aws s3api get-object: Low-Level S3 Downloads

aws s3api get-object retrieves one object with the low-level API, exposing options like byte ranges and version IDs that the high-level s3 cp hides.

When you need a specific version of an object, a byte range, or the raw response metadata, s3api get-object gives the direct S3 GetObject call. It writes the body to a file you name as the final positional argument.

What it does

aws s3api get-object calls the S3 GetObject API for one object, writing the body to the output file argument and printing response metadata (ETag, ContentLength, VersionId) as JSON. It supports --range for partial reads and --version-id for versioned buckets.

Common usage

Terminal

aws s3api get-object --bucket my-bucket --key config.json config.json
# fetch a specific version
aws s3api get-object --bucket my-bucket --key config.json \
  --version-id "3sL4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY" config.json
# first 1024 bytes only
aws s3api get-object --bucket my-bucket --key big.bin --range bytes=0-1023 head.bin

Options

Flag	What it does
--bucket <name>	Source bucket
--key <key>	Object key
--version-id <id>	Fetch a specific object version
--range bytes=<a>-<b>	Download only a byte range
--if-match <etag>	Fail unless the ETag matches
<outfile>	Final positional argument: where to write the body

In CI

Use s3api get-object when a step needs a pinned object version for reproducibility, or a byte range to sniff a file header without downloading gigabytes. For plain bulk downloads, the high-level aws s3 cp or s5cmd is faster because it parallelizes.

Common errors in CI

"(NoSuchKey) The specified key does not exist" means a wrong key or the object is in a different prefix. "(AccessDenied)" means the role lacks s3:GetObject (and s3:GetObjectVersion for --version-id). "(NoSuchBucket)" is a wrong bucket or region. Forgetting the output-file positional argument makes the CLI error on missing arguments.