[アップデート] Amazon FSx for OpenZFSでS3アクセスポイントがサポートされ、ファイルシステム内に保存されたデータにS3 APIでアクセスできるようになりました

$ df -hT
Filesystem       Type      Size  Used Avail Use% Mounted on
devtmpfs         devtmpfs  4.0M     0  4.0M   0% /dev
tmpfs            tmpfs     453M     0  453M   0% /dev/shm
tmpfs            tmpfs     181M  408K  181M   1% /run
/dev/nvme0n1p1   xfs       8.0G  2.8G  5.3G  35% /
tmpfs            tmpfs     453M     0  453M   0% /tmp
/dev/nvme0n1p128 vfat       10M  1.3M  8.7M  13% /boot/efi

$ ls -l /mnt/
total 0
drwxr-xr-x. 2 root root  6 Oct 15 08:36 express-s3
drwxr-xr-x. 2 root root  6 Sep 22 09:02 fsxl
drwxr-xr-x. 2 root root  6 Sep 30 04:42 fsxz
drwxr-xr-x. 2 root root 22 Oct 15 08:43 s3

$ ls -ld /mnt/fsxz
drwxr-xr-x. 2 root root 6 Sep 30 04:42 /mnt/fsxz

$ sudo mount -t nfs -o noatime,nfsvers=4.2,sync,nconnect=16,rsize=1048576,wsize=1048576 fs-0cf9019876e46ac08.fsx.us-east-1.amazonaws.com:/fsx/ /mnt/fsxz

$ df -hT
Filesystem                                            Type      Size  Used Avail Use% Mounted on
devtmpfs                                              devtmpfs  4.0M     0  4.0M   0% /dev
tmpfs                                                 tmpfs     453M     0  453M   0% /dev/shm
tmpfs                                                 tmpfs     181M  420K  181M   1% /run
/dev/nvme0n1p1                                        xfs       8.0G  2.8G  5.3G  35% /
tmpfs                                                 tmpfs     453M     0  453M   0% /tmp
/dev/nvme0n1p128                                      vfat       10M  1.3M  8.7M  13% /boot/efi
tmpfs                                                 tmpfs      91M     0   91M   0% /run/user/0
fs-0cf9019876e46ac08.fsx.us-east-1.amazonaws.com:/fsx nfs4       64G     0   64G   0% /mnt/fsxz

$ mount | grep nfs
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
fs-0cf9019876e46ac08.fsx.us-east-1.amazonaws.com:/fsx on /mnt/fsxz type nfs4 (rw,noatime,sync,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,nconnect=16,timeo=600,retrans=2,sec=sys,clientaddr=10.10.0.11,local_lock=none,addr=10.10.0.4)

$ ls -l /mnt/fsxz
total 25
drwxrwxrwx. 3 root root 3 Nov 10 05:20 vol1
$ ls -l /mnt/fsxz/vol1
total 0

$ df -hT -t nfs4
Filesystem                                                 Type  Size  Used Avail Use% Mounted on
fs-0cf9019876e46ac08.fsx.us-east-1.amazonaws.com:/fsx      nfs4   64G     0   64G   0% /mnt/fsxz
fs-0cf9019876e46ac08.fsx.us-east-1.amazonaws.com:/fsx/vol1 nfs4   16G     0   16G   0% /mnt/fsxz/vol1

$ sudo mkdir -p /mnt/fsxz/tier1/tier2
$ sudo mkdir -p /mnt/fsxz/vol1/tier1/tier2

$ echo "/mnt/fsxz/tier1/text1.txt" | sudo tee /mnt/fsxz/tier1/text1.txt > /dev/null
$ echo "/mnt/fsxz/tier1/text2.txt" | sudo tee /mnt/fsxz/tier1/text2.txt > /dev/null
$ echo "/mnt/fsxz/tier1/tier2/text1.txt" | sudo tee /mnt/fsxz/tier1/tier2/text1.txt > /dev/null
$ echo "/mnt/fsxz/vol1/text1.txt" | sudo tee /mnt/fsxz/vol1/text1.txt > /dev/null
$ echo "/mnt/fsxz/vol1/text2.txt" | sudo tee /mnt/fsxz/vol1/text2.txt > /dev/null
$ echo "/mnt/fsxz/vol1/tier1/text1.txt" | sudo tee /mnt/fsxz/vol1/tier1/text1.txt > /dev/null
$ echo "/mnt/fsxz/vol1/tier1/tier2/text1.txt" | sudo tee /mnt/fsxz/vol1/tier1/tier2/text1.txt > /dev/null

$ tree /mnt/fsxz
/mnt/fsxz
├── tier1
│   ├── text1.txt
│   ├── text2.txt
│   └── tier2
│       └── text1.txt
└── vol1
    ├── text1.txt
    ├── text2.txt
    └── tier1
        ├── text1.txt
        └── tier2
            └── text1.txt

$ aws s3 ls non-97-fsxz-s3-f-xwwqkuy7iok1jwyf6j8sy9btybeoguse1b-ext-s3alias
                           PRE tier1/

$ aws s3 ls s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1
                           PRE tier1/

$ aws s3 ls arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1
                           PRE tier1/

$ aws s3 ls non-97-fsxz-s3-f-xwwqkuy7iok1jwyf6j8sy9btybeoguse1b-ext-s3alias --recursive
2025-11-10 05:44:06         26 tier1/text1.txt
2025-11-10 05:44:36         26 tier1/text2.txt
2025-11-10 05:45:04         32 tier1/tier2/text1.txt

$ aws s3 ls s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1 --recursive
2025-11-10 05:46:05         25 text1.txt
2025-11-10 05:46:16         25 text2.txt
2025-11-10 05:46:36         31 tier1/text1.txt
2025-11-10 05:47:43         37 tier1/tier2/text1.txt

$ aws s3api head-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1 \
  --key tier1/text1.txt
{
    "AcceptRanges": "bytes",
    "LastModified": "2025-11-10T05:46:36+00:00",
    "ContentLength": 31,
    "ETag": "\"229c69e65bc10692d959d91cefe9ee96-1\"",
    "ContentType": "binary/octet-stream",
    "ServerSideEncryption": "aws:fsx",
    "Metadata": {},
    "StorageClass": "FSX_OPENZFS",
    "PartsCount": 0
}

$ aws s3api list-objects-v2 --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1
{
    "Contents": [
        {
            "Key": "tier1/text1.txt",
            "LastModified": "2025-11-10T05:44:06.147000+00:00",
            "ETag": "\"48a7c02dbbb8c760e444b794d14f927d-1\"",
            "Size": 26,
            "StorageClass": "FSX_OPENZFS"
        },
        {
            "Key": "tier1/text2.txt",
            "LastModified": "2025-11-10T05:44:36.586000+00:00",
            "ETag": "\"2d350d31d8c7dbf1e5e7ac04dd8ba348-1\"",
            "Size": 26,
            "StorageClass": "FSX_OPENZFS"
        },
        {
            "Key": "tier1/tier2/text1.txt",
            "LastModified": "2025-11-10T05:45:04.486000+00:00",
            "ETag": "\"065d3e18b45b4a528001d1887b3b15bf-1\"",
            "Size": 32,
            "StorageClass": "FSX_OPENZFS"
        }
    ],
    "RequestCharged": null,
    "Prefix": ""
}

$ aws s3api list-objects-v2 --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1
{
    "Contents": [
        {
            "Key": "text1.txt",
            "LastModified": "2025-11-10T05:46:05.945000+00:00",
            "ETag": "\"d00560f61be2d5c7b18e36cf8a28b346-1\"",
            "Size": 25,
            "StorageClass": "FSX_OPENZFS"
        },
        {
            "Key": "text2.txt",
            "LastModified": "2025-11-10T05:46:16.955000+00:00",
            "ETag": "\"712007676fbd015d6d297293e0b8de16-1\"",
            "Size": 25,
            "StorageClass": "FSX_OPENZFS"
        },
        {
            "Key": "tier1/text1.txt",
            "LastModified": "2025-11-10T05:46:36.085000+00:00",
            "ETag": "\"229c69e65bc10692d959d91cefe9ee96-1\"",
            "Size": 31,
            "StorageClass": "FSX_OPENZFS"
        },
        {
            "Key": "tier1/tier2/text1.txt",
            "LastModified": "2025-11-10T05:47:43.694000+00:00",
            "ETag": "\"b96b3a3da95e008e1c4c39996320b58f-1\"",
            "Size": 37,
            "StorageClass": "FSX_OPENZFS"
        }
    ],
    "RequestCharged": null,
    "Prefix": ""
}

$ aws s3 cp s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/tier1/text1.txt -
/mnt/fsxz/tier1/text1.txt

$ aws s3 cp s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1/tier1/tier2/text1.txt -
/mnt/fsxz/vol1/tier1/tier2/text1.txt

> aws s3 cp s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/tier1/text1.txt -
/mnt/fsxz/tier1/text1.txt

> aws s3 cp s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1/tier1/tier2/text1.txt -
download failed: s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1/tier1/tier2/text1.txt to - An error occurred (403) when calling the HeadObject operation: Forbidden

> aws s3api list-objects-v2 --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1
{
    "Contents": [
        {
            "Key": "tier1/text1.txt",
            "LastModified": "2025-11-10T05:44:06.147000+00:00",
            "ETag": "\"48a7c02dbbb8c760e444b794d14f927d-1\"",
            "Size": 26,
            "StorageClass": "FSX_OPENZFS"
        },
        {
            "Key": "tier1/text2.txt",
            "LastModified": "2025-11-10T05:44:36.586000+00:00",
            "ETag": "\"2d350d31d8c7dbf1e5e7ac04dd8ba348-1\"",
            "Size": 26,
            "StorageClass": "FSX_OPENZFS"
        },
        {
            "Key": "tier1/tier2/text1.txt",
            "LastModified": "2025-11-10T05:45:04.486000+00:00",
            "ETag": "\"065d3e18b45b4a528001d1887b3b15bf-1\"",
            "Size": 32,
            "StorageClass": "FSX_OPENZFS"
        }
    ],
    "RequestCharged": null,
    "Prefix": ""
}

> aws s3api list-objects-v2 --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: User: arn:aws:sts::<AWSアカウントID>:assumed-role/<IAMロール名>/<セッション名> is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1" with an explicit deny in a resource-based policy

> aws s3api put-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1 \
  --key 5.non-97-fsxz-s3-fsx-1_1.png \
  --body images/5.non-97-fsxz-s3-fsx-1_1.png

{
    "ETag": "\"3bd4fc525042a56825bbdd0ddcddcfdf\"",
    "ChecksumCRC64NVME": "B2C1KBBWVsc=",
    "ChecksumType": "FULL_OBJECT",
    "ServerSideEncryption": "aws:fsx"
}

> echo test.txt > test.txt
> aws s3api put-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1 \
  --key test.txt \
  --body test.txt
{
    "ETag": "\"bbfa1f311a5828452b953d1335cbf027\"",
    "ChecksumCRC64NVME": "Q6hHjd9gzNc=",
    "ChecksumType": "FULL_OBJECT",
    "ServerSideEncryption": "aws:fsx"
}

> aws s3api head-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1 \
  --key 5.non-97-fsxz-s3-fsx-1_1.png
{
    "AcceptRanges": "bytes",
    "LastModified": "2025-11-10T07:18:47+00:00",
    "ContentLength": 254424,
    "ETag": "\"3bd4fc525042a56825bbdd0ddcddcfdf\"",
    "ContentType": "binary/octet-stream",
    "ServerSideEncryption": "aws:fsx",
    "Metadata": {},
    "StorageClass": "FSX_OPENZFS",
    "PartsCount": 0
}

> aws s3api head-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1 \
  --key test.txt
{
    "AcceptRanges": "bytes",
    "LastModified": "2025-11-10T07:30:25+00:00",
    "ContentLength": 9,
    "ETag": "\"bbfa1f311a5828452b953d1335cbf027\"",
    "ContentType": "binary/octet-stream",
    "ServerSideEncryption": "aws:fsx",
    "Metadata": {},
    "StorageClass": "FSX_OPENZFS",
    "PartsCount": 0
}

$ ls -l /mnt/fsxz/
total 298
-rw-r--r--. 1 ec2-user ec2-user 254424 Nov 10 07:18 5.non-97-fsxz-s3-fsx-1_1.png
-rw-r--r--. 1 ec2-user ec2-user      9 Nov 10 07:30 test.txt
drwxr-xr-x. 3 nobody   nobody        5 Nov 10 05:44 tier1
drwxrwxrwx. 4 root     root          6 Nov 10 05:46 vol1

$ ls -ln /mnt/fsxz/
total 298
-rw-r--r--. 1  1000  1000 254424 Nov 10 07:18 5.non-97-fsxz-s3-fsx-1_1.png
-rw-r--r--. 1  1000  1000      9 Nov 10 07:30 test.txt
drwxr-xr-x. 3 65534 65534      5 Nov 10 05:44 tier1
drwxrwxrwx. 4     0     0      6 Nov 10 05:46 vol1

$ cat /mnt/fsxz/test.txt
test.txt

$ ls -l test.txt
-rw-rw-r--. 1 ec2-user ec2-user 88905 Oct 15 06:28 test.txt

$ head test.txt
test1
test2
test3
test4
test5
test6
test7
test8
test9
test10

$ aws s3api put-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-vol1-1 \
  --key test.txt \
  --body test.txt
{
    "ETag": "\"6dcf56682273030af2ba93015d5090fd\"",
    "ChecksumCRC64NVME": "5saWoFcRI4E=",
    "ChecksumType": "FULL_OBJECT",
    "ServerSideEncryption": "aws:fsx"
}

$ ls -l /mnt/fsxz/vol1
total 54
-rw-r--r--. 1 root   root   88905 Nov 10 09:14 test.txt
-rw-r--r--. 1 nobody nobody    25 Nov 10 05:46 text1.txt
-rw-r--r--. 1 nobody nobody    25 Nov 10 05:46 text2.txt
drwxr-xr-x. 3 nobody nobody     4 Nov 10 05:47 tier1

$ ls -ln /mnt/fsxz/vol1
total 54
-rw-r--r--. 1     0     0 88905 Nov 10 09:14 test.txt
-rw-r--r--. 1 65534 65534    25 Nov 10 05:46 text1.txt
-rw-r--r--. 1 65534 65534    25 Nov 10 05:46 text2.txt
drwxr-xr-x. 3 65534 65534     4 Nov 10 05:47 tier1

> aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket aurora-postgresql-log  \
  --key test.txt

An error occurred (NotImplemented) when calling the CopyObject operation: An access point you provided implies functionality that is not implemented

> aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key test_copy.txt
{
    "ServerSideEncryption": "aws:fsx",
    "CopyObjectResult": {
        "ETag": "\"e8ecf27f2bf8177075f0e3231e371782-1\"",
        "LastModified": "2025-11-10T07:57:47.143000+00:00",
        "ChecksumType": "FULL_OBJECT"
    }
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::<AWSアカウントID>:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/tier1/tier2/*"
        }
    ]
}

$ aws s3api head-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1 \
  --key tier1/text1.txt
{
    "AcceptRanges": "bytes",
    "LastModified": "2025-11-10T05:44:06+00:00",
    "ContentLength": 26,
    "ETag": "\"48a7c02dbbb8c760e444b794d14f927d-1\"",
    "ContentType": "binary/octet-stream",
    "ServerSideEncryption": "aws:fsx",
    "Metadata": {},
    "StorageClass": "FSX_OPENZFS",
    "PartsCount": 0
}

$ aws s3api head-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1 \
  --key tier1/tier2/text1.txt

An error occurred (403) when calling the HeadObject operation: Forbidden

$ aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key tier1/tier2/test_copy.txt

An error occurred (AccessDenied) when calling the CopyObject operation: User: arn:aws:sts::<AWSアカウントID>:assumed-role/AmazonSSMRoleForInstancesQuickSetup/i-0e3b2df10bad6f2ac is not authorized to perform: s3:PutObject on resource: "arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/tier1/tier2/test_copy.txt" with an explicit deny in a resource-based policy

$ aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key tier1/test_copy.txt

An error occurred (AccessDenied) when calling the CopyObject operation: Access Denied

$ aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key test/test_copy.txt

$ ls -l /mnt/fsxz
total 315
-rw-r--r--. 1 ec2-user ec2-user 254424 Nov 10 07:18 5.non-97-fsxz-s3-fsx-1_1.png
drwxrwxrwx. 2 ec2-user ec2-user      3 Nov 10 08:19 test
-rw-r--r--. 1 ec2-user ec2-user      9 Nov 10 07:30 test.txt
-rw-r--r--. 1 ec2-user ec2-user      9 Nov 10 08:15 test_copy.txt
drwxr-xr-x. 3 nobody   nobody        5 Nov 10 05:44 tier1
drwxrwxrwx. 4 root     root          6 Nov 10 05:46 vol1

$ ls -l /mnt/fsxz/test
total 9
-rw-r--r--. 1 ec2-user ec2-user 9 Nov 10 08:19 test_copy.txt

$ sudo mkdir -p /mnt/fsxz/test2

$ ls -ld /mnt/fsxz/test2
drwxr-xr-x. 2 nobody nobody 2 Nov 10 08:21 /mnt/fsxz/test2

$ ls -ld /mnt/fsxz/
drwxrwxrwx. 7 root root 10 Nov 10 08:21 /mnt/fsxz/

$ aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key test2/test_copy.txt

An error occurred (AccessDenied) when calling the CopyObject operation: Access Denied

$ sudo chmod 777 /mnt/fsxz/test2
$ ls -ld /mnt/fsxz/test2
drwxrwxrwx. 2 nobody nobody 2 Nov 10 08:21 /mnt/fsxz/test2

$ aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key test2/test_copy.txt
{
    "ServerSideEncryption": "aws:fsx",
    "CopyObjectResult": {
        "ETag": "\"5cd9f761885518d61394c57bca32a916-1\"",
        "LastModified": "2025-11-10T08:30:43.540000+00:00",
        "ChecksumType": "FULL_OBJECT"
    }
}

$ aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key テスト1/test_copy.txt
{
    "ServerSideEncryption": "aws:fsx",
    "CopyObjectResult": {
        "ETag": "\"027e305d44e8962718d21086fe978473-1\"",
        "LastModified": "2025-11-10T08:31:53.679000+00:00",
        "ChecksumType": "FULL_OBJECT"
    }
}

$ ls -l /mnt/fsxz
total 316
-rw-r--r--. 1 ec2-user ec2-user 254424 Nov 10 07:18 5.non-97-fsxz-s3-fsx-1_1.png
drwxrwxrwx. 2 ec2-user ec2-user      3 Nov 10 08:19 test
-rw-r--r--. 1 ec2-user ec2-user      9 Nov 10 07:30 test.txt
drwxrwxrwx. 2 nobody   nobody        3 Nov 10 08:30 test2
-rw-r--r--. 1 ec2-user ec2-user      9 Nov 10 08:15 test_copy.txt
drwxr-xr-x. 3 nobody   nobody        5 Nov 10 05:44 tier1
drwxrwxrwx. 4 root     root          6 Nov 10 05:46 vol1
drwxrwxrwx. 2 ec2-user ec2-user      3 Nov 10 08:31 テスト1

$ ls -l /mnt/fsxz/テスト1
total 9
-rw-r--r--. 1 ec2-user ec2-user 9 Nov 10 08:31 test_copy.txt

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::<AWSアカウントID>:root"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/tier1/tier2/*",
                "arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/テスト1/*"
            ]
        }
    ]
}

$ aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key テスト1/test_copy2.txt

An error occurred (AccessDenied) when calling the CopyObject operation: User: arn:aws:sts::<AWSアカウントID>:assumed-role/AmazonSSMRoleForInstancesQuickSetup/i-0e3b2df10bad6f2ac is not authorized to perform: s3:PutObject on resource: "arn:aws:s3:us-east-1:984900217833:accesspoint/non-97-fsxz-s3-fsx-1/object/テスト1/test_copy2.txt" with an explicit deny in a resource-based policy

$ aws s3api copy-object \
  --copy-source arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/object/test.txt \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1  \
  --key テスト2/test_copy.txt
{
    "ServerSideEncryption": "aws:fsx",
    "CopyObjectResult": {
        "ETag": "\"e3afeaba70ff69abe239b4d956df25c9-1\"",
        "LastModified": "2025-11-10T08:33:51.658000+00:00",
        "ChecksumType": "FULL_OBJECT"
    }
}

$ aws s3api head-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1 \
  --key テスト1/text_copy.txt

An error occurred (403) when calling the HeadObject operation: Forbidden

$ aws s3api head-object \
  --bucket arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1 \
  --key テスト2/test_copy.txt
{
    "AcceptRanges": "bytes",
    "LastModified": "2025-11-10T08:33:51+00:00",
    "ContentLength": 9,
    "ETag": "\"e3afeaba70ff69abe239b4d956df25c9-1\"",
    "ContentType": "binary/octet-stream",
    "ServerSideEncryption": "aws:fsx",
    "Metadata": {},
    "StorageClass": "FSX_OPENZFS",
    "PartsCount": 0
}

$ sudo dd if=/dev/urandom of=/mnt/fsxz/1MB_random_pattern_block_6GiB bs=1M count=6144 iflag=fullblock
6144+0 records in
6144+0 records out
6442450944 bytes (6.4 GB, 6.0 GiB) copied, 51.8133 s, 124 MB/s

$ ls -l /mnt/fsxz/1MB_random_pattern_block_6GiB
-rw-r--r--. 1 nobody nobody 6442450944 Nov 10 08:46 /mnt/fsxz/1MB_random_pattern_block_6GiB

$ aws s3 cp /mnt/fsxz/1MB_random_pattern_block_6GiB s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/1MB_random_pattern_block_6GiB_copy
Completed 506.0 MiB/6.0 GiB (83.2 MiB/s) with 1 file(s) remaining

$ aws s3 cp /mnt/fsxz/1MB_random_pattern_block_6GiB s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/1MB_random_pattern_block_6GiB_copy
Completed 6.0 GiB/6.0 GiB (71.1 MiB/s) with 1 file(s) remaining

$ aws s3 cp /mnt/fsxz/1MB_random_pattern_block_6GiB s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/1MB_random_pattern_block_6GiB_copy
upload failed: ../../mnt/fsxz/1MB_random_pattern_block_6GiB to s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/1MB_random_pattern_block_6GiB_copy An error occurred (EntityTooLarge) when calling the CompleteMultipartUpload operation (reached max retries: 2): Your proposed upload exceeds the maximum allowed size

$ aws s3 cp s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/1MB_random_pattern_block_6GiB /mnt/fsxz/1MB_random_pattern_block_6GiB_copy
Completed 1.1 GiB/6.0 GiB (104.5 MiB/s) with 1 file(s) remaining

$ aws s3 cp s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/1MB_random_pattern_block_6GiB /mnt/fsxz/1MB_random_pattern_block_6GiB_copy
download: s3://arn:aws:s3:us-east-1:<AWSアカウントID>:accesspoint/non-97-fsxz-s3-fsx-1/1MB_random_pattern_block_6GiB to ../../mnt/fsxz/1MB_random_pattern_block_6GiB_copy

$ ls -l /mnt/fsxz
total 12574014
-rw-r--r--. 1 nobody   nobody   6442450944 Nov 10 08:46 1MB_random_pattern_block_6GiB
-rw-rw-r--. 1 ec2-user ec2-user 6442450944 Nov 10 08:46 1MB_random_pattern_block_6GiB_copy
-rw-r--r--. 1 ec2-user ec2-user     254424 Nov 10 07:18 5.non-97-fsxz-s3-fsx-1_1.png
drwxrwxrwx. 2 ec2-user ec2-user          3 Nov 10 08:19 test
-rw-r--r--. 1 ec2-user ec2-user          9 Nov 10 07:30 test.txt
drwxrwxrwx. 2 nobody   nobody            3 Nov 10 08:30 test2
-rw-r--r--. 1 ec2-user ec2-user          9 Nov 10 08:15 test_copy.txt
drwxr-xr-x. 3 nobody   nobody            5 Nov 10 05:44 tier1
drwxrwxrwx. 4 root     root              6 Nov 10 05:46 vol1
drwxrwxrwx. 2 ec2-user ec2-user          3 Nov 10 08:31 テスト1
drwxrwxrwx. 2 ec2-user ec2-user          3 Nov 10 08:33 テスト2

$ date
Mon Nov 10 08:57:26 UTC 2025