{
  "version":"2.0",
  "metadata":{
    "apiVersion":"2018-08-20",
    "endpointPrefix":"s3-control",
    "protocol":"rest-xml",
    "serviceFullName":"AWS S3 Control",
    "serviceId":"S3 Control",
    "signatureVersion":"s3v4",
    "signingName":"s3",
    "uid":"s3control-2018-08-20"
  },
  "operations":{
    "DeletePublicAccessBlock":{
      "name":"DeletePublicAccessBlock",
      "http":{
        "method":"DELETE",
        "requestUri":"/v20180820/configuration/publicAccessBlock"
      },
      "input":{"shape":"DeletePublicAccessBlockRequest"},
      "documentation":"<p>Removes the Public Access Block configuration for an Amazon Web Services account.</p>"
    },
    "GetPublicAccessBlock":{
      "name":"GetPublicAccessBlock",
      "http":{
        "method":"GET",
        "requestUri":"/v20180820/configuration/publicAccessBlock"
      },
      "input":{"shape":"GetPublicAccessBlockRequest"},
      "output":{"shape":"GetPublicAccessBlockOutput"},
      "errors":[
        {"shape":"NoSuchPublicAccessBlockConfiguration"}
      ],
      "documentation":"<p>Retrieves the Public Access Block configuration for an Amazon Web Services account.</p>"
    },
    "PutPublicAccessBlock":{
      "name":"PutPublicAccessBlock",
      "http":{
        "method":"PUT",
        "requestUri":"/v20180820/configuration/publicAccessBlock"
      },
      "input":{"shape":"PutPublicAccessBlockRequest"},
      "documentation":"<p>Creates or modifies the Public Access Block configuration for an Amazon Web Services account.</p>"
    }
  },
  "shapes":{
    "AccountId":{"type":"string"},
    "DeletePublicAccessBlockRequest":{
      "type":"structure",
      "required":["AccountId"],
      "members":{
        "AccountId":{
          "shape":"AccountId",
          "documentation":"<p>The Account ID for the Amazon Web Services account whose Public Access Block configuration you want to remove.</p>",
          "location":"header",
          "locationName":"x-amz-account-id"
        }
      }
    },
    "GetPublicAccessBlockOutput":{
      "type":"structure",
      "members":{
        "PublicAccessBlockConfiguration":{
          "shape":"PublicAccessBlockConfiguration",
          "documentation":"<p>The Public Access Block configuration currently in effect for this Amazon Web Services account.</p>"
        }
      },
      "payload":"PublicAccessBlockConfiguration"
    },
    "GetPublicAccessBlockRequest":{
      "type":"structure",
      "required":["AccountId"],
      "members":{
        "AccountId":{
          "shape":"AccountId",
          "documentation":"<p>The Account ID for the Amazon Web Services account whose Public Access Block configuration you want to retrieve.</p>",
          "location":"header",
          "locationName":"x-amz-account-id"
        }
      }
    },
    "NoSuchPublicAccessBlockConfiguration":{
      "type":"structure",
      "members":{
        "Message":{"shape":"NoSuchPublicAccessBlockConfigurationMessage"}
      },
      "documentation":"<p>This exception is thrown if a <code>GetPublicAccessBlock</code> request is made against an account that does not have a PublicAccessBlockConfiguration set.</p>",
      "error":{"httpStatusCode":404},
      "exception":true
    },
    "NoSuchPublicAccessBlockConfigurationMessage":{"type":"string"},
    "PublicAccessBlockConfiguration":{
      "type":"structure",
      "members":{
        "BlockPublicAcls":{
          "shape":"Setting",
          "documentation":"<p>Specifies whether Amazon S3 should block public ACLs for buckets in this account. Setting this element to <code>TRUE</code> causes the following behavior:</p> <ul> <li> <p>PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access.</p> </li> <li> <p>PUT Object calls will fail if the request includes an object ACL.</p> </li> </ul> <p>Note that enabling this setting doesn't affect existing policies or ACLs.</p>",
          "locationName":"BlockPublicAcls"
        },
        "IgnorePublicAcls":{
          "shape":"Setting",
          "documentation":"<p>Specifies whether Amazon S3 should ignore public ACLs for buckets in this account. Setting this element to <code>TRUE</code> causes Amazon S3 to ignore all public ACLs on buckets in this account and any objects that they contain. </p> <p>Note that enabling this setting doesn't affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set.</p>",
          "locationName":"IgnorePublicAcls"
        },
        "BlockPublicPolicy":{
          "shape":"Setting",
          "documentation":"<p>Specifies whether Amazon S3 should block public bucket policies for buckets in this account. Setting this element to <code>TRUE</code> causes Amazon S3 to reject calls to PUT Bucket policy if the specified bucket policy allows public access. </p> <p>Note that enabling this setting doesn't affect existing bucket policies.</p>",
          "locationName":"BlockPublicPolicy"
        },
        "RestrictPublicBuckets":{
          "shape":"Setting",
          "documentation":"<p>Specifies whether Amazon S3 should restrict public bucket policies for buckets in this account. If this element is set to <code>TRUE</code>, then only the bucket owner and AWS Services can access buckets with public policies.</p> <p>Note that enabling this setting doesn't affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked. </p>",
          "locationName":"RestrictPublicBuckets"
        }
      },
      "documentation":"<p>The container element for all Public Access Block configuration options. You can enable the configuration options in any combination.</p> <p>Amazon S3 considers a bucket policy public unless at least one of the following conditions is true:</p> <ol> <li> <p>The policy limits access to a set of CIDRs using <code>aws:SourceIp</code>. For more information on CIDR, see <a href=\"http://www.rfc-editor.org/rfc/rfc4632.txt\">http://www.rfc-editor.org/rfc/rfc4632.txt</a> </p> </li> <li> <p>The policy grants permissions, not including any \"bad actions,\" to one of the following:</p> <ul> <li> <p>A fixed AWS principal, user, role, or service principal</p> </li> <li> <p>A fixed <code>aws:SourceArn</code> </p> </li> <li> <p>A fixed <code>aws:SourceVpc</code> </p> </li> <li> <p>A fixed <code>aws:SourceVpce</code> </p> </li> <li> <p>A fixed <code>aws:SourceOwner</code> </p> </li> <li> <p>A fixed <code>aws:SourceAccount</code> </p> </li> <li> <p>A fixed value of <code>s3:x-amz-server-side-encryption-aws-kms-key-id</code> </p> </li> <li> <p>A fixed value of <code>aws:userid</code> outside the pattern \"<code>AROLEID:*</code>\"</p> </li> </ul> </li> </ol> <p>\"Bad actions\" are those that could expose the data inside a bucket to reads or writes by the public. These actions are <code>s3:Get*</code>, <code>s3:List*</code>, <code>s3:AbortMultipartUpload</code>, <code>s3:Delete*</code>, <code>s3:Put*</code>, and <code>s3:RestoreObject</code>.</p> <p>The star notation for bad actions indicates that all matching operations are considered bad actions. For example, because <code>s3:Get*</code> is a bad action, <code>s3:GetObject</code>, <code>s3:GetObjectVersion</code>, and <code>s3:GetObjectAcl</code> are all bad actions.</p>"
    },
    "PutPublicAccessBlockRequest":{
      "type":"structure",
      "required":[
        "PublicAccessBlockConfiguration",
        "AccountId"
      ],
      "members":{
        "PublicAccessBlockConfiguration":{
          "shape":"PublicAccessBlockConfiguration",
          "documentation":"<p>The Public Access Block configuration that you want to apply to this Amazon Web Services account.</p>",
          "locationName":"PublicAccessBlockConfiguration",
          "xmlNamespace":{"uri":"http://awss3control.amazonaws.com/doc/2018-08-20/"}
        },
        "AccountId":{
          "shape":"AccountId",
          "documentation":"<p>The Account ID for the Amazon Web Services account whose Public Access Block configuration you want to set.</p>",
          "location":"header",
          "locationName":"x-amz-account-id"
        }
      },
      "payload":"PublicAccessBlockConfiguration"
    },
    "Setting":{"type":"boolean"}
  },
  "documentation":"<p> AWS S3 Control provides access to Amazon S3 control plane operations. </p>"
}