# BucketProps

Extends: BucketProps
Used as props by: Bucket

- Source: [`aws-s3/lib/bucket.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-s3/lib/bucket.ts#L1788)
- Type last changed: v2.256.0 · 20 May 2026

## Example

```ts
const accessLogsBucket = new s3.Bucket(this, 'AccessLogsBucket', {
  objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_ENFORCED,
});

accessLogsBucket.addToResourcePolicy(
  new iam.PolicyStatement({
    actions: ['s3:*'],
    resources: [accessLogsBucket.bucketArn, accessLogsBucket.arnForObjects('*')],
    principals: [new iam.AnyPrincipal()],
  })
)

const bucket = new s3.Bucket(this, 'MyBucket', {
  serverAccessLogsBucket: accessLogsBucket,
  serverAccessLogsPrefix: 'logs',
});
```

## Properties

- `abacStatus`: boolean — Enables Amazon S3 to evaluate the ABAC policy in the request.

  **Default:** The ABAC status is not set

  Set to true to enable ABAC, false to explicitly disable it.

- `accessControl`: [BucketAccessControl](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketAccessControl.html) = BucketAccessControl.PRIVATE — Specifies a canned ACL that grants predefined permissions to the bucket.

- `autoDeleteObjects`: boolean = false — Whether all objects should be automatically deleted when the bucket is removed from the stack or when the stack is deleted.

  Requires the `removalPolicy` to be set to `RemovalPolicy.DESTROY`.

  **Warning** if you have deployed a bucket with `autoDeleteObjects: true`,
  switching this to `false` in a CDK version *before* `1.126.0` will lead to
  all objects in the bucket being deleted. Be sure to update your bucket resources
  by deploying with CDK version `1.126.0` or later **before** switching this value to `false`.

  Setting `autoDeleteObjects` to true on a bucket will add `s3:PutBucketPolicy` to the
  bucket policy. This is because during bucket deletion, the custom resource provider
  needs to update the bucket policy by adding a deny policy for `s3:PutObject` to
  prevent race conditions with external bucket writers.

- `blockedEncryptionTypes`: [BlockedEncryptionType](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BlockedEncryptionType.html)[] — Encryption types that should be blocked for this bucket. Use `NONE` to allow all encryption types.

  **Default:** Amazon S3 determines which encryption types to block.

  At least one `BlockedEncryptionType` must be given. If `NONE` is given, it must be
  the only `BlockedEncryptionType` in the list.

- `blockPublicAccess`: [BlockPublicAccess](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BlockPublicAccess.html) — The block public access configuration of this bucket.

  **Default:** CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access

- `bucketKeyEnabled`: boolean = false — Whether Amazon S3 should use its own intermediary key to generate data keys.

  Only relevant when using KMS for encryption.

  - If not enabled, every object GET and PUT will cause an API call to KMS (with the
    attendant cost implications of that).
  - If enabled, S3 will use its own time-limited key instead.

  Only relevant, when Encryption is not set to `BucketEncryption.UNENCRYPTED`.

- `bucketName`: string — Physical name of this bucket.

  **Default:** Assigned by CloudFormation (recommended).

  Cannot be used together with `bucketNamePrefix` or `bucketNamespace`.

- `bucketNamePrefix`: string — A prefix for the bucket name in the account-regional namespace.

  **Default:** No prefix.

  Requires `bucketNamespace` to be set to `ACCOUNT_REGIONAL`.
  Cannot be used together with `bucketName`.

  CloudFormation appends `-<accountId>-<region>-an` to form the full name.
  For example, `my-app` becomes `my-app-123456789012-us-east-1-an`.

  Must contain only lowercase letters, numbers, and hyphens.
  Must start and end with a lowercase letter or number.

- `bucketNamespace`: [BucketNamespace](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketNamespace.html) — The namespace for the bucket name.

  **Default:** Global namespace.

  AWS recommends `ACCOUNT_REGIONAL` for improved security, as bucket names
  are scoped to your account and cannot be claimed by other accounts.
  When set to `ACCOUNT_REGIONAL`, `bucketNamePrefix` is required.
  When set to `GLOBAL`, it can be used standalone to explicitly specify the default namespace.

- `cors`: [CorsRule](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.CorsRule.html)[] — The CORS configuration of this bucket.

  **Default:** No CORS configuration.

- `encryption`: [BucketEncryption](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketEncryption.html) — The kind of server-side encryption to apply to this bucket.

  **Default:** `KMS` if `encryptionKey` is specified, or `S3_MANAGED` otherwise.

  If you choose KMS, you can specify a KMS key via `encryptionKey`. If
  encryption key is not specified, a key will automatically be created.

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — External KMS key to use for bucket encryption.

  **Default:** If `encryption` is set to `KMS` and this property is undefined, a new KMS key will be created and associated with this bucket.

  The `encryption` property must be either not specified or set to `KMS` or `DSSE`.
  An error will be emitted if `encryption` is set to `UNENCRYPTED` or `S3_MANAGED`.

- `enforceSSL`: boolean = false — Enforces SSL for requests.

  S3.5 of the AWS Foundational Security Best Practices Regarding S3.

- `eventBridgeEnabled`: boolean = false — Whether this bucket should send notifications to Amazon EventBridge or not.

- `intelligentTieringConfigurations`: [IntelligentTieringConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.IntelligentTieringConfiguration.html)[] — Intelligent Tiering Configurations.

  **Default:** No Intelligent Tiering Configurations.

- `inventories`: [Inventory](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Inventory.html)[] — The inventory configuration of the bucket.

  **Default:** No inventory configuration

- `lifecycleRules`: [LifecycleRule](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.LifecycleRule.html)[] — Rules that define how Amazon S3 manages objects during their lifetime.

  **Default:** No lifecycle rules.

- `metrics`: [BucketMetrics](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketMetrics.html)[] — The metrics configuration of this bucket.

  **Default:** No metrics configuration.

- `minimumTLSVersion`: number — Enforces minimum TLS version for requests.

  **Default:** No minimum TLS version is enforced.

  Requires `enforceSSL` to be enabled.

- `notificationsHandlerRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The role to be used by the notifications handler.

  **Default:** a new role will be created.

- `notificationsSkipDestinationValidation`: boolean = false — Skips notification validation of Amazon SQS, Amazon SNS, and Lambda destinations.

- `objectLockDefaultRetention`: [ObjectLockRetention](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.ObjectLockRetention.html) — The default retention mode and rules for S3 Object Lock.

  **Default:** no default retention period

  Default retention can be configured after a bucket is created if the bucket already
  has object lock enabled. Enabling object lock for existing buckets is not supported.

- `objectLockEnabled`: boolean — Enable object lock on the bucket.

  **Default:** false, unless objectLockDefaultRetention is set (then, true)

  Enabling object lock for existing buckets is not supported. Object lock must be
  enabled when the bucket is created.

- `objectOwnership`: [ObjectOwnership](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.ObjectOwnership.html) — The objectOwnership of the bucket.

  **Default:** No ObjectOwnership configuration. By default, Amazon S3 sets Object Ownership to `Bucket owner enforced`. This means ACLs are disabled and the bucket owner will own every object.

- `publicReadAccess`: boolean = false — Grants public read access to all objects in the bucket.

  Similar to calling `bucket.grantPublicAccess()`

- `removalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) — Policy to apply when the bucket is removed from this stack.

  **Default:** The bucket will be orphaned.

- `replicationRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The role to be used by the replication.

  **Default:** a new role will be created.

  When setting this property, you must also set `replicationRules`.

- `replicationRules`: [ReplicationRule](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.ReplicationRule.html)[] — A container for one or more replication rules.

  **Default:** No replication

- `serverAccessLogsBucket`: [IBucket](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.IBucket.html) — Destination bucket for the server access logs.

  **Default:** If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.

- `serverAccessLogsPrefix`: string — Optional log file prefix to use for the bucket's access logs.

  **Default:** No log file prefix

  If defined without "serverAccessLogsBucket", enables access logs to current bucket with this prefix.

- `targetObjectKeyFormat`: [TargetObjectKeyFormat](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.TargetObjectKeyFormat.html) — Optional key format for log objects.

  **Default:** the default key format is: [DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]

- `transferAcceleration`: boolean = false — Whether this bucket should have transfer acceleration turned on or not.

- `transitionDefaultMinimumObjectSize`: [TransitionDefaultMinimumObjectSize](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.TransitionDefaultMinimumObjectSize.html) — Indicates which default minimum object size behavior is applied to the lifecycle configuration.

  **Default:** TransitionDefaultMinimumObjectSize.VARIES_BY_STORAGE_CLASS before September 2024, otherwise TransitionDefaultMinimumObjectSize.ALL_STORAGE_CLASSES_128_K.

  To customize the minimum object size for any transition you can add a filter that specifies a custom
  `objectSizeGreaterThan` or `objectSizeLessThan` for `lifecycleRules` property. Custom filters always
  take precedence over the default transition behavior.

- `versioned`: boolean — Whether this bucket should have versioning turned on or not.

  **Default:** false (unless object lock is enabled, then true)

- `websiteErrorDocument`: string — The name of the error document (e.g. "404.html") for the website. `websiteIndexDocument` must also be set if this is set.

  **Default:** No error document.

- `websiteIndexDocument`: string — The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket.

  **Default:** No index document.

- `websiteRedirect`: [RedirectTarget](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.RedirectTarget.html) — Specifies the redirect behavior of all requests to a website endpoint of a bucket.

  **Default:** No redirection.

  If you specify this property, you can't specify "websiteIndexDocument", "websiteErrorDocument" nor , "websiteRoutingRules".

- `websiteRoutingRules`: [RoutingRule](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.RoutingRule.html)[] — Rules that define when a redirect is applied and the redirect behavior.

  **Default:** No redirection rules.