Verify stored S3 checksums without downloading

Part 43 of AWS from Zero. This lesson keeps the scope to one S3 behavior you can verify from the terminal.

What we are learning

head-object can return stored checksum values without transferring the object body when checksum mode is enabled.

Before you run it

aws sts get-caller-identity
REGION="ap-south-1"
BUCKET="replace-with-your-private-demo-bucket"

Use a private general purpose bucket that you own. Replace every placeholder before running a write or delete command.

The command

aws s3api head-object \
  --bucket "$BUCKET" \
  --key checksum.txt \
  --checksum-mode ENABLED

A successful configuration command may return no output. Treat inspection as a separate required step.

Inspect the result

aws s3api head-object \
  --bucket "$BUCKET" \
  --key checksum.txt \
  --checksum-mode ENABLED \
  --query "{CRC32:ChecksumCRC32,CRC32C:ChecksumCRC32C,SHA1:ChecksumSHA1,SHA256:ChecksumSHA256}"

Read the returned fields rather than assuming the write succeeded exactly as intended.

One tiny variation

aws s3api head-object \
  --bucket "$BUCKET" \
  --key checksum.txt \
  --query "{ETag:ETag,Checksum:ChecksumSHA256}"

Without checksum mode, checksum fields may be absent even when the object has a stored checksum.

Common mistake

For KMS-encrypted objects, retrieving checksum information can require additional KMS permissions. A missing field does not automatically mean corruption.

Cleanup

# This lesson does not require an additional persistent resource.
aws s3api head-bucket --bucket "$BUCKET"

Keep the shared demo bucket for the next lesson, or remove only the configuration and objects created here.

Next, we will learn Start an S3 multipart upload.

Official AWS CLI reference