Skip to main content

Supported file operation and filter combinations that ONTAP FPolicy monitors for S3

Contributors netapp-barbe
PDFs

When you configure your FPolicy event, you need to be aware that only certain combinations of file operations and filters are supported for monitoring S3 object access operations.

Beginning with ONTAP 9.20.1, FPolicy supports notifications for S3 object events on NAS buckets. S3 FPolicy operates in asynchronous, non-mandatory mode only.

The list of supported file operations and filter combinations for FPolicy monitoring of S3 object access events is provided in the following table:

Supported file operations

Supported filters

object_create

object-create-with-put, object-create-with-copy, object-create-with-complete-mpu

object_delete

exclude-multi-delete

object_tag

object-tag-put, object-tag-delete

Filter descriptions

The following list describes each S3 FPolicy filter:

  • object-create-with-put: Monitor object create operations performed using a PUT request.

  • object-create-with-copy: Monitor object create operations performed using a COPY request.

  • object-create-with-complete-mpu: Monitor object create operations performed by completing a multipart upload.

  • exclude-multi-delete: Exclude notifications for objects deleted as part of a multi-delete request. When this filter is set, FPolicy generates notifications only for single-object delete operations.

  • object-tag-put: Monitor operations that add or modify an object tag.

  • object-tag-delete: Monitor operations that remove an object tag.

Additional considerations for S3 FPolicy events

  • Only successful, client-driven S3 operations generate FPolicy notifications. Internally generated operations (such as object expiration or snapshot restore) and failed operations do not generate notifications.

  • GET (read) operations are not supported for S3 FPolicy monitoring.

  • A multi-delete request can delete up to 1,000 objects. FPolicy generates one notification per successfully deleted object. Each notification within the same multi-delete request shares the same FPolicy request ID and S3 request ID for correlation.

  • Access denied notifications are not supported for S3 events.