Bucket L2 construct
An S3 bucket with associated policy objects.
This bucket does not yet have all features that exposed by the underlying BucketResource.
Example
import { RemovalPolicy } from 'aws-cdk-lib';
new s3.Bucket(scope, 'Bucket', {
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
encryption: s3.BucketEncryption.S3_MANAGED,
enforceSSL: true,
versioned: true,
removalPolicy: RemovalPolicy.RETAIN,
});
from aws_cdk import RemovalPolicy
s3.Bucket(scope, "Bucket",
block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
encryption=s3.BucketEncryption.S3_MANAGED,
enforce_ssl=True,
versioned=True,
removal_policy=RemovalPolicy.RETAIN
)
import software.amazon.awscdk.RemovalPolicy;
Bucket.Builder.create(scope, "Bucket")
.blockPublicAccess(BlockPublicAccess.BLOCK_ALL)
.encryption(BucketEncryption.S3_MANAGED)
.enforceSSL(true)
.versioned(true)
.removalPolicy(RemovalPolicy.RETAIN)
.build();
// Install: dotnet add package Amazon.CDK.Lib
using Amazon.CDK;
new Bucket(scope, "Bucket", new BucketProps {
BlockPublicAccess = BlockPublicAccess.BLOCK_ALL,
Encryption = BucketEncryption.S3_MANAGED,
EnforceSSL = true,
Versioned = true,
RemovalPolicy = RemovalPolicy.RETAIN
});
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
import "github.com/aws/aws-cdk-go/awscdk"
s3.NewBucket(*scope, jsii.String("Bucket"), &BucketProps{
BlockPublicAccess: s3.BlockPublicAccess_BLOCK_ALL(),
Encryption: s3.BucketEncryption_S3_MANAGED,
EnforceSSL: jsii.Boolean(true),
Versioned: jsii.Boolean(true),
RemovalPolicy: awscdk.RemovalPolicy_RETAIN,
})
Initializer
new Bucket(scope: Construct, id: string, props?: BucketProps)
Bucket(scope: Construct, id: str, props: typing.Optional[BucketProps] = None)
new Bucket(Construct scope, String id, BucketProps props)
new Bucket(Construct scope, string id, BucketProps? props = null)
NewBucket(Scope Construct, Id *string, Props BucketProps)
Construct Props
abacStatusbooleanabac_statusboolabacStatusBooleanAbacStatusboolAbacStatus*bool= The ABAC status is not set#Set to true to enable ABAC, false to explicitly disable it.
accessControlBucketAccessControlaccess_controlBucketAccessControlaccessControlBucketAccessControlAccessControlBucketAccessControlAccessControlBucketAccessControl= BucketAccessControl.PRIVATE#autoDeleteObjectsbooleanauto_delete_objectsboolautoDeleteObjectsBooleanAutoDeleteObjectsboolAutoDeleteObjects*bool= false#notes
Requires the removalPolicy to be set to RemovalPolicy.DESTROY.
Warning if you have deployed a bucket with autoDeleteObjects: true, switching this to false in a CDK version before 1.126.0 will lead to all objects in the bucket being deleted. Be sure to update your bucket resources by deploying with CDK version 1.126.0 or later before switching this value to false.
Setting autoDeleteObjects to true on a bucket will add s3:PutBucketPolicy to the bucket policy. This is because during bucket deletion, the custom resource provider needs to update the bucket policy by adding a deny policy for s3:PutObject to prevent race conditions with external bucket writers.
blockedEncryptionTypesBlockedEncryptionType[]blocked_encryption_typestyping.List[BlockedEncryptionType]blockedEncryptionTypesList<BlockedEncryptionType>BlockedEncryptionTypesBlockedEncryptionType[]BlockedEncryptionTypes*[]BlockedEncryptionType= Amazon S3 determines which encry…#At least one BlockedEncryptionType must be given. If NONE is given, it must be the only BlockedEncryptionType in the list.
default
Default: Amazon S3 determines which encryption types to block.
blockPublicAccessBlockPublicAccessblock_public_accessBlockPublicAccessblockPublicAccessBlockPublicAccessBlockPublicAccessBlockPublicAccessBlockPublicAccessBlockPublicAccess= CloudFormation defaults will app…#default
Default: CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
bucketKeyEnabledbooleanbucket_key_enabledboolbucketKeyEnabledBooleanBucketKeyEnabledboolBucketKeyEnabled*bool= false#notes
Only relevant when using KMS for encryption.
- If not enabled, every object GET and PUT will cause an API call to KMS (with the attendant cost implications of that).
- If enabled, S3 will use its own time-limited key instead.
Only relevant, when Encryption is not set to BucketEncryption.UNENCRYPTED.
bucketNamestringbucket_namestrbucketNameStringBucketNamestringBucketName*string= Assigned by CloudFormation (reco…#Cannot be used together with bucketNamePrefix or bucketNamespace.
default
Default: Assigned by CloudFormation (recommended).
bucketNamePrefixstringbucket_name_prefixstrbucketNamePrefixStringBucketNamePrefixstringBucketNamePrefix*string= No prefix.#notes
Requires bucketNamespace to be set to ACCOUNT_REGIONAL. Cannot be used together with bucketName.
CloudFormation appends -<accountId>-<region>-an to form the full name. For example, my-app becomes my-app-123456789012-us-east-1-an.
Must contain only lowercase letters, numbers, and hyphens. Must start and end with a lowercase letter or number.
bucketNamespaceBucketNamespacebucket_namespaceBucketNamespacebucketNamespaceBucketNamespaceBucketNamespaceBucketNamespaceBucketNamespaceBucketNamespace= Global namespace.#notes
AWS recommends ACCOUNT_REGIONAL for improved security, as bucket names are scoped to your account and cannot be claimed by other accounts. When set to ACCOUNT_REGIONAL, bucketNamePrefix is required. When set to GLOBAL, it can be used standalone to explicitly specify the default namespace.
corsCorsRule[]corstyping.List[CorsRule]corsList<CorsRule>CorsCorsRule[]Cors*[]CorsRule= No CORS configuration.#encryptionBucketEncryptionencryptionBucketEncryptionencryptionBucketEncryptionEncryptionBucketEncryptionEncryptionBucketEncryption= `KMS` if `encryptionKey` is spec…#If you choose KMS, you can specify a KMS key via encryptionKey. If encryption key is not specified, a key will automatically be created.
default
Default: KMS if encryptionKey is specified, or S3_MANAGED otherwise.
encryptionKeyIKeyencryption_keyIKeyencryptionKeyIKeyEncryptionKeyIKeyEncryptionKeyIKey= If `encryption` is set to `KMS` …#The encryption property must be either not specified or set to KMS or DSSE. An error will be emitted if encryption is set to UNENCRYPTED or S3_MANAGED.
default
Default: If encryption is set to KMS and this property is undefined, a new KMS key will be created and associated with this bucket.
S3.5 of the AWS Foundational Security Best Practices Regarding S3.
eventBridgeEnabledbooleanevent_bridge_enabledbooleventBridgeEnabledBooleanEventBridgeEnabledboolEventBridgeEnabled*bool= false#intelligentTieringConfigurationsIntelligentTieringConfiguration[]intelligent_tiering_configurationstyping.List[IntelligentTieringConfiguration]intelligentTieringConfigurationsList<IntelligentTieringConfiguration>IntelligentTieringConfigurationsIntelligentTieringConfiguration[]IntelligentTieringConfigurations*[]IntelligentTieringConfiguration= No Intelligent Tiering Configura…#default
Default: No Intelligent Tiering Configurations.
inventoriesInventory[]inventoriestyping.List[Inventory]inventoriesList<Inventory>InventoriesInventory[]Inventories*[]Inventory= No inventory configuration#lifecycleRulesLifecycleRule[]lifecycle_rulestyping.List[LifecycleRule]lifecycleRulesList<LifecycleRule>LifecycleRulesLifecycleRule[]LifecycleRules*[]LifecycleRule= No lifecycle rules.#metricsBucketMetrics[]metricstyping.List[BucketMetrics]metricsList<BucketMetrics>MetricsBucketMetrics[]Metrics*[]BucketMetrics= No metrics configuration.#minimumTLSVersionnumberminimum_tls_versionint | floatminimumTLSVersionNumberMinimumTLSVersiondoubleMinimumTLSVersion*float64= No minimum TLS version is enforc…#Requires enforceSSL to be enabled.
default
Default: No minimum TLS version is enforced.
notificationsHandlerRoleIRolenotifications_handler_roleIRolenotificationsHandlerRoleIRoleNotificationsHandlerRoleIRoleNotificationsHandlerRoleIRole= a new role will be created.#notificationsSkipDestinationValidationbooleannotifications_skip_destination_validationboolnotificationsSkipDestinationValidationBooleanNotificationsSkipDestinationValidationboolNotificationsSkipDestinationValidation*bool= false#objectLockDefaultRetentionObjectLockRetentionobject_lock_default_retentionObjectLockRetentionobjectLockDefaultRetentionObjectLockRetentionObjectLockDefaultRetentionObjectLockRetentionObjectLockDefaultRetentionObjectLockRetention= no default retention period#Default retention can be configured after a bucket is created if the bucket already has object lock enabled. Enabling object lock for existing buckets is not supported.
objectLockEnabledbooleanobject_lock_enabledboolobjectLockEnabledBooleanObjectLockEnabledboolObjectLockEnabled*bool= false, unless objectLockDefaultR…#Enabling object lock for existing buckets is not supported. Object lock must be enabled when the bucket is created.
default
Default: false, unless objectLockDefaultRetention is set (then, true)
objectOwnershipObjectOwnershipobject_ownershipObjectOwnershipobjectOwnershipObjectOwnershipObjectOwnershipObjectOwnershipObjectOwnershipObjectOwnership= No ObjectOwnership configuration…#default
Default: No ObjectOwnership configuration. By default, Amazon S3 sets Object Ownership to Bucket owner enforced. This means ACLs are disabled and the bucket owner will own every object.
publicReadAccessbooleanpublic_read_accessboolpublicReadAccessBooleanPublicReadAccessboolPublicReadAccess*bool= false#Similar to calling bucket.grantPublicAccess()
removalPolicyRemovalPolicyremoval_policyRemovalPolicyremovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicy= The bucket will be orphaned.#replicationRoleIRolereplication_roleIRolereplicationRoleIRoleReplicationRoleIRoleReplicationRoleIRole= a new role will be created.#When setting this property, you must also set replicationRules.
replicationRulesReplicationRule[]replication_rulestyping.List[ReplicationRule]replicationRulesList<ReplicationRule>ReplicationRulesReplicationRule[]ReplicationRules*[]ReplicationRule= No replication#serverAccessLogsBucketIBucketserver_access_logs_bucketIBucketserverAccessLogsBucketIBucketServerAccessLogsBucketIBucketServerAccessLogsBucketIBucket= If "serverAccessLogsPrefix" unde…#default
Default: If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
serverAccessLogsPrefixstringserver_access_logs_prefixstrserverAccessLogsPrefixStringServerAccessLogsPrefixstringServerAccessLogsPrefix*string= No log file prefix#If defined without "serverAccessLogsBucket", enables access logs to current bucket with this prefix.
targetObjectKeyFormatTargetObjectKeyFormattarget_object_key_formatTargetObjectKeyFormattargetObjectKeyFormatTargetObjectKeyFormatTargetObjectKeyFormatTargetObjectKeyFormatTargetObjectKeyFormatTargetObjectKeyFormat= the default key format is: [Dest…#default
Default: the default key format is: [DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
transferAccelerationbooleantransfer_accelerationbooltransferAccelerationBooleanTransferAccelerationboolTransferAcceleration*bool= false#transitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizetransition_default_minimum_object_sizeTransitionDefaultMinimumObjectSizetransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSize= TransitionDefaultMinimumObjectSi…#notes · default
To customize the minimum object size for any transition you can add a filter that specifies a custom objectSizeGreaterThan or objectSizeLessThan for lifecycleRules property. Custom filters always take precedence over the default transition behavior.
Default: TransitionDefaultMinimumObjectSize.VARIES_BY_STORAGE_CLASS before September 2024, otherwise TransitionDefaultMinimumObjectSize.ALL_STORAGE_CLASSES_128_K.
versionedbooleanversionedboolversionedBooleanVersionedboolVersioned*bool= false (unless object lock is ena…#default
Default: false (unless object lock is enabled, then true)
websiteErrorDocumentstringwebsite_error_documentstrwebsiteErrorDocumentStringWebsiteErrorDocumentstringWebsiteErrorDocument*string= No error document.#websiteIndexDocumentstringwebsite_index_documentstrwebsiteIndexDocumentStringWebsiteIndexDocumentstringWebsiteIndexDocument*string= No index document.#websiteRedirectRedirectTargetwebsite_redirectRedirectTargetwebsiteRedirectRedirectTargetWebsiteRedirectRedirectTargetWebsiteRedirectRedirectTarget= No redirection.#If you specify this property, you can't specify "websiteIndexDocument", "websiteErrorDocument" nor , "websiteRoutingRules".
websiteRoutingRulesRoutingRule[]website_routing_rulestyping.List[RoutingRule]websiteRoutingRulesList<RoutingRule>WebsiteRoutingRulesRoutingRule[]WebsiteRoutingRules*[]RoutingRule= No redirection rules.#Properties
bucketDomainNamestringbucket_domain_namestrbucketDomainNameStringBucketDomainNamestringBucketDomainName*stringrequired#bucketDualStackDomainNamestringbucket_dual_stack_domain_namestrbucketDualStackDomainNameStringBucketDualStackDomainNamestringBucketDualStackDomainName*stringrequired#bucketRefBucketReferencebucket_refBucketReferencebucketRefBucketReferenceBucketRefBucketReferenceBucketRefBucketReferencerequired#bucketRegionalDomainNamestringbucket_regional_domain_namestrbucketRegionalDomainNameStringBucketRegionalDomainNamestringBucketRegionalDomainName*stringrequired#bucketWebsiteDomainNamestringbucket_website_domain_namestrbucketWebsiteDomainNameStringBucketWebsiteDomainNamestringBucketWebsiteDomainName*stringrequired#bucketWebsiteUrlstringbucket_website_urlstrbucketWebsiteUrlStringBucketWebsiteUrlstringBucketWebsiteUrl*stringrequired#disallowPublicAccessbooleandisallow_public_accessbooldisallowPublicAccessBooleanDisallowPublicAccessboolDisallowPublicAccess*bool#envResourceEnvironmentenvResourceEnvironmentenvResourceEnvironmentEnvResourceEnvironmentEnvResourceEnvironmentrequired#notes
For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.
For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.
If autoCreatePolicy is true, a BucketPolicy will be created upon the first call to addToResourcePolicy(s).
PROPERTY_INJECTION_IDstringproperty_injection_idstrPROPERTY_INJECTION_IDStringPROPERTY_INJECTION_IDstringPROPERTY_INJECTION_ID*stringrequiredstatic#replicationRoleArnstringreplication_role_arnstrreplicationRoleArnStringReplicationRoleArnstringReplicationRoleArn*string#Methods
addCorsRule(rule: CorsRule): voiddef add_cors_rule(self, rule: CorsRule) -> Nonepublic void addCorsRule(CorsRule rule)public void AddCorsRule(CorsRule rule)func AddCorsRule(Rule CorsRule)#1 parameter
Parameters
ruleruleruleruleRule— The CORS configuration rule to add.
addEventNotification(event: EventType, dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_event_notification(self, event: EventType, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addEventNotification(EventType event, IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddEventNotification(EventType event, IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddEventNotification(Event EventType, Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#3 parameters · example
Parameters
eventeventeventeventEvent— The event to trigger the notification.destdestdestdestDest— The notification destination (Lambda, SNS Topic or SQS Queue).filtersfiltersfiltersfiltersFilters— S3 object key filter rules to determine which objects trigger this event.
declare const myLambda: lambda.Function;
const bucket = new s3.Bucket(this, 'MyBucket');
const filter: s3.NotificationKeyFilter = { prefix: 'home/myusername/*' };
bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.LambdaDestination(myLambda), filter);
addInventory(inventory: Inventory): voiddef add_inventory(self, inventory: Inventory) -> Nonepublic void addInventory(Inventory inventory)public void AddInventory(Inventory inventory)func AddInventory(Inventory Inventory)#1 parameter
Parameters
inventoryinventoryinventoryinventoryInventory— configuration to add.
addLifecycleRule(rule: LifecycleRule): voiddef add_lifecycle_rule(self, rule: LifecycleRule) -> Nonepublic void addLifecycleRule(LifecycleRule rule)public void AddLifecycleRule(LifecycleRule rule)func AddLifecycleRule(Rule LifecycleRule)#1 parameter
Parameters
ruleruleruleruleRule— The rule to add.
addMetric(metric: BucketMetrics): voiddef add_metric(self, metric: BucketMetrics) -> Nonepublic void addMetric(BucketMetrics metric)public void AddMetric(BucketMetrics metric)func AddMetric(Metric BucketMetrics)#1 parameter
Parameters
metricmetricmetricmetricMetric— The metric configuration to add.
addObjectCreatedNotification(dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_object_created_notification(self, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addObjectCreatedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddObjectCreatedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddObjectCreatedNotification(Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#This is identical to calling onEvent(EventType.OBJECT_CREATED).
2 parameters
Parameters
destdestdestdestDest— The notification destination (see onEvent).filtersfiltersfiltersfiltersFilters— Filters (see onEvent).
addObjectRemovedNotification(dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_object_removed_notification(self, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addObjectRemovedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddObjectRemovedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddObjectRemovedNotification(Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#This is identical to calling onEvent(EventType.OBJECT_REMOVED).
2 parameters
Parameters
destdestdestdestDest— The notification destination (see onEvent).filtersfiltersfiltersfiltersFilters— Filters (see onEvent).
addReplicationPolicy(roleArn: string, accessControlTransition?: boolean, account?: string): voiddef add_replication_policy(self, role_arn: str, access_control_transition: typing.Optional[bool] = None, account: typing.Optional[str] = None) -> Nonepublic void addReplicationPolicy(String roleArn, Boolean accessControlTransition, String account)public void AddReplicationPolicy(string roleArn, bool? accessControlTransition = null, string? account = null)func AddReplicationPolicy(RoleArn *string, AccessControlTransition *bool, Account *string)#notes · 3 parameters
Call this method on the destination bucket. If the destination bucket is a referenced bucket, its policy cannot be modified by CDK and the permissions must be added in the destination account.
To change replica ownership to the destination bucket owner, set accessControlTransition to true and provide the source bucket owner's account ID.
Parameters
roleArnrole_arnroleArnroleArnRoleArn— The ARN of the source bucket's replication role.accessControlTransitionaccess_control_transitionaccessControlTransitionaccessControlTransitionAccessControlTransition— Whether to change replica ownership to the destination bucket owner.accountaccountaccountaccountAccount— The source bucket owner's AWS account ID.
addToResourcePolicy(permission: PolicyStatement): AddToResourcePolicyResultdef add_to_resource_policy(self, permission: PolicyStatement) -> AddToResourcePolicyResultpublic AddToResourcePolicyResult addToResourcePolicy(PolicyStatement permission)public AddToResourcePolicyResult AddToResourcePolicy(PolicyStatement permission)func AddToResourcePolicy(Permission PolicyStatement) AddToResourcePolicyResult#notes · 1 parameter · returns
Note that the policy statement may or may not be added to the policy. For example, when an IBucket is created from an existing bucket, it's not possible to tell whether the bucket already has a policy attached, let alone to re-use that policy to add more statements to it. So it's safest to do nothing in these cases.
Parameters
permissionpermissionpermissionpermissionPermission— the policy statement to be added to the bucket's policy.
Returns: metadata about the execution of this method. If the policy was not added, the value of statementAdded will be false. You should always check this value to make sure that the operation was actually carried out. Otherwise, synthesis and deploy will terminate silently, which may be confusing.
applyCrossStackReferenceStrength(strength: ReferenceStrength): voiddef apply_cross_stack_reference_strength(self, strength: ReferenceStrength) -> Nonepublic void applyCrossStackReferenceStrength(ReferenceStrength strength)public void ApplyCrossStackReferenceStrength(ReferenceStrength strength)func ApplyCrossStackReferenceStrength(Strength ReferenceStrength)#notes · 1 parameter
When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the @aws-cdk/core:defaultCrossStackReferences context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default.
Parameters
strengthstrengthstrengthstrengthStrength— - The reference strength to use for this resource.
applyRemovalPolicy(policy: RemovalPolicy): voiddef apply_removal_policy(self, policy: RemovalPolicy) -> Nonepublic void applyRemovalPolicy(RemovalPolicy policy)public void ApplyRemovalPolicy(RemovalPolicy policy)func ApplyRemovalPolicy(Policy RemovalPolicy)#notes
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.
The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).
arnForObjects(keyPattern: string): stringdef arn_for_objects(self, key_pattern: str) -> strpublic String arnForObjects(String keyPattern)public string ArnForObjects(string keyPattern)func ArnForObjects(KeyPattern *string) *string#To represent all keys, specify "*".
If you need to specify a keyPattern with multiple components, concatenate them into a single string, e.g.:
arnForObjects(home/${team}/${user}/*)
enableEventBridgeNotification(): voiddef enable_event_bridge_notification(self, ) -> Nonepublic void enableEventBridgeNotification()public void EnableEventBridgeNotification()func EnableEventBridgeNotification()#notes
- Object Deleted (DeleteObject)
- Object Deleted (Lifecycle expiration)
- Object Restore Initiated
- Object Restore Completed
- Object Restore Expired
- Object Storage Class Changed
- Object Access Tier Changed
- Object ACL Updated
- Object Tags Added
- Object Tags Deleted
fromBucketArn(scope: Construct, id: string, bucketArn: string): IBucket@staticmethod def from_bucket_arn(scope: Construct, id: str, bucket_arn: str) -> IBucketpublic static IBucket fromBucketArn(Construct scope, String id, String bucketArn)public static IBucket FromBucketArn(Construct scope, string id, string bucketArn)func FromBucketArn(Scope Construct, Id *string, BucketArn *string) IBucketstatic#fromBucketAttributes(scope: Construct, id: string, attrs: BucketAttributes): IBucket@staticmethod def from_bucket_attributes(scope: Construct, id: str, attrs: BucketAttributes) -> IBucketpublic static IBucket fromBucketAttributes(Construct scope, String id, BucketAttributes attrs)public static IBucket FromBucketAttributes(Construct scope, string id, BucketAttributes attrs)func FromBucketAttributes(Scope Construct, Id *string, Attrs BucketAttributes) IBucketstatic#3 parameters
Parameters
scopescopescopescopeScope— The parent creating construct (usuallythis).ididididId— The construct's name.attrsattrsattrsattrsAttrs— ABucketAttributesobject.
fromBucketName(scope: Construct, id: string, bucketName: string): IBucket@staticmethod def from_bucket_name(scope: Construct, id: str, bucket_name: str) -> IBucketpublic static IBucket fromBucketName(Construct scope, String id, String bucketName)public static IBucket FromBucketName(Construct scope, string id, string bucketName)func FromBucketName(Scope Construct, Id *string, BucketName *string) IBucketstatic#fromCfnBucket(cfnBucket: CfnBucket): IBucket@staticmethod def from_cfn_bucket(cfn_bucket: CfnBucket) -> IBucketpublic static IBucket fromCfnBucket(CfnBucket cfnBucket)public static IBucket FromCfnBucket(CfnBucket cfnBucket)func FromCfnBucket(CfnBucket CfnBucket) IBucketstatic#grantDelete(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_delete(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantDelete(IGrantable identity, Object objectsKeyPattern)public Grant GrantDelete(IGrantable identity, object? objectsKeyPattern = null)func GrantDelete(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#The use of this method is discouraged. Please use grants.delete() instead.
[disable-awslint:no-grants]
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantOnKey(grantee: IGrantable, ...actions: string[]): GrantOnKeyResultdef grant_on_key(self, grantee: IGrantable, actions: str) -> GrantOnKeyResultpublic GrantOnKeyResult grantOnKey(IGrantable grantee, String actions)public GrantOnKeyResult GrantOnKey(IGrantable grantee, string actions)func GrantOnKey(Grantee IGrantable, Actions *string) GrantOnKeyResult#grantPublicAccess(keyPrefix?: string, ...allowedActions: string[]): Grantdef grant_public_access(self, key_prefix: typing.Optional[str] = None, allowed_actions: str) -> Grantpublic Grant grantPublicAccess(String keyPrefix, String allowedActions)public Grant GrantPublicAccess(string? keyPrefix = null, string allowedActions)func GrantPublicAccess(KeyPrefix *string, AllowedActions *string) Grant#notes · 2 parameters
IMPORTANT: This permission allows anyone to perform actions on S3 objects in this bucket, which is useful for when you configure your bucket as a website and want everyone to be able to read objects in the bucket without needing to authenticate.
Without arguments, this method will grant read ("s3:GetObject") access to all objects ("*") in the bucket.
The method returns the iam.Grant object, which can then be modified as needed. For example, you can add a condition that will restrict access only to an IPv4 range like this:
const grant = bucket.grantPublicAccess();
grant.resourceStatement!.addCondition(‘IpAddress’, { “aws:SourceIp”: “54.240.143.0/24” });
Note that if this IBucket refers to an existing bucket, possibly not managed by CloudFormation, this method will have no effect, since it's impossible to modify the policy of an existing bucket.
The use of this method is discouraged. Please use grants.publicAccess() instead.
[disable-awslint:no-grants]
Parameters
keyPrefixkey_prefixkeyPrefixkeyPrefixKeyPrefix— the prefix of S3 object keys (e.g.home/*). Default is "*".allowedActionsallowed_actionsallowedActionsallowedActionsAllowedActions— the set of S3 actions to allow.
grantPut(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_put(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantPut(IGrantable identity, Object objectsKeyPattern)public Grant GrantPut(IGrantable identity, object? objectsKeyPattern = null)func GrantPut(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.
The use of this method is discouraged. Please use grants.put() instead.
[disable-awslint:no-grants]
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantPutAcl(identity: IGrantable, objectsKeyPattern?: string): Grantdef grant_put_acl(self, identity: IGrantable, objects_key_pattern: typing.Optional[str] = None) -> Grantpublic Grant grantPutAcl(IGrantable identity, String objectsKeyPattern)public Grant GrantPutAcl(IGrantable identity, string? objectsKeyPattern = null)func GrantPutAcl(Identity IGrantable, ObjectsKeyPattern *string) Grant#[disable-awslint:no-grants]
grantRead(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_read(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantRead(IGrantable identity, Object objectsKeyPattern)public Grant GrantRead(IGrantable identity, object? objectsKeyPattern = null)func GrantRead(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.
The use of this method is discouraged. Please use grants.read() instead.
[disable-awslint:no-grants]
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantReadWrite(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_read_write(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantReadWrite(IGrantable identity, Object objectsKeyPattern)public Grant GrantReadWrite(IGrantable identity, object? objectsKeyPattern = null)func GrantReadWrite(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#[disable-awslint:no-grants]
grantReplicationPermission(identity: IGrantable, props: GrantReplicationPermissionProps): Grantdef grant_replication_permission(self, identity: IGrantable, props: GrantReplicationPermissionProps) -> Grantpublic Grant grantReplicationPermission(IGrantable identity, GrantReplicationPermissionProps props)public Grant GrantReplicationPermission(IGrantable identity, GrantReplicationPermissionProps props)func GrantReplicationPermission(Identity IGrantable, Props GrantReplicationPermissionProps) Grant#notes · 2 parameters
Note that when calling this function for source or destination buckets that support KMS encryption, you need to specify the KMS key for encryption and the KMS key for decryption, respectively.
The use of this method is discouraged. Please use grants.replicationPermission() instead.
[disable-awslint:no-grants]
Parameters
identityidentityidentityidentityIdentity— The principal to grant replication permission to.propspropspropspropsProps— The properties of the replication source and destination buckets.
grantWrite(identity: IGrantable, objectsKeyPattern?: any, allowedActionPatterns?: string[]): Grantdef grant_write(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None, allowed_action_patterns: typing.Optional[typing.List[str]] = None) -> Grantpublic Grant grantWrite(IGrantable identity, Object objectsKeyPattern, List<String> allowedActionPatterns)public Grant GrantWrite(IGrantable identity, object? objectsKeyPattern = null, string[]? allowedActionPatterns = null)func GrantWrite(Identity IGrantable, ObjectsKeyPattern interface{}, AllowedActionPatterns *[]*string) Grant#[disable-awslint:no-grants]
isConstruct(x: any): boolean@staticmethod def is_construct(x: Any) -> boolpublic static Boolean isConstruct(Object x)public static bool IsConstruct(object x)func IsConstruct(X interface{}) *boolstatic#notes · 1 parameter · returns
Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.
Parameters
xxxxX— Any object.
Returns: true if x is an object created from a class which extends Construct.
isOwnedResource(construct: IConstruct): boolean@staticmethod def is_owned_resource(construct: IConstruct) -> boolpublic static Boolean isOwnedResource(IConstruct construct)public static bool IsOwnedResource(IConstruct construct)func IsOwnedResource(Construct IConstruct) *boolstatic#isResource(construct: IConstruct): boolean@staticmethod def is_resource(construct: IConstruct) -> boolpublic static Boolean isResource(IConstruct construct)public static bool IsResource(IConstruct construct)func IsResource(Construct IConstruct) *boolstatic#onCloudTrailEvent(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_event(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailEvent(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailEvent(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailEvent(Id *string, Options OnCloudTrailBucketEventOptions) Rule#Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
2 parameters
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
onCloudTrailPutObject(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_put_object(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailPutObject(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailPutObject(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailPutObject(Id *string, Options OnCloudTrailBucketEventOptions) Rule#notes · 2 parameters
Note that some tools like aws s3 cp will automatically use either PutObject or the multipart upload API depending on the file size, so using onCloudTrailWriteObject may be preferable.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
onCloudTrailWriteObject(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_write_object(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailWriteObject(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailWriteObject(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailWriteObject(Id *string, Options OnCloudTrailBucketEventOptions) Rule#notes · 2 parameters
This includes the events PutObject, CopyObject, and CompleteMultipartUpload.
Note that some tools like aws s3 cp will automatically use either PutObject or the multipart upload API depending on the file size, so using this method may be preferable to onCloudTrailPutObject.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
s3UrlForObject(key?: string): stringdef s3_url_for_object(self, key: typing.Optional[str] = None) -> strpublic String s3UrlForObject(String key)public string S3UrlForObject(string? key = null)func S3UrlForObject(Key *string) *string#s3://onlybuckets3://bucket/key
1 parameter · returns
Parameters
keykeykeykeyKey— The S3 key of the object.
Returns: an ObjectS3Url token
toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#transferAccelerationUrlForObject(key?: string, options?: TransferAccelerationUrlOptions): stringdef transfer_acceleration_url_for_object(self, key: typing.Optional[str] = None, options: typing.Optional[TransferAccelerationUrlOptions] = None) -> strpublic String transferAccelerationUrlForObject(String key, TransferAccelerationUrlOptions options)public string TransferAccelerationUrlForObject(string? key = null, TransferAccelerationUrlOptions? options = null)func TransferAccelerationUrlForObject(Key *string, Options TransferAccelerationUrlOptions) *string#Specify dualStack: true at the options for dual-stack endpoint (connect to the bucket over IPv6). For example:
https://bucket---s3-accelerate.amazonaws.com.rproxy.goskope.comhttps://bucket.s3-accelerate.amazonaws.com/key
2 parameters · returns
Parameters
keykeykeykeyKey— The S3 key of the object.optionsoptionsoptionsoptionsOptions— Options for generating URL.
Returns: an TransferAccelerationUrl token
urlForObject(key?: string): stringdef url_for_object(self, key: typing.Optional[str] = None) -> strpublic String urlForObject(String key)public string UrlForObject(string? key = null)func UrlForObject(Key *string) *string#https://s3.us-west-1.amazonaws.com/onlybuckethttps://s3.us-west-1.amazonaws.com/bucket/keyhttps://s3---cn-north-1.amazonaws.com.rproxy.goskope.com.cn/china-bucket/mykey
1 parameter · returns
Parameters
keykeykeykeyKey— The S3 key of the object.
Returns: an ObjectS3Url token
validateBucketName(physicalName: string, allowLegacyBucketNaming?: boolean): void@staticmethod def validate_bucket_name(physical_name: str, allow_legacy_bucket_naming: typing.Optional[bool] = None) -> Nonepublic static void validateBucketName(String physicalName, Boolean allowLegacyBucketNaming)public static void ValidateBucketName(string physicalName, bool? allowLegacyBucketNaming = null)func ValidateBucketName(PhysicalName *string, AllowLegacyBucketNaming *bool)static#2 parameters
Parameters
physicalNamephysical_namephysicalNamephysicalNamePhysicalName— name of the bucket.allowLegacyBucketNamingallow_legacy_bucket_namingallowLegacyBucketNamingallowLegacyBucketNamingAllowLegacyBucketNaming— allow legacy bucket naming style, default is false.
virtualHostedUrlForObject(key?: string, options?: VirtualHostedStyleUrlOptions): stringdef virtual_hosted_url_for_object(self, key: typing.Optional[str] = None, options: typing.Optional[VirtualHostedStyleUrlOptions] = None) -> strpublic String virtualHostedUrlForObject(String key, VirtualHostedStyleUrlOptions options)public string VirtualHostedUrlForObject(string? key = null, VirtualHostedStyleUrlOptions? options = null)func VirtualHostedUrlForObject(Key *string, Options VirtualHostedStyleUrlOptions) *string#https://only-bucket---s3---us-west-1.amazonaws.com.rproxy.goskope.comhttps://bucket.s3.us-west-1.amazonaws.com/keyhttps://bucket.s3.amazonaws.com/keyhttps://china-bucket---s3---cn-north-1.amazonaws.com.rproxy.goskope.com.cn/mykey
2 parameters · returns
Parameters
keykeykeykeyKey— The S3 key of the object.optionsoptionsoptionsoptionsOptions— Options for generating URL.
Returns: an ObjectS3Url token
with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.