S3FilesOptions Struct
Options for mounting an S3 Files filesystem.
Example
ts
import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as s3files from 'aws-cdk-lib/aws-s3files';
const vpc = new ec2.Vpc(this, 'Vpc');
// Versioning is required — S3 Files relies on object versions for consistency.
const bucket = new s3.Bucket(this, 'Bucket', { versioned: true });
// S3 Files assumes this role to sync data between S3 and the file system.
const role = new iam.Role(this, 'S3FilesRole', {
assumedBy: new iam.ServicePrincipal('elasticfilesystem.amazonaws.com'),
});
// S3 permissions: read/write access to the bucket and objects
role.addToPolicy(new iam.PolicyStatement({
actions: ['s3:ListBucket*'],
resources: [bucket.bucketArn],
}));
role.addToPolicy(new iam.PolicyStatement({
actions: ['s3:AbortMultipartUpload', 's3:DeleteObject', 's3:GetObject*', 's3:List*', 's3:PutObject*'],
resources: [bucket.arnForObjects('*')],
}));
// EventBridge permissions: S3 Files creates rules prefixed "DO-NOT-DELETE-S3-Files"
// to detect S3 object changes and trigger data synchronization.
role.addToPolicy(new iam.PolicyStatement({
actions: [
'events:DeleteRule', 'events:DisableRule', 'events:EnableRule',
'events:PutRule', 'events:PutTargets', 'events:RemoveTargets',
],
resources: [`arn:${cdk.Aws.PARTITION}:events:*:*:rule/DO-NOT-DELETE-S3-Files*`],
conditions: { StringEquals: { 'events:ManagedBy': 'elasticfilesystem.amazonaws.com' } },
}));
role.addToPolicy(new iam.PolicyStatement({
actions: ['events:DescribeRule', 'events:ListRuleNamesByTarget', 'events:ListRules', 'events:ListTargetsByRule'],
resources: [`arn:${cdk.Aws.PARTITION}:events:*:*:rule/*`],
}));
const fileSystem = new s3files.CfnFileSystem(this, 'S3FilesFs', {
bucket: bucket.bucketArn,
roleArn: role.roleArn,
});
const sg = new ec2.SecurityGroup(this, 'MountTargetSG', { vpc });
// Create a mount target in each private subnet so Lambda can reach the file system via NFS.
vpc.privateSubnets.forEach((subnet, i) =>
new s3files.CfnMountTarget(this, `MountTarget${i}`, {
fileSystemId: fileSystem.attrFileSystemId,
subnetId: subnet.subnetId,
securityGroups: [sg.securityGroupId],
}),
);
// The access point defines the POSIX identity and root path Lambda uses on the file system.
const accessPoint = new s3files.CfnAccessPoint(this, 'AccessPoint', {
fileSystemId: fileSystem.attrFileSystemId,
rootDirectory: {
path: '/export/lambda',
creationPermissions: { ownerGid: '1001', ownerUid: '1001', permissions: '750' },
},
posixUser: { gid: '1001', uid: '1001' },
});
const fn = new lambda.Function(this, 'MyFunction', {
runtime: lambda.Runtime.NODEJS_LATEST,
handler: 'index.handler',
code: lambda.Code.fromAsset(path.join(__dirname, 'lambda-handler')),
vpc,
filesystem: lambda.FileSystem.fromS3FilesAccessPoint(accessPoint, '/mnt/s3files', {
// Enables direct reads and grants s3:GetObject/s3:GetObjectVersion on the bucket to the execution role.
directS3Read: lambda.DirectS3Read.enabled(bucket),
}),
});
Properties
directS3ReadDirectS3Readdirect_s3_readDirectS3ReaddirectS3ReadDirectS3ReadDirectS3ReadDirectS3ReadDirectS3ReadDirectS3Read#The DirectS3Read configuration for the S3 Files filesystem.
Default: DirectS3Read is not set. The service default is AUTO.
Use DirectS3Read.enabled(bucket), DirectS3Read.enabledWithoutGrant(), DirectS3Read.auto(), or DirectS3Read.disabled() to control whether Lambda reads objects directly from S3 instead of through the mount.