# Using tags with S3 tables Tagging tables An AWS tag is a key-value pair that holds metadata about resources, in this case Amazon S3 tables. You can tag S3 tables when you create them or manage tags on existing tables. For general information about tags, see [Tagging for cost allocation or attribute-based access control (ABAC)](tagging.md). **Note** There is no additional charge for using tags on tables beyond the standard S3 API request rates. For more information, see [Amazon S3 pricing](https://aws.amazon.com/s3/pricing/). ## Common ways to use tags with tables Use tags on your S3 tables for: 1. **Cost allocation** – Track storage costs by table tag in AWS Billing and Cost Management. For more information, see [Using tags for cost allocation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/tagging.html#using-tags-for-cost-allocation). 1. **Attribute-based access control (ABAC)** – Scale access permissions and grant access to S3 tables based on their tags. For more information, see [Using tags for ABAC](https://docs.aws.amazon.com/AmazonS3/latest/userguide/tagging.html#using-tags-for-abac). **Note** You can use the same tags for both cost allocation and access control. ### ABAC for S3 tables Amazon S3 tables support attribute-based access control (ABAC) using tags. Use tag-based condition keys in your AWS organizations, AWS Identity and Access Management (IAM), and S3 table policies. ABAC in Amazon S3 supports authorization across multiple AWS accounts. In your IAM policies, you can control access to S3 tables based on the table's tags by using the `s3tables:TableBucketTag/tag-key` condition key or the [AWS global condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys): `aws:ResourceTag/key-name`, `aws:RequestTag/key-name`, or `aws:TagKeys`. #### aws:ResourceTag/key-name Use this condition key to compare the tag key-value pair that you specify in the policy with the key-value pair attached to the resource. For example, you could require that access to a table is allowed only if the table has the tag key `Department` with the value `Marketing`. This condition key applies to table actions performed using the Amazon S3 Console, the AWS Command Line Interface (CLI), S3 APIs, or the AWS SDKs,. For an example policy, see [1.1 - table policy to restrict operations on the table using tags](#example-policy-table-resource-tag). For additional example policies and more information, see [Controlling access to AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-resources) in the *AWS Identity and Access Management User Guide*. **Note** For actions performed on tables, this condition key acts on the tags applied to the table and not on the tags applied to the table bucket containing the table. Use the `s3tables:TableBucketTag/tag-key` instead if you would like your ABAC policies to act on the tags of the table bucket when performaing table actions. #### aws:RequestTag/key-name Use this condition key to compare the tag key-value pair that was passed in the request with the tag pair that you specify in the policy. For example, you could check whether the request to tag a table includes the tag key `Department` and that it has the value `Accounting`. This condition key applies when tag keys are passed in a `TagResource` or `CreateTable` API operation request, or when tagging or creating a table with tags using the Amazon S3 Console, the AWS Command Line Interface (CLI), or the AWS SDKs. For an example policy, see [1.2 - IAM policy to create or modify tables with specific tags](#example-policy-table-request-tag). For additional example policies and more information, see [Controlling access during AWS requests](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-requests) in the *AWS Identity and Access Management User Guide*. #### aws:TagKeys Use this condition key to compare the tag keys in a request with the keys that you specify in the policy to define what tag keys are allowed for access. For example, to allow tagging during the `CreateTable` action, you must create a policy that allows both the `s3tables:TagResource` and `s3tables:CreateTable` actions. You can then use the `aws:TagKeys` condition key to enforce that only specific tags are used in the `CreateTable` request. This condition key applies when tag keys are passed in a `TagResource`, `UntagResource`, or `CreateTable` API operations or when tagging, untagging, or creating a table with tags using the AWS Command Line Interface (CLI), or the AWS SDKs. For an example policy, see [1.3 - IAM policy to control the modification of tags on existing resources maintaining tagging governance](#example-policy-table-tag-keys). For additional example policies and more information, see [Controlling access based on tag keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-tag-keys) in the *AWS Identity and Access Management User Guide*. #### s3tables:TableBucketTag/tag-key Use this condition key to grant permissions to specific data in table buckets using tags. This condition key acts, on the most part, on the tags assigned to the table bucket for all S3 tables actions. Even when you create a table with tags, this condition key acts on the tags applied to the table bucket that contains that table. The exceptions are: + When you create a table bucket with tags, this condition key acts on the tags in the request. For an example policy, see [1.4 - Using the s3tables:TableBucketTag condition key](#example-policy-table-bucket-tag-tables). #### Example ABAC policies for tables See the following example ABAC policies for Amazon S3 tables. **Note** If you have an IAM or S3 Tables resource-based policy that restricts IAM users and IAM roles based on principal tags, you must attach the same principal tags to the IAM role that Lake Formation uses to access your Amazon S3 data (for example, LakeFormationDataAccessRole) and grant this role the necessary permissions. This is required for your tag-based access control policy to work correctly with your S3 Tables analytics integration. ##### 1.1 - table policy to restrict operations on the table using tags In this table policy, the specified IAM principals (users and roles) can perform the `GetTable` action only if the value of the table's `project` tag matches the value of the principal's `project` tag. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowGetTable", "Effect": "Allow", "Principal": { "AWS": "111122223333" }, "Action": "s3tables:GetTable", "Resource": "arn:aws::s3tables:us-west-2:111122223333:bucket/amzn-s3-demo-table-bucket/my_example_tab;e", "Condition": { "StringEquals": { "aws:ResourceTag/project": "${aws:PrincipalTag/project}" } } } ] } ``` ##### 1.2 - IAM policy to create or modify tables with specific tags In this IAM policy, users or roles with this policy can only create S3 tables if they tag the table with the tag key `project` and tag value `Trinity` in the table creation request. They can also add or modify tags on existing S3 tables as long as the `TagResource` request includes the tag key-value pair `project:Trinity`. This policy does not grant read, write, or delete permissions on the tables or its objects. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTableWithTags", "Effect": "Allow", "Action": [ "s3tables:CreateTable", "s3tables:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/project": [ "Trinity" ] } } } ] } ``` ##### 1.3 - IAM policy to control the modification of tags on existing resources maintaining tagging governance In this IAM policy, IAM principals (users or roles) can modify tags on a table only if the value of the table's `project` tag matches the value of the principal's `project` tag. Only the four tags `project`, `environment`, `owner`, and `cost-center` specified in the `aws:TagKeys` condition keys are permitted for these tables. This helps enforce tag governance, prevents unauthorized tag modifications, and keeps the tagging schema consistent across your tables. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "EnforceTaggingRulesOnModification", "Effect": "Allow", "Action": [ "s3tables:TagResource", "s3tables:UntagResource" ], "Resource": "arn:aws::s3tables:us-west-2:111122223333:bucket/amzn-s3-demo-table-bucket/my_example_table", "Condition": { "StringEquals": { "aws:ResourceTag/project": "${aws:PrincipalTag/project}" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "project", "environment", "owner", "cost-center" ] } } } ] } ``` ##### 1.4 - Using the s3tables:TableBucketTag condition key In this IAM policy, the condition statement allows access to the table bucket's data only if the table bucket has the tag key `Environment` and tag value `Production`. The `s3tables:TableBucketTag/` differs from the `aws:ResourceTag/` condition key because, in addition to controlling access to table buckets depending on their tags, it allows you to control access to tables based on the tags on their parent table bucket. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAccessToSpecificTables", "Effect": "Allow", "Action": "*", "Resource": "arn:aws::s3tables:us-west-2:111122223333:bucket/amzn-s3-demo-table-bucket/*", "Condition": { "StringEquals": { "s3tables:TableBucketTag/Environment": "Production" } } } ] } ``` ## Managing tags for tables You can add or manage tags for S3 tables using the Amazon S3 Console, the AWS Command Line Interface (CLI), the AWS SDKs, or using the S3 APIs: [TagResource](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_TagResource.html), [UntagResource](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_UntagResource.html), and [ListTagsForResource](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListTagsForResource.html). For more information, see: **Topics** + [ ## Common ways to use tags with tables ](#common-ways-to-use-tags-table) + [ ## Managing tags for tables ](#table-working-with-tags) + [ # Creating tables with tags ](table-create-tag.md) + [ # Adding a tag to a table ](table-tag-add.md) + [ # Viewing table tags ](table-tag-view.md) + [ # Deleting a tag from a table ](table-tag-delete.md) # Creating tables with tags You can tag Amazon S3 tables when you create them. There is no additional charge for using tags on tables beyond the standard S3 API request rates. For more information, see [Amazon S3 pricing](https://aws.amazon.com/s3/pricing/). For more information about tagging tables, see [Using tags with S3 tables](table-tagging.md). ## Permissions To create a table with tags, you must have the following permissions: + `s3tables:CreateTable` + `s3tables:TagResource` ## Troubleshooting errors If you encounter an error when attempting to create a table with tags, you can do the following: + Verify that you have the required [Permissions](#table-create-tag-permissions) to create the table and apply a tag to it. + Check your IAM user policy for any attribute-based access control (ABAC) conditions. Your policy may require you to tag your tables with only specific tag keys and values. For more information about ABAC and example table ABAC policies, see [ABAC for S3 tables](https://docs.aws.amazon.com/AmazonS3/latest/userguide/table-tagging.html#abac-for-tables). ## Steps You can create a table with tags applied by using the AWS Command Line Interface (AWS CLI), the Amazon S3 Tables REST API, and the AWS SDKs. ## Using the REST API For information about the Amazon S3 Tables REST API support for creating a table with tags, see the following section in the *Amazon Simple Storage Service API Reference*: + [CreateTable](https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3Buckets_CreateTable.html) ## Using the AWS CLI To install the AWS CLI, see [Installing the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) in the *AWS Command Line Interface User Guide*. The following CLI example shows you how to create a table with tags by using the AWS CLI. To use the command replace the *user input placeholders* with your own information. When you create a table you must provide configuration details. For more information, see [Creating an Amazon S3 table](s3-tables-create.md). You must also name the table with a name that follows the table naming convention. For more information see [Amazon S3 table bucket, table, and namespace naming rules](s3-tables-buckets-naming.md). **Request:** ``` aws --region us-west-2 \ s3tables create-table \ --endpoint https://ufwae60e2k.execute-api.us-west-2.amazonaws.com/personal/ \ --table-bucket-arn arn:aws:s3tables:us-west-2:111122223333:bucket/amzn-s3-demo-table-bucket --tags '{"Department":"Engineering"}' \ --name my_table_abc \ --namespace my_namesapce_123a \ --format ICEBERG ``` # Adding a tag to a table You can add tags to Amazon S3 tables and modify these tags. For more information about tagging tables, see [Using tags with S3 tables](table-tagging.md). ## Permissions To add a tag to a table, you must have the following permission: + `s3tables:TagResource` ## Troubleshooting errors If you encounter an error when attempting to add a tag to a table, you can do the following: + Verify that you have the required [Permissions](#table-tag-add-permissions) to add a tag to a table. + If you attempted to add a tag key that starts with the AWS reserved prefix `aws:`, change the tag key and try again. + The tag key is required. Also, make sure that the tag key and the tag value do not exceed the maximum character length and do not contain restricted characters. For more information, see [Tagging for cost allocation or attribute-based access control (ABAC)](tagging.md). ## Steps You can add tags to tables by using the Amazon S3 console, the AWS Command Line Interface (AWS CLI), the Amazon S3 Tables REST API, and AWS SDKs. ## Using the S3 console To add tags to a table using the Amazon S3 console: 1. Sign in to Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/). 1. In the left navigation pane, choose **Table buckets**. 1. Choose the table bucket name. 1. Choose the table name. 1. Choose the **Properties** tab. 1. Scroll to the **Tags** section and choose **Add new Tag**. 1. This opens the **Add Tags** page. You can enter up to 50 tag key value pairs. 1. If you add a new tag with the same key name as an existing tag, the value of the new tag overrides the value of the existing tag. 1. You can also edit the values of existing tags on this page. 1. After you have added the tag(s), choose **Save changes**. ## Using the REST API For information about the Amazon S3 REST API support for adding tags to a table, see the following section in the *Amazon Simple Storage Service API Reference*: + [TagResource](https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3Buckets_TagResource.html) ## Using the AWS CLI To install the AWS CLI, see [Installing the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) in the *AWS Command Line Interface User Guide*. The following CLI example shows you how to add tags to a table by using the AWS CLI. To use the command replace the *user input placeholders* with your own information. **Request:** ``` aws --region us-west-2 \ s3tables tag-resource \ --resource-arn arn:aws::s3tables:us-west-2:111122223333:bucket/amzn-s3-demo-table-bucket/table/my_example_table \ --tags '{"Department":"engineering"}' ``` # Viewing table tags You can view or list tags applied to Amazon S3 tables. For more information about tags, see [Using tags with S3 tables](table-tagging.md). ## Permissions To view tags applied to a table, you must have the following permission: + `s3tables:ListTagsForResource` ## Troubleshooting errors If you encounter an error when attempting to list or view the tags of a table, you can do the following: + Verify that you have the required [Permissions](#table-tag-view-permissions) to view or list the tags of the table. ## Steps You can view tags applied to tables by using the Amazon S3 console, the AWS Command Line Interface (AWS CLI), the Amazon S3 REST API, and AWS SDKs. ## Using the S3 console To view tags applied to a table using the Amazon S3 console: 1. Sign in to Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/). 1. In the left navigation pane, choose **Table buckets**. 1. Choose the Table bucket name. 1. Choose the table name within the Table bucket. 1. Choose the **Properties** tab. 1. Scroll to the **Tags** section to view all of the tags applied to the table. 1. The **Tags** section shows the **User-defined tags** by default. You can select the **AWS-generated tags** tab to view tags applied to your table by AWS services. ## Using the REST API For information about the Amazon S3 REST API support for viewing the tags applied to a table, see the following section in the *Amazon Simple Storage Service API Reference*: + [ListTagsforResource](https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3Buckets_ListTagsForResource.html) ## Using the AWS CLI To install the AWS CLI, see [Installing the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) in the *AWS Command Line Interface User Guide*. The following CLI example shows you how to view tags applied to a table. To use the command replace the *user input placeholders* with your own information. **Request:** ``` aws --region us-west-2 \ s3tables list-tags-for-resource \ --resource-arn arn:aws::s3tables:us-west-2:111122223333:bucket/amzn-s3-demo-table-bucket/table/my_example_table ``` # Deleting a tag from a table You can remove tags from Amazon S3 tables. For more information about tagging tables, see [Using tags with S3 tables](table-tagging.md). **Note** If you delete a tag and later learn that it was being used to track costs or for access control, you can add the tag back to the table. ## Permissions To delete a tag from a table, you must have the following permission: + `s3tables:UntagResource` ## Troubleshooting errors If you encounter an error when attempting to delete a tag from a table, you can do the following: + Verify that you have the required [Permissions](#table-tag-delete-permissions) to delete a tag from a table. ## Steps You can delete tags from tables by using the Amazon S3 console, the AWS Command Line Interface (AWS CLI), the Amazon S3 Tables REST API, and AWS SDKs. ## Using the S3 console To delete tags from a table using the Amazon S3 console: 1. Sign in to Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/). 1. In the left navigation pane, choose **Table buckets**. 1. Choose the table bucket name. 1. Choose the table name. 1. Choose the **Properties** tab. 1. Scroll to the **Tags** section and select the checkbox next to the tag or tags that you would like to delete. 1. Choose **Delete**. 1. The **Delete user-defined tags** pop-up appears and asks you to confirm the deletion of the tag or tags you selected. 1. Choose **Delete** to confirm. ## Using the REST API For information about the Amazon S3 REST API support for deleting tags from a table, see the following section in the *Amazon Simple Storage Service API Reference*: + [UnTagResource](https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3Buckets_UntagResource.html) ## Using the AWS CLI To install the AWS CLI, see [Installing the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) in the *AWS Command Line Interface User Guide*. The following CLI example shows you how to delete tags from a table by using the AWS CLI. To use the command replace the *user input placeholders* with your own information. **Request:** ``` aws --region us-west-2 \ s3tables untag-resource \ --resource-arn arn:aws::s3tables:us-west-2:111122223333:bucket/amzn-s3-demo-table-bucket/table/my_example_table \ --tag-keys '["department"]' ```