.Rules.ApplyServerSideEncryptionByDefault.KMSMasterKeyID
      description: S3 Bucket Encryption KMS Master Key ID.
      type: string
    - contextPath: AWS.S3.Buckets.BucketName.ServerSideEncryptionConfiguration.Rules.BucketKeyEnabled
      description: S3 Bucket Encryption Key Enabled.
      type: boolean
  - arguments:
    - description: Entry ID of the file to upload.
      name: entryID
      required: true
    - description: The name of the bucket to upload to.
      name: bucket
      required: true
    - description: The name of the key to upload to.
      name: key
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Upload file to S3 bucket.
    name: aws-s3-upload-file
  - arguments:
    - description: The name of the Amazon S3 bucket whose PublicAccessBlock configuration you want to retrieve.
      name: bucket
      required: true
    description: Retrieves the PublicAccessBlock configuration for an Amazon S3 bucket.
    name: aws-s3-get-public-access-block
    outputs:
    - contextPath: AWS.S3.Buckets.BucketName.PublicAccessBlockConfiguration.BlockPublicAcls
      description: Specifies whether Amazon S3 should block public access control lists (ACLs) for this bucket and objects in this bucket.
      type: Boolean
    - contextPath: AWS.S3.Buckets.BucketName.PublicAccessBlockConfiguration.IgnorePublicAcls
      description: Specifies whether Amazon S3 should ignore public ACLs for this bucket and objects in this bucket.
      type: Boolean
    - contextPath: AWS.S3.Buckets.BucketName.PublicAccessBlockConfiguration.BlockPublicPolicy
      description: Specifies whether Amazon S3 should block public bucket policies for this bucket.
      type: Boolean
    - contextPath: AWS.S3.Buckets.BucketName.PublicAccessBlockConfiguration.RestrictPublicBuckets
      description: Specifies whether Amazon S3 should restrict public bucket policies for this bucket.
      type: Boolean
  - arguments:
    - description: The name of the Amazon S3 bucket whose PublicAccessBlock configuration you want to retrieve.
      name: bucket
      required: true
    - description: Specifies whether Amazon S3 should block public access control lists (ACLs) for this bucket and objects in this bucket.
      name: BlockPublicAcls
      required: true
    - description: Specifies whether Amazon S3 should ignore public ACLs for this bucket and objects in this bucket.
      name: IgnorePublicAcls
      required: true
    - description: Specifies whether Amazon S3 should block public bucket policies for this bucket.
      name: BlockPublicPolicy
      required: true
    - description: Specifies whether Amazon S3 should restrict public bucket policies for this bucket.
      name: RestrictPublicBuckets
      required: true
    description: Creates or modifies the PublicAccessBlock configuration for an Amazon S3 bucket.
    name: aws-s3-put-public-access-block
  dockerimage: demisto/boto3py3:1.0.0.10221838
  runonce: false
  script: ''
  type: python
  subtype: python3
tests:
- AWS - S3 Test Playbook
fromversion: 5.0.0