Using awscli v2 with Swarm S3

The v2 version of awscli, the official AWS command-line tool, provides a large number of "aws s3api ..." commands exposing most S3 features. awscli is no longer installed with pip, see:

https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html

To configure just create a ~/.aws/credentials file with a Swarm S3 token and secret, which you can create in the Gateway Content Portal e.g. http://mydomain.example.com/_admin/portal.

[default]
aws_access_key_id = 538310d5a74754af308c2fbe0b2cbb1a
aws_secret_access_key = secret

Tip: add multiple profiles besides [default] that use different Swarm clusters or domains then refer to it using aws --profile devswarm …. Unfortunately the domain, which must resolve to your Gateway S3 endpoint, must always be specified on the command-line with --endpoint-url.

This will show the buckets in your domain then list a bucket:

aws s3api --endpoint-url http://mydomain.example.com:8090 list-buckets
aws s3api --endpoint-url http://mydomain.example.com:8090 list-objects --bucket mybucket

The aws s3 syntax is slight different than the aws s3api commands:

aws s3 --endpoint-url http://mydomain.example.com:8090 ls
aws s3 --endpoint-url http://mydomain.example.com:8090 ls s3://mybucket

Tip: use aws --debug to see full HTTP request and response details, including the request-id for searching cloudgateway_server.log. Long listings might require --cli-read-timeout 300. Internal error messages like this are expected and can be ignored:
botocore.exceptions.ConnectTimeoutError: Connect timeout on endpoint URL: "http://169.254.169.254/latest/meta-data/placement/availability-zone/"

The s3api subcommand provides most of the AWS S3 features. E.g. these commands create a bucket with a locking and retention configuration. Note this feature requires the upcoming Gateway 7.6 release! An object is created then locked with a “legal hold” preventing that version from being deleted. Finally the lock is removed so the version can be deleted.