将 S3 分批操作与 S3 对象锁定保留监管模式结合使用 - Amazon Simple Storage Service
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅 中国的 Amazon Web Services 服务入门 (PDF)

将 S3 分批操作与 S3 对象锁定保留监管模式结合使用

以下示例基于上述创建信任策略以及设置 S3 分批操作和 S3 对象锁定配置权限的示例而构建。本示例说明如何跨多个对象应用 S3 对象锁定保留监管,retain until date 为 2025 年 1 月 30 日。它会创建一个分批操作任务,该任务使用清单存储桶,并在报告存储桶中报告结果。

要使用以下示例,请将 user input placeholders 替换为您自己的信息。

以下 Amazon CLI 示例说明如何使用批量操作跨多个对象应用 S3 对象锁定保留监管模式。

例 — 跨多个对象应用 S3 对象锁定保留监管,“保留到期日”为 2025 年 1 月 30 日
export AWS_PROFILE='aws-user' export AWS_DEFAULT_REGION='us-west-2' export ACCOUNT_ID=123456789012 export ROLE_ARN='arn:aws:iam::123456789012:role/batch_operations-objectlock' read -d '' OPERATION <<EOF { "S3PutObjectRetention": { "Retention": { "RetainUntilDate":"2025-01-30T00:00:00", "Mode":"GOVERNANCE" } } } EOF read -d '' MANIFEST <<EOF { "Spec": { "Format": "S3BatchOperations_CSV_20180820", "Fields": [ "Bucket", "Key" ] }, "Location": { "ObjectArn": "arn:aws:s3:::amzn-s3-demo-manifest-bucket/governance-objects-manifest.csv", "ETag": "Your-manifest-ETag" } } EOF read -d '' REPORT <<EOF { "Bucket": "arn:aws:s3:::amzn-s3-demo-completion-report-bucketT", "Format": "Report_CSV_20180820", "Enabled": true, "Prefix": "reports/governance-objects", "ReportScope": "AllTasks" } EOF aws \ s3control create-job \ --account-id "${ACCOUNT_ID}" \ --manifest "${MANIFEST//$'\n'}" \ --operation "${OPERATION//$'\n'/}" \ --report "${REPORT//$'\n'}" \ --priority 10 \ --role-arn "${ROLE_ARN}" \ --client-request-token "$(uuidgen)" \ --region "${AWS_DEFAULT_REGION}" \ --description "Put governance retention";
例 — 跨多个对象绕过保留监管

以下示例基于上述创建信任策略以及设置 S3 分批操作和 S3 对象锁定配置权限的示例而构建。它说明如何绕过跨多个对象的保留监管,并创建一个分批操作任务,该任务使用清单存储桶并在报告存储桶中报告结果。

export AWS_PROFILE='aws-user' read -d '' bypass_governance_permissions <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:BypassGovernanceRetention" ], "Resource": [ "arn:aws:s3:::amzn-s3-demo-manifest-bucket/*" ] } ] } EOF aws iam put-role-policy --role-name batch-operations-objectlock --policy-name bypass-governance-permissions --policy-document "${bypass_governance_permissions}" export AWS_PROFILE='aws-user' export AWS_DEFAULT_REGION='us-west-2' export ACCOUNT_ID=123456789012 export ROLE_ARN='arn:aws:iam::123456789012:role/batch_operations-objectlock' read -d '' OPERATION <<EOF { "S3PutObjectRetention": { "BypassGovernanceRetention": true, "Retention": { } } } EOF read -d '' MANIFEST <<EOF { "Spec": { "Format": "S3BatchOperations_CSV_20180820", "Fields": [ "Bucket", "Key" ] }, "Location": { "ObjectArn": "arn:aws:s3:::amzn-s3-demo-manifest-bucket/governance-objects-manifest.csv", "ETag": "Your-manifest-ETag" } } EOF read -d '' REPORT <<EOF { "Bucket": "arn:aws:s3:::amzn-s3-demo-completion-report-bucket", "Format": "Report_CSV_20180820", "Enabled": true, "Prefix": "reports/batch_operations-governance", "ReportScope": "AllTasks" } EOF aws \ s3control create-job \ --account-id "${ACCOUNT_ID}" \ --manifest "${MANIFEST//$'\n'}" \ --operation "${OPERATION//$'\n'/}" \ --report "${REPORT//$'\n'}" \ --priority 10 \ --role-arn "${ROLE_ARN}" \ --client-request-token "$(uuidgen)" \ --region "${AWS_DEFAULT_REGION}" \ --description "Remove governance retention";

以下示例基于上述创建信任策略以及设置 S3 分批操作和 S3 对象锁定配置权限的示例而构建。本示例说明如何跨多个对象应用 S3 对象锁定保留监管,retain until date 设置为 2025 年 1 月 30 日。本示例会创建一个批量操作任务,该任务使用清单存储桶,并在报告存储桶中报告结果。

例 — 跨多个对象应用 S3 对象锁定保留监管,“保留到期日”为 2025 年 1 月 30 日
public String createGovernanceRetentionJob(final AWSS3ControlClient awss3ControlClient) throws ParseException { final String manifestObjectArn = "arn:aws:s3:::amzn-s3-demo-manifest-bucket/governance-objects-manifest.csv"; final String manifestObjectVersionId = "15ad5ba069e6bbc465c77bf83d541385"; final JobManifestLocation manifestLocation = new JobManifestLocation() .withObjectArn(manifestObjectArn) .withETag(manifestObjectVersionId); final JobManifestSpec manifestSpec = new JobManifestSpec() .withFormat(JobManifestFormat.S3BatchOperations_CSV_20180820) .withFields("Bucket", "Key"); final JobManifest manifestToPublicApi = new JobManifest() .withLocation(manifestLocation) .withSpec(manifestSpec); final String jobReportBucketArn = "arn:aws:s3:::amzn-s3-demo-completion-report-bucket"; final String jobReportPrefix = "reports/governance-objects"; final JobReport jobReport = new JobReport() .withEnabled(true) .withReportScope(JobReportScope.AllTasks) .withBucket(jobReportBucketArn) .withPrefix(jobReportPrefix) .withFormat(JobReportFormat.Report_CSV_20180820); final SimpleDateFormat format = new SimpleDateFormat("dd/MM/yyyy"); final Date jan30th = format.parse("30/01/2025"); final JobOperation jobOperation = new JobOperation() .withS3PutObjectRetention(new S3SetObjectRetentionOperation() .withRetention(new S3Retention() .withMode(S3ObjectLockRetentionMode.GOVERNANCE) .withRetainUntilDate(jan30th))); final String roleArn = "arn:aws:iam::123456789012:role/batch_operations-object-lock"; final Boolean requiresConfirmation = true; final int priority = 10; final CreateJobRequest request = new CreateJobRequest() .withAccountId("123456789012") .withDescription("Put governance retention") .withManifest(manifestToPublicApi) .withOperation(jobOperation) .withPriority(priority) .withRoleArn(roleArn) .withReport(jobReport) .withConfirmationRequired(requiresConfirmation); final CreateJobResult result = awss3ControlClient.createJob(request); return result.getJobId(); }
例 — 跨多个对象绕过保留监管

以下示例基于上述创建信任策略以及设置 S3 分批操作和 S3 对象锁定配置权限的示例而构建。本示例说明如何跨多个对象绕过保留监管,并创建一个批量操作任务,该任务使用清单存储桶并在报告存储桶中报告结果。

public void allowBypassGovernance() { final String roleName = "batch_operations-object-lock"; final String bypassGovernancePermissions = "{" + " \"Version\": \"2012-10-17\"," + " \"Statement\": [" + " {" + " \"Effect\": \"Allow\"," + " \"Action\": [" + " \"s3:BypassGovernanceRetention\"" + " ]," + " \"Resource\": [" + " \"arn:aws:s3:::amzn-s3-demo-manifest-bucket/*\"" + " ]" + " }" + " ]" + "}"; final AmazonIdentityManagement iam = AmazonIdentityManagementClientBuilder.defaultClient(); final PutRolePolicyRequest putRolePolicyRequest = new PutRolePolicyRequest() .withPolicyDocument(bypassGovernancePermissions) .withPolicyName("bypass-governance-permissions") .withRoleName(roleName); final PutRolePolicyResult putRolePolicyResult = iam.putRolePolicy(putRolePolicyRequest); } public String createRemoveGovernanceRetentionJob(final AWSS3ControlClient awss3ControlClient) { final String manifestObjectArn = "arn:aws:s3:::amzn-s3-demo-manifest-bucket/governance-objects-manifest.csv"; final String manifestObjectVersionId = "15ad5ba069e6bbc465c77bf83d541385"; final JobManifestLocation manifestLocation = new JobManifestLocation() .withObjectArn(manifestObjectArn) .withETag(manifestObjectVersionId); final JobManifestSpec manifestSpec = new JobManifestSpec() .withFormat(JobManifestFormat.S3BatchOperations_CSV_20180820) .withFields("Bucket", "Key"); final JobManifest manifestToPublicApi = new JobManifest() .withLocation(manifestLocation) .withSpec(manifestSpec); final String jobReportBucketArn = "arn:aws:s3:::amzn-s3-demo-completion-report-bucket"; final String jobReportPrefix = "reports/batch_operations-governance"; final JobReport jobReport = new JobReport() .withEnabled(true) .withReportScope(JobReportScope.AllTasks) .withBucket(jobReportBucketArn) .withPrefix(jobReportPrefix) .withFormat(JobReportFormat.Report_CSV_20180820); final JobOperation jobOperation = new JobOperation() .withS3PutObjectRetention(new S3SetObjectRetentionOperation() .withRetention(new S3Retention())); final String roleArn = "arn:aws:iam::123456789012:role/batch_operations-object-lock"; final Boolean requiresConfirmation = true; final int priority = 10; final CreateJobRequest request = new CreateJobRequest() .withAccountId("123456789012") .withDescription("Remove governance retention") .withManifest(manifestToPublicApi) .withOperation(jobOperation) .withPriority(priority) .withRoleArn(roleArn) .withReport(jobReport) .withConfirmationRequired(requiresConfirmation); final CreateJobResult result = awss3ControlClient.createJob(request); return result.getJobId(); }