[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tools](index.md) > SDK > AWS SDK for Go # AWS SDK for Go The [AWS SDK for Go](https://docs.aws.amazon.com/sdk-for-go/) is a software development kit for integration with AWS services in Go. ## Getting started {#before-you-begin} 1. [Create a service account](../../iam/operations/sa/create.md). 1. [Assign to the service account the roles](../../iam/operations/sa/assign-role-for-sa.md) required for your project, e.g., [storage.editor](../security/index.md#storage-editor) for a bucket (to work with a particular bucket) or a folder (to work with all buckets in this folder). For more information about roles, see [Access management with Yandex Identity and Access Management](../security/index.md). To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer): * `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects. * `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects. * `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter). For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles). 1. [Create a static access key](../../iam/operations/authentication/manage-access-keys.md#create-access-key). As a result, you will get the static access key data. To authenticate in Object Storage, you will need the following: * `key_id`: Static access key ID * `secret`: Secret key Save `key_id` and `secret`: you will not be able to get the key value again. To access the HTTP API directly, you need static key authentication, which is supported by the tools listed in [Supported tools](index.md). {% note info %} You can [disable using static keys for bucket access](../operations/buckets/disable-statickey-auth.md). Once disabled, access will be denied to all tools using this access option: the AWS CLI, SDK, and third-party applications. Access via [ephemeral keys](../security/ephemeral-keys.md), [temporary Security Token Service access keys](../security/sts.md), and [pre-signed URLs](../security/overview.md#pre-signed) will also be disabled. Only access with an [IAM token](../../iam/concepts/authorization/iam-token.md) or [anonymous access](../security/public-access.md) (if enabled) will remain. {% endnote %} You can use Yandex Lockbox to safely store the static key for access to Object Storage. For more information, see [Using a Yandex Lockbox secret to store a static access key](../tutorials/static-key-in-lockbox/index.md). {% note info %} A service account is only allowed to view a list of buckets in the folder it was created in. A service account can perform actions with objects in buckets that are created in folders different from the service account folder. To enable this, [assign](../../iam/operations/sa/assign-role-for-sa.md) the service account [roles](../security/index.md#service-roles) for the appropriate folder or its bucket. {% endnote %} ## Installation {#installation} To install the AWS SDK for Go, use the [instructions](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/getting-started) posted on the developer's site. ## Configuration {#setup} ### Configuring a directory for authentication data 1. Create a directory to store the authentication data in and navigate to it: For macOS and Linux: ```bash mkdir ~/.aws/ ``` For Windows: ```bash mkdir C:\Users\\.aws\ ``` 1. In the `.aws` directory, create a file named `credentials` and copy the credentials [received earlier](#before-you-begin) into it: ```text [default] aws_access_key_id = aws_secret_access_key = ``` 1. Create a file named `config` with the default region settings and copy the following information to it: ```text [default] region = ru-central1 endpoint_url = https://storage.yandexcloud.net ``` {% note info %} Some apps designed to work with Amazon S3 do not allow you to specify the region; this is why Object Storage may also accept the main AWS region value, which is the [first row in the table of regions](https://docs.aws.amazon.com/global-infrastructure/latest/regions/aws-regions.html#available-regions). {% endnote %} To access Object Storage, use the `https://storage.yandexcloud.net` endpoint. ### Using environment variables By default, the AWS SDK for Go uses authentication data from environment variables if they are set. These variables have priority over authentication data from the `.aws/credentials` file. The following environment variables are supported: * `AWS_ACCESS_KEY_ID`: Static key ID. * `AWS_SECRET_ACCESS_KEY`: Secret key. * `AWS_SESSION_TOKEN`: (Optional) Session token. For more information, see [Accessing a bucket using Security Token Service](../operations/buckets/create-sts-key.md). To set environment variables, depending on your operating system, follow these steps: {% list tabs group=operating_system %} - Linux/macOS In the terminal, run this command: ```bash export AWS_ACCESS_KEY_ID= export AWS_SECRET_ACCESS_KEY= export AWS_SESSION_TOKEN= ``` - Windows In PowerShell, run: ```powershell $Env:AWS_ACCESS_KEY_ID= $Env:AWS_SECRET_ACCESS_KEY= $Env:AWS_SESSION_TOKEN= ``` {% endlist %} ## Code examples {#go-code-examples} [AWS SDK v.1](https://github.com/aws/aws-sdk-go) for Go entered maintenance mode in July 2024. We recommend migrating to [AWS SDK v.2](https://github.com/aws/aws-sdk-go-v2). #### Getting a list of bucket names {#list-buckets} {% list tabs group=interface_relevance %} - AWS SDK v.2 {#contemporary} ```go package main import ( "context" "log" "github.com/aws/aws-sdk-go-v2/aws" "github.com/aws/aws-sdk-go-v2/config" "github.com/aws/aws-sdk-go-v2/service/s3" ) func main() { // Loading the configuration from ~/.aws/* cfg, err := config.LoadDefaultConfig(context.TODO()) if err != nil { log.Fatal(err) } // Creating a client to access the S3 storage client := s3.NewFromConfig(cfg) // Requesting a list of buckets result, err := client.ListBuckets(context.TODO(), &s3.ListBucketsInput{}) if err != nil { log.Fatal(err) } for _, bucket := range result.Buckets { log.Printf("bucket=%s creation time=%s", aws.ToString(bucket.Name), bucket.CreationDate.Local().Format("2006-01-02 15:04:05 Monday")) } } ``` - AWS SDK v.1 {#deprecated} ```go package main import ( "context" "fmt" "log" "github.com/aws/aws-sdk-go-v2/aws" "github.com/aws/aws-sdk-go-v2/config" "github.com/aws/aws-sdk-go-v2/service/s3" ) func main() { // Creating a custom endpoint resolver to return the correct URL for S3 and ru-central1 customResolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) { if service == s3.ServiceID && region == "ru-central1" { return aws.Endpoint{ PartitionID: "yc", URL: "https://storage.yandexcloud.net", SigningRegion: "ru-central1", }, nil } return aws.Endpoint{}, fmt.Errorf("unknown endpoint requested") }) // Loading the configuration from ~/.aws/* cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithEndpointResolverWithOptions(customResolver)) if err != nil { log.Fatal(err) } // Creating a client to access the S3 storage client := s3.NewFromConfig(cfg) // Requesting a list of buckets result, err := client.ListBuckets(context.TODO(), &s3.ListBucketsInput{}) if err != nil { log.Fatal(err) } for _, bucket := range result.Buckets { log.Printf("bucket=%s creation time=%s", aws.ToString(bucket.Name), bucket.CreationDate.Format("2006-01-02 15:04:05 Monday")) } } ``` {% endlist %} #### Getting a list of bucket objects {#list-buckets} To get a list of objects in a bucket, provide its name in the `-b` command line parameter. {% list tabs group=interface_relevance %} - AWS SDK v.2 {#contemporary} ```go package main import ( "context" "flag" "fmt" "log" "github.com/aws/aws-sdk-go-v2/aws" "github.com/aws/aws-sdk-go-v2/config" "github.com/aws/aws-sdk-go-v2/service/s3" ) func main() { // Getting the bucket name from the command line argument bucketName := flag.String("b", "", "The name of the bucket") flag.Parse() if *bucketName == "" { fmt.Println("You must supply the name of a bucket (-b BUCKET)") return } // Loading the configuration from ~/.aws/* cfg, err := config.LoadDefaultConfig(context.TODO()) if err != nil { log.Fatal(err) } // Creating a client to access the S3 storage client := s3.NewFromConfig(cfg) // Requesting a list of all bucket files result, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{ Bucket: aws.String(*bucketName), }) if err != nil { log.Fatal(err) } for _, object := range result.Contents { log.Printf("object=%s size=%d Bytes last modified=%s", aws.ToString(object.Key), aws.ToInt64(object.Size), object.LastModified.Local().Format("2006-01-02 15:04:05 Monday")) } } ``` - AWS SDK v.1 {#deprecated} ```go package main import ( "context" "fmt" "log" "flag" "github.com/aws/aws-sdk-go-v2/aws" "github.com/aws/aws-sdk-go-v2/config" "github.com/aws/aws-sdk-go-v2/service/s3" ) func main() { // Getting the bucket name from the command line argument bucketName := flag.String("b", "", "The name of the bucket") flag.Parse() if *bucketName == "" { fmt.Println("You must supply the name of a bucket (-b BUCKET)") return } // Creating a custom endpoint resolver to return the correct URL for S3 and ru-central1 customResolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) { if service == s3.ServiceID && region == "ru-central1" { return aws.Endpoint{ PartitionID: "yc", URL: "https://storage.yandexcloud.net", SigningRegion: "ru-central1", }, nil } return aws.Endpoint{}, fmt.Errorf("unknown endpoint requested") }) // Loading the configuration from ~/.aws/* cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithEndpointResolverWithOptions(customResolver)) if err != nil { log.Fatal(err) } // Creating a client to access the S3 storage client := s3.NewFromConfig(cfg) // Requesting a list of all bucket files result, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{ Bucket: aws.String(*bucketName), }) if err != nil { log.Fatal(err) } for _, object := range result.Contents { log.Printf("object=%s size=%d Bytes last modified=%s", aws.ToString(object.Key), object.Size, object.LastModified.Format("2006-01-02 15:04:05 Monday")) } } ``` {% endlist %} See also the [code examples](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/s3) and [Go SDK API Reference Guide](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3).