Given the bucket policy:
{
"Sid": "Stmt1731447043438",
"Effect": "Deny",
"Principal": "",
"Action": [
"s3:PutObject",
"s3:PutObjectRetention"
],
"Resource": "arn:aws:s3:::bkt9/",
"Condition": {
"StringNotEqualsIfExists": {
"s3:object-lock-mode": "GOVERNANCE"
}
}
}
create-multipart-upload takes the header: --object-lock-mode
As expected, requests can be allowed/denied based on the mode specified
add-part does not take the header: --object-lock-mode
So all add-part requests can succeed; requests are not evaluated for object-lock-mode
complete-multipart-upload does not take the header: --object-lock-mode
Without the header, it can be denied
Q: Shouldn't complete-multipart-upload requests be accepted in the same way as add-part?
