new¶

Create a new S3 client object. Takes some arguments:

credentials (optional)

Reference to a class (like "Amazon::Credentials") that can provide credentials via the methods:

 get_aws_access_key_id()
 get_aws_secret_access_key()
 get_token()
    

If you do not provide a credential class you must provide the keys when you instantiate the object. See below.

You are strongly encourage to use a class that provides getters. If you choose to provide your credentials to this class then they will be stored in this object. If you dump the class you will likely expose those credentials.

aws_access_key_id

Use your Access Key ID as the value of the AWSAccessKeyId parameter in requests you send to Amazon Web Services (when required). Your Access Key ID identifies you as the party responsible for the request.

aws_secret_access_key

Since your Access Key ID is not encrypted in requests to AWS, it could be discovered and used by anyone. Services that are not free require you to provide additional information, a request signature, to verify that a request containing your unique Access Key ID could only have come from you.

DO NOT INCLUDE THIS IN SCRIPTS OR APPLICATIONS YOU DISTRIBUTE. YOU'LL BE SORRY.

Consider using a credential class as described above to provide credentials, otherwise this class will store your credentials for signing the requests. If you dump this object to logs your credentials could be discovered.

token

An optional temporary token that will be inserted in the request along with your access and secret key. A token is used in conjunction with temporary credentials when your EC2 instance has assumed a role and you've scraped the temporary credentials from http://169.254.169.254/latest/meta-data/iam/security-credentials

secure

Set this to a true value if you want to use SSL-encrypted connections when connecting to S3. Starting in version 0.49, the default is true.

default: true

timeout

Defines the time, in seconds, your script should wait or a response before bailing.

default: 30s

retry

Enables or disables the library to retry upon errors. This uses exponential backoff with retries after 1, 2, 4, 8, 16, 32 seconds, as recommended by Amazon.

default: off

host

Defines the S3 host endpoint to use.

default: s3.amazonaws.com

Note that requests are made to domain buckets when possible. You can prevent that behavior if either the bucket name does conform to DNS bucket naming conventions or you preface the bucket name with '/'.

If you set a region then the host name will be modified accordingly if it is an Amazon endpoint.

region

The AWS region you where your bucket is located.

default: us-east-1

buffer_size

The default buffer size when reading or writing files.

default: 4096

signer¶

Sets or retrieves the signer object. API calls must be signed using your AWS credentials. By default, starting with version 0.54 the module will use Net::Amazon::Signature::V4 as the signer and instantiate a signer object in the constructor. Note however, that signers need your credentials and they will get stored by that class, making them susceptible to inadvertant exfiltration. You have a few options here:

1. Use your own signer.

You may have noticed that you can also provide your own credentials object forcing this module to use your object for retrieving credentials. Likewise, you can use your own signer so that this module's signer never sees or stores those credentials.

2. Pass the credentials object and set "cache_signer" to a false value.

If you pass a credentials object and set "cache_signer" to a false value, the module will use the credentials object to retrieve credentials and create a new signer each time an API call is made that requires signing. This prevents your credentials from being stored inside of the signer class.

Note that using your own credentials object that stores your credentials in plaintext is also going to expose your credentials when someone dumps the class.

3. Pass credentials, set "cache_signer" to a false value.

Unfortunately, while this will prevent Net::Amazon::Signature::V4 from hanging on to your credentials, you credentials will be stored in the Amazon::S3 object.

Starting with version 0.55 of this module, if you have installed Crypt::CBC and Crypt::Blowfish, your credentials will be encrypted using a random key created when the class is instantiated. While this is more secure than leaving them in plaintext, if the key is discovered (the key however is not stored in the object's hash) and the object is dumped, your encrypted credentials can be exposed.

4. Use very granular credentials for bucket access only.

Use credentials that only allow access to a bucket or portions of a bucket required for your application. This will at least limit the blast radius of any potential security breach.

5. Do nothing...send the credentials, use the default signer.

In this case, both the Amazon::S3 class and the Net::Amazon::Signature::V4 have your credentials. Caveat Emptor.

See Also Amazon::Credentials for more information about safely storing your credentials and preventing exfiltration.

region¶

Sets the region for the for the API calls. This will also be the default when instantiating the bucket object unless you pass the region parameter in the "bucket" method or use the "verify_region" flag that will always verify the region of the bucket using the "get_location_constraint" method.

default: us-east-1

buckets¶

 buckets([verify-region])

verify-region (optional)

"verify-region" is a boolean value that indicates if the bucket's region should be verified when the bucket object is instantiated.

If set to true, this method will call the "bucket" method with "verify_region" set to true causing the constructor to call the "get_location_constraint" for each bucket to set the bucket's region. This will cause a significant decrease in the peformance of the "buckets()" method. Setting the region for each bucket is necessary since API operations on buckets require the region of the bucket when signing API requests. If all of your buckets are in the same region and you have passed a region parameter to your S3 object, then that region will be used when calling the constructor of your bucket objects.

default: false

Returns a HASHREF containing the metadata for all of the buckets owned by the accout or (see below) or "undef" on error.

owner_id

The owner ID of the bucket's owner.

owner_display_name

The name of the owner account.

buckets

Any ARRAYREF of Amazon::S3::Bucket objects for the account.

add_bucket¶

 add_bucket(bucket-configuration)

"bucket-configuration" is a reference to a hash with bucket configuration parameters.

bucket

The name of the bucket. See Bucket name rules <https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html> for more details on bucket naming rules.

acl_short (optional)

See the set_acl subroutine for documentation on the acl_short options

location_constraint

region

The region the bucket is to be created in.

Returns a Amazon::S3::Bucket object on success or "undef" on failure.

bucket¶

 bucket(bucket, [region])
 bucket({ bucket => bucket-name, verify_region => boolean, region => region });

Takes a scalar argument or refernce to a hash of arguments.

You can pass the region or set "verify_region" indicating that you want the bucket constructor to detemine the bucket region.

If you do not pass the region or set the "verify_region" value, the region will be set to the default region set in your "Amazon::S3" object.

See Amazon::S3::Bucket for a complete description of the "bucket" method.

delete_bucket¶

Takes either a Amazon::S3::Bucket object or a HASHREF containing:

bucket

The name of the bucket to remove

region

Region the bucket is located in. If not provided, the method will determine the bucket's region by calling "get_bucket_location".

Returns a boolean indicating the success of failure of the API call. Check "err" or "errstr" for error messages.

Note from the Amazon's documentation <https://docs.aws.amazon.com/AmazonS3/latest/userguide/BucketRestrictions.html>

dns_bucket_names¶

Set or get a boolean that indicates whether to use DNS bucket names.

default: true

list_bucket, list_bucket_v2¶

List all keys in this bucket.

Takes a HASHREF of arguments:

bucket

REQUIRED. The name of the bucket you want to list keys on.

prefix

Restricts the response to only contain results that begin with the specified prefix. If you omit this optional argument, the value of prefix for your query will be the empty string. In other words, the results will be not be restricted by prefix.

delimiter

If this optional, Unicode string parameter is included with your request, then keys that contain the same string between the prefix and the first occurrence of the delimiter will be rolled up into a single result element in the CommonPrefixes collection. These rolled-up keys are not returned elsewhere in the response. For example, with prefix="USA/" and delimiter="/", the matching keys "USA/Oregon/Salem" and "USA/Oregon/Portland" would be summarized in the response as a single "USA/Oregon" element in the CommonPrefixes collection. If an otherwise matching key does not contain the delimiter after the prefix, it appears in the Contents collection.

Each element in the CommonPrefixes collection counts as one against the MaxKeys limit. The rolled-up keys represented by each CommonPrefixes element do not. If the Delimiter parameter is not present in your request, keys in the result set will not be rolled-up and neither the CommonPrefixes collection nor the NextMarker element will be present in the response.

NOTE: CommonPrefixes isn't currently supported by Amazon::S3.

max-keys

This optional argument limits the number of results returned in response to your query. Amazon S3 will return no more than this number of results, but possibly less. Even if max-keys is not specified, Amazon S3 will limit the number of results in the response. Check the IsTruncated flag to see if your results are incomplete. If so, use the Marker parameter to request the next page of results. For the purpose of counting max-keys, a 'result' is either a key in the 'Contents' collection, or a delimited prefix in the 'CommonPrefixes' collection. So for delimiter requests, max-keys limits the total number of list results, not just the number of keys.

marker

This optional parameter enables pagination of large result sets. "marker" specifies where in the result set to resume listing. It restricts the response to only contain results that occur alphabetically after the value of marker. To retrieve the next page of results, use the last key from the current page of results as the marker in your next request.

See also "next_marker", below.

If "marker" is omitted,the first page of results is returned.

Returns "undef" on error and a HASHREF of data on success:

The HASHREF looks like this:

  {
        bucket       => $bucket_name,
        prefix       => $bucket_prefix, 
        marker       => $bucket_marker, 
        next_marker  => $bucket_next_available_marker,
        max_keys     => $bucket_max_keys,
        is_truncated => $bucket_is_truncated_boolean
        keys          => [$key1,$key2,...]
   }

Explanation of bits of that:

is_truncated

B flag that indicates whether or not all results of your query were returned in this response. If your results were truncated, you can make a follow-up paginated request using the Marker parameter to retrieve the rest of the results.

next_marker

A convenience element, useful when paginating with delimiters. The value of "next_marker", if present, is the largest (alphabetically) of all key names and all CommonPrefixes prefixes in the response. If the "is_truncated" flag is set, request the next page of results by setting "marker" to the value of "next_marker". This element is only present in the response if the "delimiter" parameter was sent with the request.

Each key is a HASHREF that looks like this:

     {
        key           => $key,
        last_modified => $last_mod_date,
        etag          => $etag, # An MD5 sum of the stored content.
        size          => $size, # Bytes
        storage_class => $storage_class # Doc?
        owner_id      => $owner_id,
        owner_displayname => $owner_name
    }

get_bucket_location¶

 get_bucket_location(bucket-name)
 get_bucket_locaiton(bucket-obj)

This is a convenience routines for the "get_location_constraint()" of the bucket object. This method will, however return the default region of 'us-east-1' when "get_location_constraint()" returns a null value.

 my $region = $s3->get_bucket_location('my-bucket');

Starting with version 0.55, "Amazon::S3::Bucket" will call this "get_location_constraint()" to determine the region for the bucket. You can get the region for the bucket by using the "region()" method of the bucket object.

  my $bucket = $s3->bucket('my-bucket');
  my $bucket_region = $bucket->region;

get_logger¶

Returns the logger object. If you did not set a logger when you created the object then the an instance of "Amazon::S3::Logger" is returned. You can log to STDERR using this logger. For example:

 $s3->get_logger->debug('this is a debug message');
 $s3->get_logger->trace(sub { return Dumper([$response]) });

list_bucket_all, list_bucket_all_v2¶

List all keys in this bucket without having to worry about 'marker'. This is a convenience method, but may make multiple requests to S3 under the hood.

Takes the same arguments as list_bucket.

You are encouraged to use the newer "list_bucket_all_v2" method.

err¶

The S3 error code for the last error encountered.

errstr¶

A human readable error string for the last error encountered.

error¶

The decoded XML string as a hash object of the last error.

last_response¶

Returns the last HTTP::Response object.

last_request¶

Returns the last HTTP::Request object.

level¶

Set the logging level.

default: error

turn_on_special_retry¶

Called to add extra retry codes if retry has been set

turn_off_special_retry¶

Called to turn off special retry codes when we are deliberately triggering them

LOGGING AND DEBUGGING¶

Additional debugging information can be output to STDERR by setting the "level" option when you instantiate the "Amazon::S3" object. Levels are represented as a string. The valid levels are:

 fatal
 error
 warn
 info
 debug
 trace

You can set an optionally pass in a logger that implements a subset of the "Log::Log4perl" interface. Your logger should support at least these method calls. If you do not supply a logger the default logger ("Amazon::S3::Logger") will be used.

 get_logger()
 fatal()
 error()
 warn()
 info()
 debug()
 trace()
 level()

At the "trace" level, every HTTP request and response will be output to STDERR. At the "debug" level information regarding the higher level methods will be output to STDERR. There currently is no additional information logged at lower levels.

S3 LINKS OF INTEREST¶

Bucket restrictions and limitations <https://docs.aws.amazon.com/AmazonS3/latest/userguide/BucketRestrictions.html>

Bucket naming rules <https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html>

Amazon S3 REST API <https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html>

Authenticating Requests (AWS Signature Version 4) <https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html>

Authenticating Requests (AWS Signature Version 2) <https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAuthentication.html>