BucketProps Struct
Example
const accessLogsBucket = new s3.Bucket(this, 'AccessLogsBucket', {
objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_ENFORCED,
});
accessLogsBucket.addToResourcePolicy(
new iam.PolicyStatement({
actions: ['s3:*'],
resources: [accessLogsBucket.bucketArn, accessLogsBucket.arnForObjects('*')],
principals: [new iam.AnyPrincipal()],
})
)
const bucket = new s3.Bucket(this, 'MyBucket', {
serverAccessLogsBucket: accessLogsBucket,
serverAccessLogsPrefix: 'logs',
});
Properties
abacStatusbooleanabac_statusboolabacStatusBooleanAbacStatusboolAbacStatus*bool= The ABAC status is not set#Set to true to enable ABAC, false to explicitly disable it.
accessControlBucketAccessControlaccess_controlBucketAccessControlaccessControlBucketAccessControlAccessControlBucketAccessControlAccessControlBucketAccessControl= BucketAccessControl.PRIVATE#autoDeleteObjectsbooleanauto_delete_objectsboolautoDeleteObjectsBooleanAutoDeleteObjectsboolAutoDeleteObjects*bool= false#notes
Requires the removalPolicy to be set to RemovalPolicy.DESTROY.
Warning if you have deployed a bucket with autoDeleteObjects: true, switching this to false in a CDK version before 1.126.0 will lead to all objects in the bucket being deleted. Be sure to update your bucket resources by deploying with CDK version 1.126.0 or later before switching this value to false.
Setting autoDeleteObjects to true on a bucket will add s3:PutBucketPolicy to the bucket policy. This is because during bucket deletion, the custom resource provider needs to update the bucket policy by adding a deny policy for s3:PutObject to prevent race conditions with external bucket writers.
blockedEncryptionTypesBlockedEncryptionType[]blocked_encryption_typestyping.List[BlockedEncryptionType]blockedEncryptionTypesList<BlockedEncryptionType>BlockedEncryptionTypesBlockedEncryptionType[]BlockedEncryptionTypes*[]BlockedEncryptionType= Amazon S3 determines which encry…#At least one BlockedEncryptionType must be given. If NONE is given, it must be the only BlockedEncryptionType in the list.
default
Default: Amazon S3 determines which encryption types to block.
blockPublicAccessBlockPublicAccessblock_public_accessBlockPublicAccessblockPublicAccessBlockPublicAccessBlockPublicAccessBlockPublicAccessBlockPublicAccessBlockPublicAccess= CloudFormation defaults will app…#default
Default: CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
bucketKeyEnabledbooleanbucket_key_enabledboolbucketKeyEnabledBooleanBucketKeyEnabledboolBucketKeyEnabled*bool= false#notes
Only relevant when using KMS for encryption.
- If not enabled, every object GET and PUT will cause an API call to KMS (with the attendant cost implications of that).
- If enabled, S3 will use its own time-limited key instead.
Only relevant, when Encryption is not set to BucketEncryption.UNENCRYPTED.
bucketNamestringbucket_namestrbucketNameStringBucketNamestringBucketName*string= Assigned by CloudFormation (reco…#Cannot be used together with bucketNamePrefix or bucketNamespace.
default
Default: Assigned by CloudFormation (recommended).
bucketNamePrefixstringbucket_name_prefixstrbucketNamePrefixStringBucketNamePrefixstringBucketNamePrefix*string= No prefix.#notes
Requires bucketNamespace to be set to ACCOUNT_REGIONAL. Cannot be used together with bucketName.
CloudFormation appends -<accountId>-<region>-an to form the full name. For example, my-app becomes my-app-123456789012-us-east-1-an.
Must contain only lowercase letters, numbers, and hyphens. Must start and end with a lowercase letter or number.
bucketNamespaceBucketNamespacebucket_namespaceBucketNamespacebucketNamespaceBucketNamespaceBucketNamespaceBucketNamespaceBucketNamespaceBucketNamespace= Global namespace.#notes
AWS recommends ACCOUNT_REGIONAL for improved security, as bucket names are scoped to your account and cannot be claimed by other accounts. When set to ACCOUNT_REGIONAL, bucketNamePrefix is required. When set to GLOBAL, it can be used standalone to explicitly specify the default namespace.
corsCorsRule[]corstyping.List[CorsRule]corsList<CorsRule>CorsCorsRule[]Cors*[]CorsRule= No CORS configuration.#encryptionBucketEncryptionencryptionBucketEncryptionencryptionBucketEncryptionEncryptionBucketEncryptionEncryptionBucketEncryption= `KMS` if `encryptionKey` is spec…#If you choose KMS, you can specify a KMS key via encryptionKey. If encryption key is not specified, a key will automatically be created.
default
Default: KMS if encryptionKey is specified, or S3_MANAGED otherwise.
encryptionKeyIKeyencryption_keyIKeyencryptionKeyIKeyEncryptionKeyIKeyEncryptionKeyIKey= If `encryption` is set to `KMS` …#The encryption property must be either not specified or set to KMS or DSSE. An error will be emitted if encryption is set to UNENCRYPTED or S3_MANAGED.
default
Default: If encryption is set to KMS and this property is undefined, a new KMS key will be created and associated with this bucket.
S3.5 of the AWS Foundational Security Best Practices Regarding S3.
eventBridgeEnabledbooleanevent_bridge_enabledbooleventBridgeEnabledBooleanEventBridgeEnabledboolEventBridgeEnabled*bool= false#intelligentTieringConfigurationsIntelligentTieringConfiguration[]intelligent_tiering_configurationstyping.List[IntelligentTieringConfiguration]intelligentTieringConfigurationsList<IntelligentTieringConfiguration>IntelligentTieringConfigurationsIntelligentTieringConfiguration[]IntelligentTieringConfigurations*[]IntelligentTieringConfiguration= No Intelligent Tiering Configura…#default
Default: No Intelligent Tiering Configurations.
inventoriesInventory[]inventoriestyping.List[Inventory]inventoriesList<Inventory>InventoriesInventory[]Inventories*[]Inventory= No inventory configuration#lifecycleRulesLifecycleRule[]lifecycle_rulestyping.List[LifecycleRule]lifecycleRulesList<LifecycleRule>LifecycleRulesLifecycleRule[]LifecycleRules*[]LifecycleRule= No lifecycle rules.#metricsBucketMetrics[]metricstyping.List[BucketMetrics]metricsList<BucketMetrics>MetricsBucketMetrics[]Metrics*[]BucketMetrics= No metrics configuration.#minimumTLSVersionnumberminimum_tls_versionint | floatminimumTLSVersionNumberMinimumTLSVersiondoubleMinimumTLSVersion*float64= No minimum TLS version is enforc…#Requires enforceSSL to be enabled.
default
Default: No minimum TLS version is enforced.
notificationsHandlerRoleIRolenotifications_handler_roleIRolenotificationsHandlerRoleIRoleNotificationsHandlerRoleIRoleNotificationsHandlerRoleIRole= a new role will be created.#notificationsSkipDestinationValidationbooleannotifications_skip_destination_validationboolnotificationsSkipDestinationValidationBooleanNotificationsSkipDestinationValidationboolNotificationsSkipDestinationValidation*bool= false#objectLockDefaultRetentionObjectLockRetentionobject_lock_default_retentionObjectLockRetentionobjectLockDefaultRetentionObjectLockRetentionObjectLockDefaultRetentionObjectLockRetentionObjectLockDefaultRetentionObjectLockRetention= no default retention period#Default retention can be configured after a bucket is created if the bucket already has object lock enabled. Enabling object lock for existing buckets is not supported.
objectLockEnabledbooleanobject_lock_enabledboolobjectLockEnabledBooleanObjectLockEnabledboolObjectLockEnabled*bool= false, unless objectLockDefaultR…#Enabling object lock for existing buckets is not supported. Object lock must be enabled when the bucket is created.
default
Default: false, unless objectLockDefaultRetention is set (then, true)
objectOwnershipObjectOwnershipobject_ownershipObjectOwnershipobjectOwnershipObjectOwnershipObjectOwnershipObjectOwnershipObjectOwnershipObjectOwnership= No ObjectOwnership configuration…#default
Default: No ObjectOwnership configuration. By default, Amazon S3 sets Object Ownership to Bucket owner enforced. This means ACLs are disabled and the bucket owner will own every object.
publicReadAccessbooleanpublic_read_accessboolpublicReadAccessBooleanPublicReadAccessboolPublicReadAccess*bool= false#Similar to calling bucket.grantPublicAccess()
removalPolicyRemovalPolicyremoval_policyRemovalPolicyremovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicy= The bucket will be orphaned.#replicationRoleIRolereplication_roleIRolereplicationRoleIRoleReplicationRoleIRoleReplicationRoleIRole= a new role will be created.#When setting this property, you must also set replicationRules.
replicationRulesReplicationRule[]replication_rulestyping.List[ReplicationRule]replicationRulesList<ReplicationRule>ReplicationRulesReplicationRule[]ReplicationRules*[]ReplicationRule= No replication#serverAccessLogsBucketIBucketserver_access_logs_bucketIBucketserverAccessLogsBucketIBucketServerAccessLogsBucketIBucketServerAccessLogsBucketIBucket= If "serverAccessLogsPrefix" unde…#default
Default: If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
serverAccessLogsPrefixstringserver_access_logs_prefixstrserverAccessLogsPrefixStringServerAccessLogsPrefixstringServerAccessLogsPrefix*string= No log file prefix#If defined without "serverAccessLogsBucket", enables access logs to current bucket with this prefix.
targetObjectKeyFormatTargetObjectKeyFormattarget_object_key_formatTargetObjectKeyFormattargetObjectKeyFormatTargetObjectKeyFormatTargetObjectKeyFormatTargetObjectKeyFormatTargetObjectKeyFormatTargetObjectKeyFormat= the default key format is: [Dest…#default
Default: the default key format is: [DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
transferAccelerationbooleantransfer_accelerationbooltransferAccelerationBooleanTransferAccelerationboolTransferAcceleration*bool= false#transitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizetransition_default_minimum_object_sizeTransitionDefaultMinimumObjectSizetransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSize= TransitionDefaultMinimumObjectSi…#notes · default
To customize the minimum object size for any transition you can add a filter that specifies a custom objectSizeGreaterThan or objectSizeLessThan for lifecycleRules property. Custom filters always take precedence over the default transition behavior.
Default: TransitionDefaultMinimumObjectSize.VARIES_BY_STORAGE_CLASS before September 2024, otherwise TransitionDefaultMinimumObjectSize.ALL_STORAGE_CLASSES_128_K.
versionedbooleanversionedboolversionedBooleanVersionedboolVersioned*bool= false (unless object lock is ena…#default
Default: false (unless object lock is enabled, then true)
websiteErrorDocumentstringwebsite_error_documentstrwebsiteErrorDocumentStringWebsiteErrorDocumentstringWebsiteErrorDocument*string= No error document.#websiteIndexDocumentstringwebsite_index_documentstrwebsiteIndexDocumentStringWebsiteIndexDocumentstringWebsiteIndexDocument*string= No index document.#websiteRedirectRedirectTargetwebsite_redirectRedirectTargetwebsiteRedirectRedirectTargetWebsiteRedirectRedirectTargetWebsiteRedirectRedirectTarget= No redirection.#If you specify this property, you can't specify "websiteIndexDocument", "websiteErrorDocument" nor , "websiteRoutingRules".
websiteRoutingRulesRoutingRule[]website_routing_rulestyping.List[RoutingRule]websiteRoutingRulesList<RoutingRule>WebsiteRoutingRulesRoutingRule[]WebsiteRoutingRules*[]RoutingRule= No redirection rules.#