The S3 surface

Which S3 operations are implemented and how, and the rule for every other one: refused with NotImplemented, never routed somewhere it happens to fit.

Requests are dispatched by operation name. An operation the server does not implement is answered NotImplemented; an unknown or misplaced parameter is refused before any operation runs. Each of the 116 operations of the AWS S3 model is signed, sent and answered in the server's tests.

Buckets

operation	notes
`CreateBucket` · `HeadBucket` · `DeleteBucket` · `ListBuckets`	a bucket holding only versions is not empty
`GetBucketLocation`	the server's region
`GetBucketVersioning` · `PutBucketVersioning`	never versioned → Enabled ↔ Suspended, never back; MFA delete refused
`GetBucketLifecycleConfiguration` · `PutBucketLifecycleConfiguration` · `DeleteBucketLifecycle`	see Events, lifecycle and media
`GetBucketNotificationConfiguration` · `PutBucketNotificationConfiguration`	queue configurations only
`GetBucketReplication` · `PutBucketReplication` · `DeleteBucketReplication`	the `Filter` form, both buckets versioned; see Clusters
`GetObjectLockConfiguration` · `PutObjectLockConfiguration`	a bucket created with `x-amz-bucket-object-lock-enabled`, or a versioned one; kept for good, with an optional default retention
`GetBucketTagging` · `PutBucketTagging` · `DeleteBucketTagging`	at most 50 tags; none is `NoSuchTagSet`
`GetBucketEncryption` · `PutBucketEncryption` · `DeleteBucketEncryption`	`AES256` or `aws:kms` under a key this node holds; see Encryption
`GetBucketPolicy` · `PutBucketPolicy` · `DeleteBucketPolicy` · `GetBucketPolicyStatus`	evaluated on every request; see Policies, groups and temporary credentials
`GetPublicAccessBlock` · `PutPublicAccessBlock` · `DeletePublicAccessBlock`	every switch on for a bucket that set none
`GetBucketCors` · `PutBucketCors` · `DeleteBucketCors`	up to 100 rules; preflights answered without credentials

Objects

operation	notes
`PutObject`	up to 5 GiB; payload hash and declared checksums verified before the write is acknowledged; SSE-S3, SSE-KMS and SSE-C
POST object	a browser form to `POST /{bucket}` under a signed policy
`GetObject` · `HeadObject`	ranges, `partNumber`, `versionId`, `x-amz-version-id` answered
`CopyObject`	up to 5 GiB, COPY or REPLACE metadata, copy-source conditions, checksum recomputed and checked
`DeleteObject` · `DeleteObjects`	with `versionId`, removes that version for good
`ListObjectsV2` · `ListObjects`	byte order, delimiter roll-up, authenticated continuation tokens, `encoding-type=url`
`ListObjectVersions`	keys in byte order, each key newest first with `IsLatest`, key and version-id markers
`GetObjectTagging` · `PutObjectTagging` · `DeleteObjectTagging`	a version by `versionId` or the current one; at most 10 tags, `aws:` keys refused; `x-amz-tagging` on `PutObject`, `CopyObject` and `CreateMultipartUpload`, `x-amz-tagging-count` on reads
`GetObjectRetention` · `PutObjectRetention` · `GetObjectLegalHold` · `PutObjectLegalHold`	COMPLIANCE is never shortened; GOVERNANCE yields to who administers the bucket with `x-amz-bypass-governance-retention: true`; a kept version cannot be deleted or rewritten by any path, lifecycle included

Multipart

operation	notes
`CreateMultipartUpload` · `UploadPart` · `UploadPartCopy`	`UploadPartCopy` from a range or all of a source
`ListParts` · `ListMultipartUploads`	key and upload-id markers, delimiter roll-up
`CompleteMultipartUpload`	multipart ETag, full-object or composite checksum; reads across parts with `Range` and `partNumber`
`AbortMultipartUpload`	an upload open longer than `TESSARIDB_S3_UPLOAD_MAX_AGE_SECS` (a week) is aborted by the reaper

Versioning in practice

An enabled bucket keeps every version and a delete adds a marker; a suspended one replaces only the null version. GetObject with a versionId naming no version answers NoSuchVersion; a delete marker named by id answers 405, and a current one 404 with x-amz-delete-marker. Removing a delete marker by id brings the object back. Objects from an earlier build become null versions at start.

What is not here yet

ACLs, event holds, website configuration, lifecycle transitions and dual-layer KMS encryption are among the operations answered NotImplemented today. A client that needs one of them gets that refusal, not a quiet success.