Creating metadata table configurations

To create a metadata table configuration

Before you create a metadata table configuration, make sure that you've reviewed and met the prerequisites and that you've reviewed Metadata table limitations and restrictions.

1. Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.

2. In the left navigation pane, choose General purpose buckets.

3. Choose the general purpose bucket that you want to create a metadata table configuration for.

   Note

   Make sure that this general purpose bucket is an AWS Region where table buckets are available. Table buckets are available only in the US East (N. Virginia), US East (Ohio), and US West (Oregon) Regions.

4. On the bucket's details page, choose the Metadata tab.

5. On the Metadata tab, choose Create metadata configuration.

6. On the Create metadata configuration page, under Journal table, you can choose whether to encrypt your table with server-side encryption using AWS Key Management Service (AWS KMS) keys (SSE-KMS). By default, journal tables are encrypted with server-side encryption using Amazon S3 managed keys (SSE-S3).

   If you choose to use SSE-KMS, you must provide a customer managed KMS key in the same Region as your general purpose bucket.

   Important

   You can set the encryption type for your metadata tables only during table creation. After an AWS managed table is created, you can't change its encryption setting.

   • To encrypt your journal table with SSE-S3 (the default), choose Don't specify encryption type.

   • To encrypt your journal table with SSE-KMS, choose Specify encryption type. Under Encryption type, choose Server-side encryption using AWS Key Management Service (AWS KMS) keys (SSE-KMS). Under AWS KMS key, either choose from your existing KMS keys, or enter your KMS key ARN. If you don't already have a KMS key, choose Enter KMS key ARN, and then choose Create a KMS key.

     Make sure that you've set up the necessary permissions for SSE-KMS. For more information, see Permissions for SSE-KMS.

7. (Optional) By default, the records in your journal table don't expire. To help minimize the storage costs for your journal table, choose Enabled for Record expiration.

   If you enable journal table record expiration, you can set the number of days to retain your journal table records. To set the Days after which records expire value, you can specify any whole number between 7 and 2147483647. For example, to retain your journal table records for one year, set this value to 365.

   Records will be expired within 24 to 48 hours after they become eligible for expiration.

   Important

   After journal table records expire, they can't be recovered.

   Under Journal table records will expire after the specified number of days, select the checkbox.

8. (Optional) If you want to add an inventory table to your metadata table configuration, under Live inventory table, choose Enabled for Configuration status.

   You can choose whether to encrypt your table with server-side encryption using AWS Key Management Service (AWS KMS) keys (SSE-KMS). By default, inventory tables are encrypted with server-side encryption using Amazon S3 managed keys (SSE-S3).

   If you choose to use SSE-KMS, you must provide a customer managed KMS key in the same Region as your general purpose bucket.

   Important

   You can set the encryption type for your metadata tables only during table creation. After an AWS managed table is created, you can't change its encryption setting.

   • To encrypt your inventory table with SSE-S3 (the default), choose Don't specify encryption type.

   • To encrypt your inventory table with SSE-KMS, choose Specify encryption type. Under Encryption type, choose Server-side encryption using AWS Key Management Service (AWS KMS) keys (SSE-KMS). Under AWS KMS key, either choose from your existing KMS keys, or enter your KMS key ARN. If you don't already have a KMS key, choose Enter KMS key ARN, and then choose Create a KMS key.

     Make sure that you've set up the necessary permissions for SSE-KMS. For more information, see Permissions for SSE-KMS.

9. Choose Create metadata table configuration.

To create a metadata table configuration by using the AWS CLI

Before you create a metadata table configuration, make sure that you've reviewed and met the prerequisites and that you've reviewed Metadata table limitations and restrictions.

To use the following example commands, replace the user input placeholders with your own information.

1. Create a JSON file that contains your metadata table configuration, and save it (for example, metadata-config.json). The following is a sample configuration.

   You must specify whether to enable or disable journal table record expiration. If you choose to enable record expiration, you must also specify the number of days after which your journal table records will expire. To set the Days value, you can specify any whole number between 7 and 2147483647. For example, to retain your journal table records for one year, set this value to 365.

   You can optionally choose to configure an inventory table.

   For both journal tables and inventory tables, you can optionally specify an encryption configuration. By default, metadata tables are encrypted with server-side encryption using Amazon S3 managed keys (SSE-S3), which you can specify by setting SseAlgorithm to AES256.

   To encrypt your metadata tables with server-side encryption using AWS Key Management Service (AWS KMS) keys (SSE-KMS), set SseAlgorithm to aws:kms. You must also set KmsKeyArn to the ARN of a customer managed KMS key in the same Region where your general purpose bucket is located.

   {
     "JournalTableConfiguration": {
        "RecordExpiration": {          
          "Expiration": "ENABLED",
         "Days": 10
       },
       "EncryptionConfiguration": {  
         "SseAlgorithm": "AES256"
       }
     },
     "InventoryTableConfiguration": { 
       "ConfigurationState": "ENABLED",
       "EncryptionConfiguration": {   
         "SseAlgorithm": "aws:kms",
         "KmsKeyArn": "arn:aws:kms:us-east-2:account-id:key/key-id"
       }
     }
   }

2. Use the following command to apply the metadata table configuration to your general purpose bucket (for example, amzn-s3-demo-bucket):

   aws s3api create-bucket-metadata-configuration \
   --bucket amzn-s3-demo-bucket \
   --metadata-configuration file://./metadata-config.json \
   --region us-east-2

3. To verify that the configuration was created, use the following command:

   aws s3api get-bucket-metadata-configuration \
   --bucket amzn-s3-demo-bucket \
   --region us-east-2