S3 501 Discipline: Object-Level Subresources (tagging, acl, versionId, retention, legal-hold)
5 object-level query parameters now return honest 501 NotImplemented instead of silently falling into GetObject/PutObject/DeleteObject.
S3
S3 501 Discipline: Honest 'Not Implemented' for 16 Bucket Config Subresources
16 bucket config subresources (versioning, ACL, policy, CORS, lifecycle, etc.) now return honest 501 NotImplemented instead of silently misrouting to ListObjects/GetObject.
S3 Integrity Checksums: x-amz-checksum-*
x-amz-checksum-CRC32/SHA256 echo on PUT; integrity surfaced to clients so dirty bytes never masquerade as clean. Teaches: client-verifiable integrity, Bolt zero-allocation on read path, Sentinel honesty guarantee.
⚡ Bolt: 1000 → 16 Allocations in S3 ListObjectsV2 XML
S3 ListObjectsV2 XML serialization dropped from ~1000 allocations to 16 per op via inlined time formatting and a pre-allocated escape buffer.
S3 Multipart and Protocol Breadth: 501 Discipline
Multipart upload support plus a rigorous 501 strategy for unsupported S3 subresources — honest breadths over silent misbehavior.
S3 and Inbound TLS: HTTPS-by-Default Enforcement
The S3 gateway turned HTTPS-or-explicit-insecure into the default: no silent plaintext for the gateway or inbound tcp/quic.
S3 Auth: SigV4, Presigned URLs, and Key Decoupling
Query-string SigV4 for presigned URLs, mandatory X-Amz-Date freshness, and decoupling gateway access/secret keys from the native auth token.
S3 Gateway Core: XML, Buckets, Objects, Lists
The S3 gateway: SigV4, S3-compliant XML errors, Head/List/Copy, pagination, ranges, and metadata — a compatible API surface for real clients.
Signed Payloads and Server-Sent Events for S3
SigV4 signed payload verification for S3 PUT/POST and Server-Sent Events for async operation notifications.
AWS Chunked Streaming: Signed Payloads Without Buffering
aws-chunked payload encoding streams large S3 uploads in signed chunks — no full-body buffering, per-chunk SigV4 integrity.