Access S3 data through an access grant
After a grantee obtains temporary credentials through their access grant, they can use these temporary credentials to call Amazon S3 API operations to access your data.
Grantees can access S3 data by using the Amazon Command Line Interface (Amazon CLI), the Amazon SDKs, and the Amazon S3 REST API.
After the grantee obtains their temporary credentials from S3 Access Grants, they can set up a profile with these credentials to retrieve the data.
To install the Amazon CLI, see Installing the Amazon CLI in the Amazon Command Line Interface User Guide.
To use the following example commands, replace the
with your own information.user input
placeholders
Example – Set up a profile
aws configure set aws_access_key_id "
$accessKey
" --profileaccess-grants-consumer-access-profile
aws configure set aws_secret_access_key "$secretKey
" --profileaccess-grants-consumer-access-profile
aws configure set aws_session_token "$sessionToken
" --profileaccess-grants-consumer-access-profile
To use the following example command, replace the
with your own information.user input
placeholders
Example – Get the S3 data
The grantee can use the get-object Amazon CLI command to access the data. The grantee can also use put-object, ls, and other S3 Amazon CLI commands.
aws s3api get-object \ --bucket DOC-EXAMPLE-BUCKET1 \ --key
myprefix
\ --regionus-east-2
\ --profileaccess-grants-consumer-access-profile
This section provides examples of how grantees can access your S3 data by using the Amazon SDKs.