Add tags to an S3 object

Part 34 of AWS from Zero. This lesson keeps the scope to one S3 behavior you can verify from the terminal.

What we are learning

Object tags are separate from object metadata. Tags can drive lifecycle rules, permissions, replication, and automation.

Before you run it

aws sts get-caller-identity
REGION="ap-south-1"
BUCKET="replace-with-your-private-demo-bucket"

Use a private general purpose bucket that you own. Replace every placeholder before running a write or delete command.

The command

echo "tag demo" > tagged.txt
aws s3 cp tagged.txt "s3://$BUCKET/tagged.txt"
aws s3api put-object-tagging \
  --bucket "$BUCKET" \
  --key tagged.txt \
  --tagging 'TagSet=[{Key=Environment,Value=demo},{Key=Owner,Value=aws-zero}]'

A successful configuration command may return no output. Treat inspection as a separate required step.

Inspect the result

aws s3api get-object-tagging \
  --bucket "$BUCKET" \
  --key tagged.txt \
  --query "TagSet[].{Key:Key,Value:Value}" \
  --output table

Read the returned fields rather than assuming the write succeeded exactly as intended.

One tiny variation

aws s3api get-object-tagging \
  --bucket "$BUCKET" \
  --key tagged.txt \
  --query "TagSet[?Key=='Environment'].Value | [0]" \
  --output text

JMESPath can select one tag value without downloading the object.

Common mistake

put-object-tagging replaces the complete tag set. Read and merge existing tags when you intend to add one without losing others.

Cleanup

aws s3api delete-object-tagging --bucket "$BUCKET" --key tagged.txt
aws s3 rm "s3://$BUCKET/tagged.txt"
rm tagged.txt

The tags and demo object are removed.

Next, we will learn Replace and remove S3 object tags.

Official AWS CLI reference