s3express:CreateSession is a Write access-level action in the s3express service. Grants permission to Create Session token which is used for object APIs such as PutObject, GetObject, etc
ARNs that s3express:CreateSession can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants s3express:CreateSession.
Filters access by AWS Local Zone network border group(s) provided in this condition key
Filters access by the permission requested by Access Point Scope configuration, such as GetObject, PutObject
Filters access by the resource owner AWS account ID
Filters access by the permission requested by CreateSession API, such as ReadOnly and ReadWrite
Filters access by the TLS version used by the client
Filters access by authentication method
Filters access by the age in milliseconds of the request signature
Filters access by the AWS Signature Version used on the request
Filters access by unsigned content in your bucket
Filters access by server-side encryption
Filters access by AWS KMS customer managed key for server-side encryption
Filters access by the tags associated with the resource
Filters access by tag key-value pairs attached to the bucket
A minimal policy that allows s3express:CreateSession. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowS3expressCreateSession",
"Effect": "Allow",
"Action": "s3express:CreateSession",
"Resource": "*"
}
]
}