get_object
¶
get_object(
bucket: BucketName,
key: ObjectKey,
*,
config_overrides: Optional[S3ClientConfig] = None,
if_match: Optional[IfMatch] = None,
if_modified_since: Optional[IfModifiedSince] = None,
if_none_match: Optional[IfNoneMatch] = None,
if_unmodified_since: Optional[IfUnmodifiedSince] = None,
range: Optional[Range] = None,
response_cache_control: Optional[ResponseCacheControl] = None,
response_content_disposition: Optional[ResponseContentDisposition] = None,
response_content_encoding: Optional[ResponseContentEncoding] = None,
response_content_language: Optional[ResponseContentLanguage] = None,
response_content_type: Optional[ResponseContentType] = None,
response_expires: Optional[ResponseExpires] = None,
version_id: Optional[ObjectVersionId] = None,
sse_customer_algorithm: Optional[SSECustomerAlgorithm] = None,
sse_customer_key: Optional[SSECustomerKey] = None,
sse_customer_key_md5: Optional[SSECustomerKeyMD5] = None,
request_payer: Optional[RequestPayer] = None,
part_number: Optional[PartNumber] = None,
expected_bucket_owner: Optional[AccountId] = None,
checksum_mode: Optional[ChecksumMode] = None,
) -> Generator[GetObjectOutput]
Retrieves an object from Amazon S3.
In the GetObject request, specify the full key name for the object.
General purpose buckets - Both the virtual-hosted-style requests and the path-style requests are supported. For a virtual hosted-style request example, if you have the object photos/2006/February/sample.jpg, specify the object key name as /photos/2006/February/sample.jpg. For a path-style request example, if you have the object photos/2006/February/sample.jpg in the bucket named examplebucket, specify the object key name as /examplebucket/photos/2006/February/sample.jpg. For more information about request types, see HTTP Host Header Bucket Specification in the Amazon S3 User Guide.
Directory buckets - Only virtual-hosted-style requests are supported. For a virtual hosted-style request example, if you have the object photos/2006/February/sample.jpg in the bucket named amzn-s3-demo-bucket--usw2-az1--x-s3, specify the object key name as /photos/2006/February/sample.jpg. Also, when you make requests to this API operation, your requests are sent to the Zonal endpoint. These endpoints support virtual-hosted-style requests in the format https://bucket-name.s3express-zone-id.region-code.amazonaws.com/key-name . Path-style requests are not supported. For more information about endpoints in Availability Zones, see Regional and Zonal endpoints for directory buckets in Availability Zones in the Amazon S3 User Guide. For more information about endpoints in Local Zones, see Concepts for directory buckets in Local Zones in the Amazon S3 User Guide.
- Permissions
-
-
General purpose bucket permissions - You must have the required permissions in a policy. To use
GetObject, you must have theREADaccess to the object (or version). If you grantREADaccess to the anonymous user, theGetObjectoperation returns the object without using an authorization header. For more information, see Specifying permissions in a policy in the Amazon S3 User Guide.If you include a
versionIdin your request header, you must have thes3:GetObjectVersionpermission to access a specific version of an object. Thes3:GetObjectpermission is not required in this scenario.If you request the current version of an object without a specific
versionIdin the request header, only thes3:GetObjectpermission is required. Thes3:GetObjectVersionpermission is not required in this scenario.If the object that you request doesn’t exist, the error that Amazon S3 returns depends on whether you also have the
s3:ListBucketpermission.-
If you have the
s3:ListBucketpermission on the bucket, Amazon S3 returns an HTTP status code404 Not Founderror. -
If you don’t have the
s3:ListBucketpermission, Amazon S3 returns an HTTP status code403 Access Deniederror.
-
-
Directory bucket permissions - To grant access to this API operation on a directory bucket, we recommend that you use the
CreateSessionAPI operation for session-based authorization. Specifically, you grant thes3express:CreateSessionpermission to the directory bucket in a bucket policy or an IAM identity-based policy. Then, you make theCreateSessionAPI call on the bucket to obtain a session token. With the session token in your request header, you can make API requests to this operation. After the session token expires, you make anotherCreateSessionAPI call to generate a new session token for use. Amazon Web Services CLI or SDKs create session and refresh the session token automatically to avoid service interruptions when a session expires. For more information about authorization, seeCreateSession.If the object is encrypted using SSE-KMS, you must also have the
kms:GenerateDataKeyandkms:Decryptpermissions in IAM identity-based policies and KMS key policies for the KMS key.
-
- Storage classes
-
If the object you are retrieving is stored in the S3 Glacier Flexible Retrieval storage class, the S3 Glacier Deep Archive storage class, the S3 Intelligent-Tiering Archive Access tier, or the S3 Intelligent-Tiering Deep Archive Access tier, before you can retrieve the object you must first restore a copy using RestoreObject. Otherwise, this operation returns an
InvalidObjectStateerror. For information about restoring archived objects, see Restoring Archived Objects in the Amazon S3 User Guide.Directory buckets - Directory buckets only support
EXPRESS_ONEZONE(the S3 Express One Zone storage class) in Availability Zones andONEZONE_IA(the S3 One Zone-Infrequent Access storage class) in Dedicated Local Zones. Unsupported storage class values won't write a destination object and will respond with the HTTP status code400 Bad Request. - Encryption
-
Encryption request headers, like
x-amz-server-side-encryption, should not be sent for theGetObjectrequests, if your object uses server-side encryption with Amazon S3 managed encryption keys (SSE-S3), server-side encryption with Key Management Service (KMS) keys (SSE-KMS), or dual-layer server-side encryption with Amazon Web Services KMS keys (DSSE-KMS). If you include the header in yourGetObjectrequests for the object that uses these types of keys, you’ll get an HTTP400 Bad Requesterror.Directory buckets - For directory buckets, there are only two supported options for server-side encryption: SSE-S3 and SSE-KMS. SSE-C isn't supported. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide.
- Overriding response header values through the request
-
There are times when you want to override certain response header values of a
GetObjectresponse. For example, you might override theContent-Dispositionresponse header value through yourGetObjectrequest.You can override values for a set of response headers. These modified response header values are included only in a successful response, that is, when the HTTP status code
200 OKis returned. The headers you can override using the following query parameters in the request are a subset of the headers that Amazon S3 accepts when you create an object.The response headers that you can override for the
GetObjectresponse areCache-Control,Content-Disposition,Content-Encoding,Content-Language,Content-Type, andExpires.To override values for a set of response headers in the
GetObjectresponse, you can use the following query parameters in the request.-
response-cache-control -
response-content-disposition -
response-content-encoding -
response-content-language -
response-content-type -
response-expires
When you use these parameters, you must sign the request by using either an Authorization header or a presigned URL. These parameters cannot be used with an unsigned (anonymous) request.
-
- HTTP Host header syntax
-
Directory buckets - The HTTP Host header syntax is
Bucket-name.s3express-zone-id.region-code.amazonaws.com.
The following operations are related to GetObject:
You must URL encode any signed header values that contain spaces. For example, if your header value is my file.txt, containing two spaces after my, you must URL encode this value to my%20%20file.txt.
Parameters:
-
bucket(BucketName) –The bucket name containing the object.
Directory buckets - When you use this operation with a directory bucket, you must use virtual-hosted-style requests in the format
Bucket-name.s3express-zone-id.region-code.amazonaws.com. Path-style requests are not supported. Directory bucket names must be unique in the chosen Zone (Availability Zone or Local Zone). Bucket names must follow the formatbucket-base-name--zone-id--x-s3(for example,amzn-s3-demo-bucket--usw2-az1--x-s3). For information about bucket naming restrictions, see Directory bucket naming rules in the Amazon S3 User Guide.Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
Object Lambda access points - When you use this action with an Object Lambda access point, you must direct requests to the Object Lambda access point hostname. The Object Lambda access point hostname takes the form AccessPointName-AccountId.s3-object-lambda.Region.amazonaws.com.
Object Lambda access points are not supported by directory buckets.
S3 on Outposts - When you use this action with S3 on Outposts, you must direct requests to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form
AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When you use this action with S3 on Outposts, the destination bucket must be the Outposts access point ARN or the access point alias. For more information about S3 on Outposts, see What is S3 on Outposts? in the Amazon S3 User Guide. -
if_match(Optional[IfMatch], default:None) –Return the object only if its entity tag (ETag) is the same as the one specified in this header; otherwise, return a
412 Precondition Failederror.If both of the
If-MatchandIf-Unmodified-Sinceheaders are present in the request as follows:If-Matchcondition evaluates totrue, and;If-Unmodified-Sincecondition evaluates tofalse; then, S3 returns200 OKand the data requested.For more information about conditional requests, see RFC 7232.
-
if_modified_since(Optional[IfModifiedSince], default:None) –Return the object only if it has been modified since the specified time; otherwise, return a
304 Not Modifiederror.If both of the
If-None-MatchandIf-Modified-Sinceheaders are present in the request as follows:If-None-Matchcondition evaluates tofalse, and;If-Modified-Sincecondition evaluates totrue; then, S3 returns304 Not Modifiedstatus code.For more information about conditional requests, see RFC 7232.
-
if_none_match(Optional[IfNoneMatch], default:None) –Return the object only if its entity tag (ETag) is different from the one specified in this header; otherwise, return a
304 Not Modifiederror.If both of the
If-None-MatchandIf-Modified-Sinceheaders are present in the request as follows:If-None-Matchcondition evaluates tofalse, and;If-Modified-Sincecondition evaluates totrue; then, S3 returns304 Not ModifiedHTTP status code.For more information about conditional requests, see RFC 7232.
-
if_unmodified_since(Optional[IfUnmodifiedSince], default:None) –Return the object only if it has not been modified since the specified time; otherwise, return a
412 Precondition Failederror.If both of the
If-MatchandIf-Unmodified-Sinceheaders are present in the request as follows:If-Matchcondition evaluates totrue, and;If-Unmodified-Sincecondition evaluates tofalse; then, S3 returns200 OKand the data requested.For more information about conditional requests, see RFC 7232.
-
key(ObjectKey) –Key of the object to get.
-
range(Optional[Range], default:None) –Downloads the specified byte range of an object. For more information about the HTTP Range header, see https://www.rfc-editor.org/rfc/rfc9110.html#name-range.
Amazon S3 doesn't support retrieving multiple ranges of data per
GETrequest. -
response_cache_control(Optional[ResponseCacheControl], default:None) –Sets the
Cache-Controlheader of the response. -
response_content_disposition(Optional[ResponseContentDisposition], default:None) –Sets the
Content-Dispositionheader of the response. -
response_content_encoding(Optional[ResponseContentEncoding], default:None) –Sets the
Content-Encodingheader of the response. -
response_content_language(Optional[ResponseContentLanguage], default:None) –Sets the
Content-Languageheader of the response. -
response_content_type(Optional[ResponseContentType], default:None) –Sets the
Content-Typeheader of the response. -
response_expires(Optional[ResponseExpires], default:None) –Sets the
Expiresheader of the response. -
version_id(Optional[ObjectVersionId], default:None) –Version ID used to reference a specific version of the object.
By default, the
GetObjectoperation returns the current version of an object. To return a different version, use theversionIdsubresource.-
If you include a
versionIdin your request header, you must have thes3:GetObjectVersionpermission to access a specific version of an object. Thes3:GetObjectpermission is not required in this scenario. -
If you request the current version of an object without a specific
versionIdin the request header, only thes3:GetObjectpermission is required. Thes3:GetObjectVersionpermission is not required in this scenario. -
Directory buckets - S3 Versioning isn't enabled and supported for directory buckets. For this API operation, only the
nullvalue of the version ID is supported by directory buckets. You can only specifynullto theversionIdquery parameter in the request.
For more information about versioning, see PutBucketVersioning.
-
-
sse_customer_algorithm(Optional[SSECustomerAlgorithm], default:None) –Specifies the algorithm to use when decrypting the object (for example,
AES256).If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you GET the object, you must use the following headers:
-
x-amz-server-side-encryption-customer-algorithm -
x-amz-server-side-encryption-customer-key -
x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 User Guide.
This functionality is not supported for directory buckets.
-
-
sse_customer_key(Optional[SSECustomerKey], default:None) –Specifies the customer-provided encryption key that you originally provided for Amazon S3 to encrypt the data before storing it. This value is used to decrypt the object when recovering it and must match the one used when storing the data. The key must be appropriate for use with the algorithm specified in the
x-amz-server-side-encryption-customer-algorithmheader.If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you GET the object, you must use the following headers:
-
x-amz-server-side-encryption-customer-algorithm -
x-amz-server-side-encryption-customer-key -
x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 User Guide.
This functionality is not supported for directory buckets.
-
-
sse_customer_key_md5(Optional[SSECustomerKeyMD5], default:None) –Specifies the 128-bit MD5 digest of the customer-provided encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you GET the object, you must use the following headers:
-
x-amz-server-side-encryption-customer-algorithm -
x-amz-server-side-encryption-customer-key -
x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 User Guide.
This functionality is not supported for directory buckets.
-
-
part_number(Optional[PartNumber], default:None) –Part number of the object being read. This is a positive integer between 1 and 10,000. Effectively performs a 'ranged' GET request for the part specified. Useful for downloading just a part of an object.
-
expected_bucket_owner(Optional[AccountId], default:None) –The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code
403 Forbidden(access denied). -
checksum_mode(Optional[ChecksumMode], default:None) –To retrieve the checksum, this mode must be enabled.
Raises:
-
InvalidObjectState–Object is archived and inaccessible until restored.
If the object you are retrieving is stored in the S3 Glacier Flexible Retrieval storage class, the S3 Glacier Deep Archive storage class, the S3 Intelligent-Tiering Archive Access tier, or the S3 Intelligent-Tiering Deep Archive Access tier, before you can retrieve the object you must first restore a copy using RestoreObject. Otherwise, this operation returns an
InvalidObjectStateerror. For information about restoring archived objects, see Restoring Archived Objects in the Amazon S3 User Guide. -
NoSuchKey–The specified key does not exist.
-
UnknownServiceError–The service returned an error code this client does not model.
Examples:
To retrieve a byte range of an object The following example retrieves an object for an S3 bucket. The request specifies the range header to retrieve a specific byte range.
>>> client.get_object(bucket='examplebucket', key='SampleFile.txt', range='bytes=0-9')
To retrieve an object
The following example retrieves an object for an S3 bucket.
Source code in docs_src/capo_s3/_services/s3.py
4038 4039 4040 4041 4042 4043 4044 4045 4046 4047 4048 4049 4050 4051 4052 4053 4054 4055 4056 4057 4058 4059 4060 4061 4062 4063 4064 4065 4066 4067 4068 4069 4070 4071 4072 4073 4074 4075 4076 4077 4078 4079 4080 4081 4082 4083 4084 4085 4086 4087 4088 4089 4090 4091 4092 4093 4094 4095 4096 4097 4098 4099 4100 4101 4102 4103 4104 4105 4106 4107 4108 4109 4110 4111 4112 4113 4114 4115 4116 4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140 4141 4142 4143 4144 4145 4146 4147 4148 4149 4150 4151 4152 4153 4154 4155 4156 4157 4158 4159 4160 4161 4162 4163 4164 4165 4166 4167 4168 4169 4170 4171 4172 4173 4174 4175 4176 4177 4178 4179 4180 4181 4182 4183 4184 4185 4186 4187 4188 4189 4190 4191 4192 4193 4194 4195 4196 4197 4198 4199 4200 4201 4202 4203 4204 4205 4206 4207 4208 | |