[ aws . glacier ]

initiate-vault-lock

Description

This operation initiates the vault locking process by doing the following:

• Installing a vault lock policy on the specified vault.

• Setting the lock state of vault lock to InProgress .

• Returning a lock ID, which is used to complete the vault locking process.

You can set one vault lock policy for each vault and this policy can be up to 20 KB in size. For more information about vault lock policies, see Amazon Glacier Access Control with Vault Lock Policies .

You must complete the vault locking process within 24 hours after the vault lock enters the InProgress state. After the 24 hour window ends, the lock ID expires, the vault automatically exits the InProgress state, and the vault lock policy is removed from the vault. You call CompleteVaultLock to complete the vault locking process by setting the state of the vault lock to Locked .

After a vault lock is in the Locked state, you cannot initiate a new vault lock for the vault.

You can abort the vault locking process by calling AbortVaultLock . You can get the state of the vault lock by calling GetVaultLock . For more information about the vault locking process, Amazon Glacier Vault Lock .

If this operation is called when the vault lock is in the InProgress state, the operation returns an AccessDeniedException error. When the vault lock is in the InProgress state you must call AbortVaultLock before you can initiate a new vault lock policy.

See also: AWS API Documentation

See ‘aws help’ for descriptions of global parameters.

Synopsis

  initiate-vault-lock
--account-id <value>
--vault-name <value>
[--policy <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options

--account-id (string)

The AccountId value is the AWS account ID. This value must match the AWS account ID associated with the credentials used to sign the request. You can either specify an AWS account ID or optionally a single ‘- ‘ (hyphen), in which case Amazon Glacier uses the AWS account ID associated with the credentials used to sign the request. If you specify your account ID, do not include any hyphens (‘-‘) in the ID.

--vault-name (string)

The name of the vault.

--policy (structure)

The vault lock policy as a JSON string, which uses “” as an escape character.

Policy -> (string)

The vault lock policy.

Shorthand Syntax:

Policy=string

JSON Syntax:

{
  "Policy": "string"
}

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

See ‘aws help’ for descriptions of global parameters.

Examples

Note

To use the following examples, you must have the AWS CLI installed and configured. See the Getting started guide in the AWS CLI User Guide for more information.

Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal’s quoting rules. See Using quotation marks with strings in the AWS CLI User Guide .

To initiate the vault locking process

The following initiate-vault-lock example installs a vault lock policy on the specified vault and sets the lock state of the vault lock to InProgress. You must complete the process by calling complete-vault-lock within 24 hours to set the state of the vault lock to Locked.

aws glacier initiate-vault-lock \
    --account-id - \
    --vault-name MyVaultName \
    --policy file://vault_lock_policy.json

Contents of vault_lock_policy.json:

{"Policy":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Define-vault-lock\",\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"arn:aws:iam::999999999999:root\"},\"Action\":\"glacier:DeleteArchive\",\"Resource\":\"arn:aws:glacier:us-west-2:999999999999:vaults/examplevault\",\"Condition\":{\"NumericLessThanEquals\":{\"glacier:ArchiveAgeinDays\":\"365\"}}}]}"}

The output is the vault lock ID that you can use to complete the vault lock process.

{
    "lockId": "9QZgEXAMPLEPhvL6xEXAMPLE"
}

For more information, see Initiate Vault Lock (POST lock-policy) in the Amazon Glacier API Developer Guide.

Output

lockId -> (string)

The lock ID, which is used to complete the vault locking process.