Package software.amazon.awscdk.services.s3
Amazon S3 Construct Library
Define an S3 bucket.
Bucket bucket = new Bucket(this, "MyFirstBucket");
Bucket
constructs expose the following deploy-time attributes:
bucketArn
- the ARN of the bucket (i.e.arn:aws:s3:::bucket_name
)bucketName
- the name of the bucket (i.e.bucket_name
)bucketWebsiteUrl
- the Website URL of the bucket (i.e.http://bucket_name.s3-website-us-west-1.amazonaws.com
)bucketDomainName
- the URL of the bucket (i.e.bucket_name.s3.amazonaws.com
)bucketDualStackDomainName
- the dual-stack URL of the bucket (i.e.bucket_name.s3.dualstack.eu-west-1.amazonaws.com
)bucketRegionalDomainName
- the regional URL of the bucket (i.e.bucket_name.s3.eu-west-1.amazonaws.com
)arnForObjects(pattern)
- the ARN of an object or objects within the bucket (i.e.arn:aws:s3:::bucket_name/exampleobject.png
orarn:aws:s3:::bucket_name/Development/*
)urlForObject(key)
- the HTTP URL of an object within the bucket (i.e.https://s3---cn-north-1.amazonaws.com.rproxy.goskope.com.cn/china-bucket/mykey
)virtualHostedUrlForObject(key)
- the virtual-hosted style HTTP URL of an object within the bucket (i.e.https://china-bucket-s3---cn-north-1.amazonaws.com.rproxy.goskope.com.cn/mykey
)s3UrlForObject(key)
- the S3 URL of an object within the bucket (i.e.s3://bucket/mykey
)
Encryption
Define a KMS-encrypted bucket:
Bucket bucket = Bucket.Builder.create(this, "MyEncryptedBucket") .encryption(BucketEncryption.KMS) .build(); // you can access the encryption key: assert(bucket.getEncryptionKey() instanceof Key);
You can also supply your own key:
Key myKmsKey = new Key(this, "MyKey"); Bucket bucket = Bucket.Builder.create(this, "MyEncryptedBucket") .encryption(BucketEncryption.KMS) .encryptionKey(myKmsKey) .build(); assert(bucket.getEncryptionKey() == myKmsKey);
Enable KMS-SSE encryption via S3 Bucket Keys:
Bucket bucket = Bucket.Builder.create(this, "MyEncryptedBucket") .encryption(BucketEncryption.KMS) .bucketKeyEnabled(true) .build();
Use BucketEncryption.ManagedKms
to use the S3 master KMS key:
Bucket bucket = Bucket.Builder.create(this, "Buck") .encryption(BucketEncryption.KMS_MANAGED) .build(); assert(bucket.getEncryptionKey() == null);
Enable DSSE encryption:
const bucket = new s3.Bucket(stack, 'MyDSSEBucket', { encryption: s3.BucketEncryption.DSSE_MANAGED, bucketKeyEnabled: true, });
Permissions
A bucket policy will be automatically created for the bucket upon the first call to
addToResourcePolicy(statement)
:
Bucket bucket = new Bucket(this, "MyBucket"); AddToResourcePolicyResult result = bucket.addToResourcePolicy( PolicyStatement.Builder.create() .actions(List.of("s3:GetObject")) .resources(List.of(bucket.arnForObjects("file.txt"))) .principals(List.of(new AccountRootPrincipal())) .build());
If you try to add a policy statement to an existing bucket, this method will not do anything:
IBucket bucket = Bucket.fromBucketName(this, "existingBucket", "bucket-name"); // No policy statement will be added to the resource AddToResourcePolicyResult result = bucket.addToResourcePolicy( PolicyStatement.Builder.create() .actions(List.of("s3:GetObject")) .resources(List.of(bucket.arnForObjects("file.txt"))) .principals(List.of(new AccountRootPrincipal())) .build());
That's because it's not possible to tell whether the bucket already has a policy attached, let alone to re-use that policy to add more statements to it. We recommend that you always check the result of the call:
Bucket bucket = new Bucket(this, "MyBucket"); AddToResourcePolicyResult result = bucket.addToResourcePolicy( PolicyStatement.Builder.create() .actions(List.of("s3:GetObject")) .resources(List.of(bucket.arnForObjects("file.txt"))) .principals(List.of(new AccountRootPrincipal())) .build()); if (!result.getStatementAdded()) { }
The bucket policy can be directly accessed after creation to add statements or adjust the removal policy.
Bucket bucket = new Bucket(this, "MyBucket"); bucket.policy.applyRemovalPolicy(RemovalPolicy.RETAIN);
Most of the time, you won't have to manipulate the bucket policy directly. Instead, buckets have "grant" methods called to give prepackaged sets of permissions to other resources. For example:
Function myLambda; Bucket bucket = new Bucket(this, "MyBucket"); bucket.grantReadWrite(myLambda);
Will give the Lambda's execution role permissions to read and write from the bucket.
AWS Foundational Security Best Practices
Enforcing SSL
To require all requests use Secure Socket Layer (SSL):
Bucket bucket = Bucket.Builder.create(this, "Bucket") .enforceSSL(true) .build();
To require a minimum TLS version for all requests:
Bucket bucket = Bucket.Builder.create(this, "Bucket") .enforceSSL(true) .minimumTLSVersion(1.2) .build();
Sharing buckets between stacks
To use a bucket in a different stack in the same CDK application, pass the object to the other stack:
/** * Stack that defines the bucket */ public class Producer extends Stack { public final Bucket myBucket; public Producer(Construct scope, String id) { this(scope, id, null); } public Producer(Construct scope, String id, StackProps props) { super(scope, id, props); Bucket bucket = Bucket.Builder.create(this, "MyBucket") .removalPolicy(RemovalPolicy.DESTROY) .build(); this.myBucket = bucket; } } public class ConsumerProps extends StackProps { private IBucket userBucket; public IBucket getUserBucket() { return this.userBucket; } public ConsumerProps userBucket(IBucket userBucket) { this.userBucket = userBucket; return this; } } /** * Stack that consumes the bucket */ public class Consumer extends Stack { public Consumer(Construct scope, String id, ConsumerProps props) { super(scope, id, props); User user = new User(this, "MyUser"); props.userBucket.grantReadWrite(user); } } App app = new App(); Producer producer = new Producer(app, "ProducerStack"); new Consumer(app, "ConsumerStack", new ConsumerProps().userBucket(producer.getMyBucket()));
Importing existing buckets
To import an existing bucket into your CDK application, use the Bucket.fromBucketAttributes
factory method. This method accepts BucketAttributes
which describes the properties of an already
existing bucket:
Note that this method allows importing buckets with legacy names containing underscores (_
), which was
permitted for buckets created before March 1, 2018. For buckets created after this date, underscores
are not allowed in the bucket name.
Function myLambda; IBucket bucket = Bucket.fromBucketAttributes(this, "ImportedBucket", BucketAttributes.builder() .bucketArn("arn:aws:s3:::my-bucket") .build()); // now you can just call methods on the bucket bucket.addEventNotification(EventType.OBJECT_CREATED, new LambdaDestination(myLambda), NotificationKeyFilter.builder() .prefix("home/myusername/*") .build());
Alternatively, short-hand factories are available as Bucket.fromBucketName
and
Bucket.fromBucketArn
, which will derive all bucket attributes from the bucket
name or ARN respectively:
IBucket byName = Bucket.fromBucketName(this, "BucketByName", "my-bucket"); IBucket byArn = Bucket.fromBucketArn(this, "BucketByArn", "arn:aws:s3:::my-bucket");
The bucket's region defaults to the current stack's region, but can also be explicitly set in cases where one of the bucket's regional properties needs to contain the correct values.
IBucket myCrossRegionBucket = Bucket.fromBucketAttributes(this, "CrossRegionImport", BucketAttributes.builder() .bucketArn("arn:aws:s3:::my-bucket") .region("us-east-1") .build());
Bucket Notifications
The Amazon S3 notification feature enables you to receive notifications when certain events happen in your bucket as described under S3 Bucket Notifications of the S3 Developer Guide.
To subscribe for bucket notifications, use the bucket.addEventNotification
method. The
bucket.addObjectCreatedNotification
and bucket.addObjectRemovedNotification
can also be used for
these common use cases.
The following example will subscribe an SNS topic to be notified of all s3:ObjectCreated:*
events:
Bucket bucket = new Bucket(this, "MyBucket"); Topic topic = new Topic(this, "MyTopic"); bucket.addEventNotification(EventType.OBJECT_CREATED, new SnsDestination(topic));
This call will also ensure that the topic policy can accept notifications for this specific bucket.
Supported S3 notification targets are exposed by the aws-cdk-lib/aws-s3-notifications
package.
It is also possible to specify S3 object key filters when subscribing. The
following example will notify myQueue
when objects prefixed with foo/
and
have the .jpg
suffix are removed from the bucket.
Queue myQueue; Bucket bucket = new Bucket(this, "MyBucket"); bucket.addEventNotification(EventType.OBJECT_REMOVED, new SqsDestination(myQueue), NotificationKeyFilter.builder() .prefix("foo/") .suffix(".jpg") .build());
Adding notifications on existing buckets:
Topic topic; IBucket bucket = Bucket.fromBucketAttributes(this, "ImportedBucket", BucketAttributes.builder() .bucketArn("arn:aws:s3:::my-bucket") .build()); bucket.addEventNotification(EventType.OBJECT_CREATED, new SnsDestination(topic));
If you do not want for S3 to validate permissions of Amazon SQS, Amazon SNS, and Lambda destinations you can use the notificationsSkipDestinationValidation
flag:
Queue myQueue; Bucket bucket = Bucket.Builder.create(this, "MyBucket") .notificationsSkipDestinationValidation(true) .build(); bucket.addEventNotification(EventType.OBJECT_REMOVED, new SqsDestination(myQueue));
When you add an event notification to a bucket, a custom resource is created to
manage the notifications. By default, a new role is created for the Lambda
function that implements this feature. If you want to use your own role instead,
you should provide it in the Bucket
constructor:
IRole myRole; Bucket bucket = Bucket.Builder.create(this, "MyBucket") .notificationsHandlerRole(myRole) .build();
Whatever role you provide, the CDK will try to modify it by adding the
permissions from AWSLambdaBasicExecutionRole
(an AWS managed policy) as well
as the permissions s3:PutBucketNotification
and s3:GetBucketNotification
.
If you’re passing an imported role, and you don’t want this to happen, configure
it to be immutable:
IRole importedRole = Role.fromRoleArn(this, "role", "arn:aws:iam::123456789012:role/RoleName", FromRoleArnOptions.builder() .mutable(false) .build());
If you provide an imported immutable role, make sure that it has at least all the permissions mentioned above. Otherwise, the deployment will fail!
EventBridge notifications
Amazon S3 can send events to Amazon EventBridge whenever certain events happen in your bucket. Unlike other destinations, you don't need to select which event types you want to deliver.
The following example will enable EventBridge notifications:
Bucket bucket = Bucket.Builder.create(this, "MyEventBridgeBucket") .eventBridgeEnabled(true) .build();
Block Public Access
Use blockPublicAccess
to specify block public access settings on the bucket.
Enable all block public access settings:
Bucket bucket = Bucket.Builder.create(this, "MyBlockedBucket") .blockPublicAccess(BlockPublicAccess.BLOCK_ALL) .build();
Block and ignore public ACLs:
Bucket bucket = Bucket.Builder.create(this, "MyBlockedBucket") .blockPublicAccess(BlockPublicAccess.BLOCK_ACLS) .build();
Alternatively, specify the settings manually:
Bucket bucket = Bucket.Builder.create(this, "MyBlockedBucket") .blockPublicAccess(BlockPublicAccess.Builder.create().blockPublicPolicy(true).build()) .build();
When blockPublicPolicy
is set to true
, grantPublicRead()
throws an error.
Public Read Access
Use publicReadAccess
to allow public read access to the bucket.
Note that to enable publicReadAccess
, make sure both bucket-level and account-level block public access control is disabled.
Bucket-level block public access control can be configured through blockPublicAccess
property. Account-level block public
access control can be configured on AWS Console -> S3 -> Block Public Access settings for this account (Navigation Panel).
Bucket bucket = Bucket.Builder.create(this, "Bucket") .publicReadAccess(true) .blockPublicAccess(Map.of( "blockPublicPolicy", false, "blockPublicAcls", false, "ignorePublicAcls", false, "restrictPublicBuckets", false)) .build();
Logging configuration
Use serverAccessLogsBucket
to describe where server access logs are to be stored.
Bucket accessLogsBucket = new Bucket(this, "AccessLogsBucket"); Bucket bucket = Bucket.Builder.create(this, "MyBucket") .serverAccessLogsBucket(accessLogsBucket) .build();
It's also possible to specify a prefix for Amazon S3 to assign to all log object keys.
Bucket accessLogsBucket = new Bucket(this, "AccessLogsBucket"); Bucket bucket = Bucket.Builder.create(this, "MyBucket") .serverAccessLogsBucket(accessLogsBucket) .serverAccessLogsPrefix("logs") .build();
You have two options for the log object key format.
Non-date-based partitioning
is the default log object key format and appears as follows:
[DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
Bucket accessLogsBucket = new Bucket(this, "AccessLogsBucket"); Bucket bucket = Bucket.Builder.create(this, "MyBucket") .serverAccessLogsBucket(accessLogsBucket) .serverAccessLogsPrefix("logs") // You can use a simple prefix with `TargetObjectKeyFormat.simplePrefix()`, but it is the same even if you do not specify `targetObjectKeyFormat` property. .targetObjectKeyFormat(TargetObjectKeyFormat.simplePrefix()) .build();
Another option is Date-based partitioning
.
If you choose this format, you can select either the event time or the delivery time of the log file as the date source used in the log format.
This format appears as follows:
[DestinationPrefix][SourceAccountId]/[SourceRegion]/[SourceBucket]/[YYYY]/[MM]/[DD]/[YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
Bucket accessLogsBucket = new Bucket(this, "AccessLogsBucket"); Bucket bucket = Bucket.Builder.create(this, "MyBucket") .serverAccessLogsBucket(accessLogsBucket) .serverAccessLogsPrefix("logs") .targetObjectKeyFormat(TargetObjectKeyFormat.partitionedPrefix(PartitionDateSource.EVENT_TIME)) .build();
Allowing access log delivery using a Bucket Policy (recommended)
When possible, it is recommended to use a bucket policy to grant access instead of
using ACLs. When the @aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy
feature flag
is enabled, this is done by default for server access logs. If S3 Server Access Logs
are the only logs delivered to your bucket (or if all other services logging to the
bucket support using bucket policy instead of ACLs), you can set object ownership
to bucket owner enforced, as is recommended.
Bucket accessLogsBucket = Bucket.Builder.create(this, "AccessLogsBucket") .objectOwnership(ObjectOwnership.BUCKET_OWNER_ENFORCED) .build(); Bucket bucket = Bucket.Builder.create(this, "MyBucket") .serverAccessLogsBucket(accessLogsBucket) .serverAccessLogsPrefix("logs") .build();
S3 Inventory
An inventory contains a list of the objects in the source bucket and metadata for each object. The inventory lists are stored in the destination bucket as a CSV file compressed with GZIP, as an Apache optimized row columnar (ORC) file compressed with ZLIB, or as an Apache Parquet (Parquet) file compressed with Snappy.
You can configure multiple inventory lists for a bucket. You can configure what object metadata to include in the inventory, whether to list all object versions or only current versions, where to store the inventory list file output, and whether to generate the inventory on a daily or weekly basis.
Bucket inventoryBucket = new Bucket(this, "InventoryBucket"); Bucket dataBucket = Bucket.Builder.create(this, "DataBucket") .inventories(List.of(Inventory.builder() .frequency(InventoryFrequency.DAILY) .includeObjectVersions(InventoryObjectVersion.CURRENT) .destination(InventoryDestination.builder() .bucket(inventoryBucket) .build()) .build(), Inventory.builder() .frequency(InventoryFrequency.WEEKLY) .includeObjectVersions(InventoryObjectVersion.ALL) .destination(InventoryDestination.builder() .bucket(inventoryBucket) .prefix("with-all-versions") .build()) .build())) .build();
If the destination bucket is created as part of the same CDK application, the necessary permissions will be automatically added to the bucket policy.
However, if you use an imported bucket (i.e Bucket.fromXXX()
), you'll have to make sure it contains the following policy document:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "InventoryAndAnalyticsExamplePolicy", "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "s3:PutObject", "Resource": ["arn:aws:s3:::destinationBucket/*"] } ] }
Website redirection
You can use the two following properties to specify the bucket redirection policy. Please note that these methods cannot both be applied to the same bucket.
Static redirection
You can statically redirect a to a given Bucket URL or any other host name with websiteRedirect
:
Bucket bucket = Bucket.Builder.create(this, "MyRedirectedBucket") .websiteRedirect(RedirectTarget.builder().hostName("www.example.com").build()) .build();
Routing rules
Alternatively, you can also define multiple websiteRoutingRules
, to define complex, conditional redirections:
Bucket bucket = Bucket.Builder.create(this, "MyRedirectedBucket") .websiteRoutingRules(List.of(RoutingRule.builder() .hostName("www.example.com") .httpRedirectCode("302") .protocol(RedirectProtocol.HTTPS) .replaceKey(ReplaceKey.prefixWith("test/")) .condition(RoutingRuleCondition.builder() .httpErrorCodeReturnedEquals("200") .keyPrefixEquals("prefix") .build()) .build())) .build();
Filling the bucket as part of deployment
To put files into a bucket as part of a deployment (for example, to host a
website), see the aws-cdk-lib/aws-s3-deployment
package, which provides a
resource that can do just that.
The URL for objects
S3 provides two types of URLs for accessing objects via HTTP(S). Path-Style and Virtual Hosted-Style URL. Path-Style is a classic way and will be deprecated. We recommend to use Virtual Hosted-Style URL for newly made bucket.
You can generate both of them.
Bucket bucket = new Bucket(this, "MyBucket"); bucket.urlForObject("objectname"); // Path-Style URL bucket.virtualHostedUrlForObject("objectname"); // Virtual Hosted-Style URL bucket.virtualHostedUrlForObject("objectname", VirtualHostedStyleUrlOptions.builder().regional(false).build());
Object Ownership
You can use one of following properties to specify the bucket object Ownership.
Object writer
The Uploading account will own the object.
Bucket.Builder.create(this, "MyBucket") .objectOwnership(ObjectOwnership.OBJECT_WRITER) .build();
Bucket owner preferred
The bucket owner will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. Without this setting and canned ACL, the object is uploaded and remains owned by the uploading account.
Bucket.Builder.create(this, "MyBucket") .objectOwnership(ObjectOwnership.BUCKET_OWNER_PREFERRED) .build();
Bucket owner enforced (recommended)
ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. ACLs no longer affect permissions to data in the S3 bucket. The bucket uses policies to define access control.
Bucket.Builder.create(this, "MyBucket") .objectOwnership(ObjectOwnership.BUCKET_OWNER_ENFORCED) .build();
Some services may not not support log delivery to buckets that have object ownership set to bucket owner enforced, such as S3 buckets using ACLs or CloudFront Distributions.
Bucket deletion
When a bucket is removed from a stack (or the stack is deleted), the S3
bucket will be removed according to its removal policy (which by default will
simply orphan the bucket and leave it in your AWS account). If the removal
policy is set to RemovalPolicy.DESTROY
, the bucket will be deleted as long
as it does not contain any objects.
To override this and force all objects to get deleted during bucket deletion,
enable theautoDeleteObjects
option.
When autoDeleteObjects
is enabled, s3:PutBucketPolicy
is added to the bucket policy. This is done to allow the custom resource this feature is built on to add a deny policy for s3:PutObject
to the bucket policy when a delete stack event occurs. Adding this deny policy prevents new objects from being written to the bucket. Doing this prevents race conditions with external bucket writers during the deletion process.
Bucket bucket = Bucket.Builder.create(this, "MyTempFileBucket") .removalPolicy(RemovalPolicy.DESTROY) .autoDeleteObjects(true) .build();
Warning if you have deployed a bucket with autoDeleteObjects: true
,
switching this to false
in a CDK version before 1.126.0
will lead to
all objects in the bucket being deleted. Be sure to update your bucket resources
by deploying with CDK version 1.126.0
or later before switching this value to false
.
Transfer Acceleration
Transfer Acceleration can be configured to enable fast, easy, and secure transfers of files over long distances:
Bucket bucket = Bucket.Builder.create(this, "MyBucket") .transferAcceleration(true) .build();
To access the bucket that is enabled for Transfer Acceleration, you must use a special endpoint. The URL can be generated using method transferAccelerationUrlForObject
:
Bucket bucket = Bucket.Builder.create(this, "MyBucket") .transferAcceleration(true) .build(); bucket.transferAccelerationUrlForObject("objectname");
Intelligent Tiering
Intelligent Tiering can be configured to automatically move files to glacier:
Bucket.Builder.create(this, "MyBucket") .intelligentTieringConfigurations(List.of(IntelligentTieringConfiguration.builder() .name("foo") .prefix("folder/name") .archiveAccessTierTime(Duration.days(90)) .deepArchiveAccessTierTime(Duration.days(180)) .tags(List.of(Tag.builder().key("tagname").value("tagvalue").build())) .build())) .build();
Lifecycle Rule
Managing lifecycle can be configured transition or expiration actions.
Bucket bucket = Bucket.Builder.create(this, "MyBucket") .lifecycleRules(List.of(LifecycleRule.builder() .abortIncompleteMultipartUploadAfter(Duration.minutes(30)) .enabled(false) .expiration(Duration.days(30)) .expirationDate(new Date()) .expiredObjectDeleteMarker(false) .id("id") .noncurrentVersionExpiration(Duration.days(30)) // the properties below are optional .noncurrentVersionsToRetain(123) .noncurrentVersionTransitions(List.of(NoncurrentVersionTransition.builder() .storageClass(StorageClass.GLACIER) .transitionAfter(Duration.days(30)) // the properties below are optional .noncurrentVersionsToRetain(123) .build())) .objectSizeGreaterThan(500) .prefix("prefix") .objectSizeLessThan(10000) .transitions(List.of(Transition.builder() .storageClass(StorageClass.GLACIER) // the properties below are optional .transitionAfter(Duration.days(30)) .transitionDate(new Date()) .build())) .build())) .build();
Object Lock Configuration
Object Lock can be configured to enable a write-once-read-many model for an S3 bucket. Object Lock must be configured when a bucket is created; if a bucket is created without Object Lock, it cannot be enabled later via the CDK.
Object Lock can be enabled on an S3 bucket by specifying:
Bucket bucket = Bucket.Builder.create(this, "MyBucket") .objectLockEnabled(true) .build();
Usually, it is desired to not just enable Object Lock for a bucket but to also configure a
retention mode
and a retention period.
These can be specified by providing objectLockDefaultRetention
:
// Configure for governance mode with a duration of 7 years // Configure for governance mode with a duration of 7 years Bucket.Builder.create(this, "Bucket1") .objectLockDefaultRetention(ObjectLockRetention.governance(Duration.days(7 * 365))) .build(); // Configure for compliance mode with a duration of 1 year // Configure for compliance mode with a duration of 1 year Bucket.Builder.create(this, "Bucket2") .objectLockDefaultRetention(ObjectLockRetention.compliance(Duration.days(365))) .build();
-
ClassDescriptionExample:A fluent builder for
BlockPublicAccess
.Example:A builder forBlockPublicAccessOptions
An implementation forBlockPublicAccessOptions
An S3 bucket with associated policy objects.A fluent builder forBucket
.Default bucket access control types.A reference to a bucket outside this stack.A builder forBucketAttributes
An implementation forBucketAttributes
Represents an S3 Bucket.What kind of server-side encryption to apply to this bucket.Specifies a metrics configuration for the CloudWatch request metrics from an Amazon S3 bucket.A builder forBucketMetrics
An implementation forBucketMetrics
Represents the properties of a notification destination.A builder forBucketNotificationDestinationConfig
An implementation forBucketNotificationDestinationConfig
Supported types of notification destinations.The bucket policy for an Amazon S3 bucket.A fluent builder forBucketPolicy
.Example:A builder forBucketPolicyProps
An implementation forBucketPolicyProps
Example:A builder forBucketProps
An implementation forBucketProps
TheAWS::S3::AccessGrant
resource creates an access grant that gives a grantee access to your S3 data.The configuration options of the S3 Access Grants location.A builder forCfnAccessGrant.AccessGrantsLocationConfigurationProperty
An implementation forCfnAccessGrant.AccessGrantsLocationConfigurationProperty
A fluent builder forCfnAccessGrant
.The user, group, or role to which you are granting access.A builder forCfnAccessGrant.GranteeProperty
An implementation forCfnAccessGrant.GranteeProperty
Properties for defining aCfnAccessGrant
.A builder forCfnAccessGrantProps
An implementation forCfnAccessGrantProps
TheAWS::S3::AccessGrantInstance
resource creates an S3 Access Grants instance, which serves as a logical grouping for access grants.A fluent builder forCfnAccessGrantsInstance
.Properties for defining aCfnAccessGrantsInstance
.A builder forCfnAccessGrantsInstanceProps
An implementation forCfnAccessGrantsInstanceProps
TheAWS::S3::AccessGrantsLocation
resource creates the S3 data location that you would like to register in your S3 Access Grants instance.A fluent builder forCfnAccessGrantsLocation
.Properties for defining aCfnAccessGrantsLocation
.A builder forCfnAccessGrantsLocationProps
An implementation forCfnAccessGrantsLocationProps
The AWS::S3::AccessPoint resource is an Amazon S3 resource type that you can use to access buckets.A fluent builder forCfnAccessPoint
.The PublicAccessBlock configuration that you want to apply to this Amazon S3 bucket.A builder forCfnAccessPoint.PublicAccessBlockConfigurationProperty
An implementation forCfnAccessPoint.PublicAccessBlockConfigurationProperty
The Virtual Private Cloud (VPC) configuration for this access point.A builder forCfnAccessPoint.VpcConfigurationProperty
An implementation forCfnAccessPoint.VpcConfigurationProperty
Properties for defining aCfnAccessPoint
.A builder forCfnAccessPointProps
An implementation forCfnAccessPointProps
TheAWS::S3::Bucket
resource creates an Amazon S3 bucket in the same AWS Region where you create the AWS CloudFormation stack.Specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload.A builder forCfnBucket.AbortIncompleteMultipartUploadProperty
An implementation forCfnBucket.AbortIncompleteMultipartUploadProperty
Configures the transfer acceleration state for an Amazon S3 bucket.A builder forCfnBucket.AccelerateConfigurationProperty
An implementation forCfnBucket.AccelerateConfigurationProperty
Specify this only in a cross-account scenario (where source and destination bucket owners are not the same), and you want to change replica ownership to the AWS account that owns the destination bucket.A builder forCfnBucket.AccessControlTranslationProperty
An implementation forCfnBucket.AccessControlTranslationProperty
Specifies the configuration and any analyses for the analytics filter of an Amazon S3 bucket.A builder forCfnBucket.AnalyticsConfigurationProperty
An implementation forCfnBucket.AnalyticsConfigurationProperty
Specifies default encryption for a bucket using server-side encryption with Amazon S3-managed keys (SSE-S3), AWS KMS-managed keys (SSE-KMS), or dual-layer server-side encryption with KMS-managed keys (DSSE-KMS).A builder forCfnBucket.BucketEncryptionProperty
An implementation forCfnBucket.BucketEncryptionProperty
A fluent builder forCfnBucket
.Describes the cross-origin access configuration for objects in an Amazon S3 bucket.A builder forCfnBucket.CorsConfigurationProperty
An implementation forCfnBucket.CorsConfigurationProperty
Specifies a cross-origin access rule for an Amazon S3 bucket.A builder forCfnBucket.CorsRuleProperty
An implementation forCfnBucket.CorsRuleProperty
Specifies how data related to the storage class analysis for an Amazon S3 bucket should be exported.A builder forCfnBucket.DataExportProperty
An implementation forCfnBucket.DataExportProperty
The container element for optionally specifying the default Object Lock retention settings for new objects placed in the specified bucket.A builder forCfnBucket.DefaultRetentionProperty
An implementation forCfnBucket.DefaultRetentionProperty
Specifies whether Amazon S3 replicates delete markers.A builder forCfnBucket.DeleteMarkerReplicationProperty
An implementation forCfnBucket.DeleteMarkerReplicationProperty
Specifies information about where to publish analysis or configuration results for an Amazon S3 bucket.A builder forCfnBucket.DestinationProperty
An implementation forCfnBucket.DestinationProperty
Specifies encryption-related information for an Amazon S3 bucket that is a destination for replicated objects.A builder forCfnBucket.EncryptionConfigurationProperty
An implementation forCfnBucket.EncryptionConfigurationProperty
Amazon S3 can send events to Amazon EventBridge whenever certain events happen in your bucket, see Using EventBridge in the Amazon S3 User Guide .A builder forCfnBucket.EventBridgeConfigurationProperty
An implementation forCfnBucket.EventBridgeConfigurationProperty
Specifies the Amazon S3 object key name to filter on.A builder forCfnBucket.FilterRuleProperty
An implementation forCfnBucket.FilterRuleProperty
Specifies the S3 Intelligent-Tiering configuration for an Amazon S3 bucket.A builder forCfnBucket.IntelligentTieringConfigurationProperty
An implementation forCfnBucket.IntelligentTieringConfigurationProperty
Specifies the inventory configuration for an Amazon S3 bucket.A builder forCfnBucket.InventoryConfigurationProperty
An implementation forCfnBucket.InventoryConfigurationProperty
Describes the AWS Lambda functions to invoke and the events for which to invoke them.A builder forCfnBucket.LambdaConfigurationProperty
An implementation forCfnBucket.LambdaConfigurationProperty
Specifies the lifecycle configuration for objects in an Amazon S3 bucket.A builder forCfnBucket.LifecycleConfigurationProperty
An implementation forCfnBucket.LifecycleConfigurationProperty
Describes where logs are stored and the prefix that Amazon S3 assigns to all log object keys for a bucket.A builder forCfnBucket.LoggingConfigurationProperty
An implementation forCfnBucket.LoggingConfigurationProperty
Specifies a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from an Amazon S3 bucket.A builder forCfnBucket.MetricsConfigurationProperty
An implementation forCfnBucket.MetricsConfigurationProperty
A container specifying replication metrics-related settings enabling replication metrics and events.A builder forCfnBucket.MetricsProperty
An implementation forCfnBucket.MetricsProperty
Specifies when noncurrent object versions expire.A builder forCfnBucket.NoncurrentVersionExpirationProperty
An implementation forCfnBucket.NoncurrentVersionExpirationProperty
Container for the transition rule that describes when noncurrent objects transition to theSTANDARD_IA
,ONEZONE_IA
,INTELLIGENT_TIERING
,GLACIER_IR
,GLACIER
, orDEEP_ARCHIVE
storage class.A builder forCfnBucket.NoncurrentVersionTransitionProperty
An implementation forCfnBucket.NoncurrentVersionTransitionProperty
Describes the notification configuration for an Amazon S3 bucket.A builder forCfnBucket.NotificationConfigurationProperty
An implementation forCfnBucket.NotificationConfigurationProperty
Specifies object key name filtering rules.A builder forCfnBucket.NotificationFilterProperty
An implementation forCfnBucket.NotificationFilterProperty
Places an Object Lock configuration on the specified bucket.A builder forCfnBucket.ObjectLockConfigurationProperty
An implementation forCfnBucket.ObjectLockConfigurationProperty
Specifies the Object Lock rule for the specified object.A builder forCfnBucket.ObjectLockRuleProperty
An implementation forCfnBucket.ObjectLockRuleProperty
Specifies the container element for Object Ownership rules.A builder forCfnBucket.OwnershipControlsProperty
An implementation forCfnBucket.OwnershipControlsProperty
Specifies an Object Ownership rule.A builder forCfnBucket.OwnershipControlsRuleProperty
An implementation forCfnBucket.OwnershipControlsRuleProperty
Amazon S3 keys for log objects are partitioned in the following format:.A builder forCfnBucket.PartitionedPrefixProperty
An implementation forCfnBucket.PartitionedPrefixProperty
The PublicAccessBlock configuration that you want to apply to this Amazon S3 bucket.A builder forCfnBucket.PublicAccessBlockConfigurationProperty
An implementation forCfnBucket.PublicAccessBlockConfigurationProperty
Specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.A builder forCfnBucket.QueueConfigurationProperty
An implementation forCfnBucket.QueueConfigurationProperty
Specifies the redirect behavior of all requests to a website endpoint of an Amazon S3 bucket.A builder forCfnBucket.RedirectAllRequestsToProperty
An implementation forCfnBucket.RedirectAllRequestsToProperty
Specifies how requests are redirected.A builder forCfnBucket.RedirectRuleProperty
An implementation forCfnBucket.RedirectRuleProperty
A filter that you can specify for selection for modifications on replicas.A builder forCfnBucket.ReplicaModificationsProperty
An implementation forCfnBucket.ReplicaModificationsProperty
A container for replication rules.A builder forCfnBucket.ReplicationConfigurationProperty
An implementation forCfnBucket.ReplicationConfigurationProperty
A container for information about the replication destination and its configurations including enabling the S3 Replication Time Control (S3 RTC).A builder forCfnBucket.ReplicationDestinationProperty
An implementation forCfnBucket.ReplicationDestinationProperty
A container for specifying rule filters.A builder forCfnBucket.ReplicationRuleAndOperatorProperty
An implementation forCfnBucket.ReplicationRuleAndOperatorProperty
A filter that identifies the subset of objects to which the replication rule applies.A builder forCfnBucket.ReplicationRuleFilterProperty
An implementation forCfnBucket.ReplicationRuleFilterProperty
Specifies which Amazon S3 objects to replicate and where to store the replicas.A builder forCfnBucket.ReplicationRuleProperty
An implementation forCfnBucket.ReplicationRuleProperty
A container specifying S3 Replication Time Control (S3 RTC) related information, including whether S3 RTC is enabled and the time when all objects and operations on objects must be replicated.A builder forCfnBucket.ReplicationTimeProperty
An implementation forCfnBucket.ReplicationTimeProperty
A container specifying the time value for S3 Replication Time Control (S3 RTC) and replication metricsEventThreshold
.A builder forCfnBucket.ReplicationTimeValueProperty
An implementation forCfnBucket.ReplicationTimeValueProperty
A container for describing a condition that must be met for the specified redirect to apply.A builder forCfnBucket.RoutingRuleConditionProperty
An implementation forCfnBucket.RoutingRuleConditionProperty
Specifies the redirect behavior and when a redirect is applied.A builder forCfnBucket.RoutingRuleProperty
An implementation forCfnBucket.RoutingRuleProperty
Specifies lifecycle rules for an Amazon S3 bucket.A builder forCfnBucket.RuleProperty
An implementation forCfnBucket.RuleProperty
A container for object key name prefix and suffix filtering rules.A builder forCfnBucket.S3KeyFilterProperty
An implementation forCfnBucket.S3KeyFilterProperty
Describes the default server-side encryption to apply to new objects in the bucket.A builder forCfnBucket.ServerSideEncryptionByDefaultProperty
An implementation forCfnBucket.ServerSideEncryptionByDefaultProperty
Specifies the default server-side encryption configuration.A builder forCfnBucket.ServerSideEncryptionRuleProperty
An implementation forCfnBucket.ServerSideEncryptionRuleProperty
A container that describes additional filters for identifying the source objects that you want to replicate.A builder forCfnBucket.SourceSelectionCriteriaProperty
An implementation forCfnBucket.SourceSelectionCriteriaProperty
A container for filter information for the selection of S3 objects encrypted with AWS KMS.A builder forCfnBucket.SseKmsEncryptedObjectsProperty
An implementation forCfnBucket.SseKmsEncryptedObjectsProperty
Specifies data related to access patterns to be collected and made available to analyze the tradeoffs between different storage classes for an Amazon S3 bucket.A builder forCfnBucket.StorageClassAnalysisProperty
An implementation forCfnBucket.StorageClassAnalysisProperty
Specifies tags to use to identify a subset of objects for an Amazon S3 bucket.A builder forCfnBucket.TagFilterProperty
An implementation forCfnBucket.TagFilterProperty
Amazon S3 key format for log objects.A builder forCfnBucket.TargetObjectKeyFormatProperty
An implementation forCfnBucket.TargetObjectKeyFormatProperty
The S3 Intelligent-Tiering storage class is designed to optimize storage costs by automatically moving data to the most cost-effective storage access tier, without additional operational overhead.A builder forCfnBucket.TieringProperty
An implementation forCfnBucket.TieringProperty
A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.A builder forCfnBucket.TopicConfigurationProperty
An implementation forCfnBucket.TopicConfigurationProperty
Specifies when an object transitions to a specified storage class.A builder forCfnBucket.TransitionProperty
An implementation forCfnBucket.TransitionProperty
Describes the versioning state of an Amazon S3 bucket.A builder forCfnBucket.VersioningConfigurationProperty
An implementation forCfnBucket.VersioningConfigurationProperty
Specifies website configuration parameters for an Amazon S3 bucket.A builder forCfnBucket.WebsiteConfigurationProperty
An implementation forCfnBucket.WebsiteConfigurationProperty
Applies an Amazon S3 bucket policy to an Amazon S3 bucket.A fluent builder forCfnBucketPolicy
.Properties for defining aCfnBucketPolicy
.A builder forCfnBucketPolicyProps
An implementation forCfnBucketPolicyProps
Properties for defining aCfnBucket
.A builder forCfnBucketProps
An implementation forCfnBucketProps
TheAWS::S3::MultiRegionAccessPoint
resource creates an Amazon S3 Multi-Region Access Point.A fluent builder forCfnMultiRegionAccessPoint
.The PublicAccessBlock configuration that you want to apply to this Amazon S3 Multi-Region Access Point.An implementation forCfnMultiRegionAccessPoint.PublicAccessBlockConfigurationProperty
A bucket associated with a specific Region when creating Multi-Region Access Points.A builder forCfnMultiRegionAccessPoint.RegionProperty
An implementation forCfnMultiRegionAccessPoint.RegionProperty
Applies an Amazon S3 access policy to an Amazon S3 Multi-Region Access Point.A fluent builder forCfnMultiRegionAccessPointPolicy
.The container element for a bucket's policy status.A builder forCfnMultiRegionAccessPointPolicy.PolicyStatusProperty
An implementation forCfnMultiRegionAccessPointPolicy.PolicyStatusProperty
Properties for defining aCfnMultiRegionAccessPointPolicy
.A builder forCfnMultiRegionAccessPointPolicyProps
An implementation forCfnMultiRegionAccessPointPolicyProps
Properties for defining aCfnMultiRegionAccessPoint
.A builder forCfnMultiRegionAccessPointProps
An implementation forCfnMultiRegionAccessPointProps
The AWS::S3::StorageLens resource creates an Amazon S3 Storage Lens configuration.This resource contains the details of the account-level metrics for Amazon S3 Storage Lens.A builder forCfnStorageLens.AccountLevelProperty
An implementation forCfnStorageLens.AccountLevelProperty
This resource enables Amazon S3 Storage Lens activity metrics.A builder forCfnStorageLens.ActivityMetricsProperty
An implementation forCfnStorageLens.ActivityMetricsProperty
This resource enables Amazon S3 Storage Lens advanced cost optimization metrics.A builder forCfnStorageLens.AdvancedCostOptimizationMetricsProperty
An implementation forCfnStorageLens.AdvancedCostOptimizationMetricsProperty
This resource enables Amazon S3 Storage Lens advanced data protection metrics.A builder forCfnStorageLens.AdvancedDataProtectionMetricsProperty
An implementation forCfnStorageLens.AdvancedDataProtectionMetricsProperty
This resource contains the details of the AWS Organization for Amazon S3 Storage Lens.A builder forCfnStorageLens.AwsOrgProperty
An implementation forCfnStorageLens.AwsOrgProperty
A property for the bucket-level storage metrics for Amazon S3 Storage Lens.A builder forCfnStorageLens.BucketLevelProperty
An implementation forCfnStorageLens.BucketLevelProperty
This resource contains the details of the buckets and Regions for the Amazon S3 Storage Lens configuration.A builder forCfnStorageLens.BucketsAndRegionsProperty
An implementation forCfnStorageLens.BucketsAndRegionsProperty
A fluent builder forCfnStorageLens
.This resource enables the Amazon CloudWatch publishing option for Amazon S3 Storage Lens metrics.A builder forCfnStorageLens.CloudWatchMetricsProperty
An implementation forCfnStorageLens.CloudWatchMetricsProperty
This resource contains the details of the Amazon S3 Storage Lens metrics export.A builder forCfnStorageLens.DataExportProperty
An implementation forCfnStorageLens.DataExportProperty
This resource enables Amazon S3 Storage Lens detailed status code metrics.A builder forCfnStorageLens.DetailedStatusCodesMetricsProperty
An implementation forCfnStorageLens.DetailedStatusCodesMetricsProperty
This resource contains the type of server-side encryption used to encrypt an Amazon S3 Storage Lens metrics export.A builder forCfnStorageLens.EncryptionProperty
An implementation forCfnStorageLens.EncryptionProperty
This resource contains the details of the prefix-level of the Amazon S3 Storage Lens.A builder forCfnStorageLens.PrefixLevelProperty
An implementation forCfnStorageLens.PrefixLevelProperty
This resource contains the details of the prefix-level storage metrics for Amazon S3 Storage Lens.A builder forCfnStorageLens.PrefixLevelStorageMetricsProperty
An implementation forCfnStorageLens.PrefixLevelStorageMetricsProperty
This resource contains the details of the bucket where the Amazon S3 Storage Lens metrics export will be placed.A builder forCfnStorageLens.S3BucketDestinationProperty
An implementation forCfnStorageLens.S3BucketDestinationProperty
This resource contains the details of the Amazon S3 Storage Lens selection criteria.A builder forCfnStorageLens.SelectionCriteriaProperty
An implementation forCfnStorageLens.SelectionCriteriaProperty
Specifies the use of server-side encryption using an AWS Key Management Service key (SSE-KMS) to encrypt the delivered S3 Storage Lens metrics export file.A builder forCfnStorageLens.SSEKMSProperty
An implementation forCfnStorageLens.SSEKMSProperty
This is the property of the Amazon S3 Storage Lens configuration.A builder forCfnStorageLens.StorageLensConfigurationProperty
An implementation forCfnStorageLens.StorageLensConfigurationProperty
This resource determines the scope of Storage Lens group data that is displayed in the Storage Lens dashboard.A builder forCfnStorageLens.StorageLensGroupLevelProperty
An implementation forCfnStorageLens.StorageLensGroupLevelProperty
This resource indicates which Storage Lens group ARNs to include or exclude in the Storage Lens group aggregation.A builder forCfnStorageLens.StorageLensGroupSelectionCriteriaProperty
An implementation forCfnStorageLens.StorageLensGroupSelectionCriteriaProperty
TheAWS::S3::StorageLensGroup
resource creates an S3 Storage Lens group.This resource is a logical operator that allows multiple filter conditions to be joined for more complex comparisons of Storage Lens group data.A builder forCfnStorageLensGroup.AndProperty
An implementation forCfnStorageLensGroup.AndProperty
A fluent builder forCfnStorageLensGroup
.This resource sets the criteria for the Storage Lens group data that is displayed.A builder forCfnStorageLensGroup.FilterProperty
An implementation forCfnStorageLensGroup.FilterProperty
This resource containsDaysGreaterThan
andDaysLessThan
to define the object age range (minimum and maximum number of days).A builder forCfnStorageLensGroup.MatchObjectAgeProperty
An implementation forCfnStorageLensGroup.MatchObjectAgeProperty
This resource filters objects that match the specified object size range.A builder forCfnStorageLensGroup.MatchObjectSizeProperty
An implementation forCfnStorageLensGroup.MatchObjectSizeProperty
This resource contains theOr
logical operator, which allows multiple filter conditions to be joined for more complex comparisons of Storage Lens group data.A builder forCfnStorageLensGroup.OrProperty
An implementation forCfnStorageLensGroup.OrProperty
Properties for defining aCfnStorageLensGroup
.A builder forCfnStorageLensGroupProps
An implementation forCfnStorageLensGroupProps
Properties for defining aCfnStorageLens
.A builder forCfnStorageLensProps
An implementation forCfnStorageLensProps
Specifies a cross-origin access rule for an Amazon S3 bucket.A builder forCorsRule
An implementation forCorsRule
Notification event types.All http request methods.Internal default implementation forIBucket
.A proxy class which represents a concrete javascript instance of this type.Implemented by constructs that can be used as bucket notification destinations.Internal default implementation forIBucketNotificationDestination
.A proxy class which represents a concrete javascript instance of this type.The intelligent tiering configuration.A builder forIntelligentTieringConfiguration
An implementation forIntelligentTieringConfiguration
Specifies the inventory configuration of an S3 Bucket.A builder forInventory
An implementation forInventory
The destination of the inventory.A builder forInventoryDestination
An implementation forInventoryDestination
All supported inventory list formats.All supported inventory frequencies.Inventory version support.Declaration of a Life cycle rule.A builder forLifecycleRule
An implementation forLifecycleRule
An interface that represents the location of a specific object in an S3 Bucket.A builder forLocation
An implementation forLocation
Describes when noncurrent versions transition to a specified storage class.A builder forNoncurrentVersionTransition
An implementation forNoncurrentVersionTransition
Example:A builder forNotificationKeyFilter
An implementation forNotificationKeyFilter
Modes in which S3 Object Lock retention can be configured.The default retention settings for an S3 Object Lock configuration.The ObjectOwnership of the bucket.Options for the onCloudTrailPutObject method.A builder forOnCloudTrailBucketEventOptions
An implementation forOnCloudTrailBucketEventOptions
The date source for the partitioned prefix.All http request methods.Specifies a redirect behavior of all requests to a website endpoint of a bucket.A builder forRedirectTarget
An implementation forRedirectTarget
Example:Rule that define when a redirect is applied and the redirect behavior.A builder forRoutingRule
An implementation forRoutingRule
Example:A builder forRoutingRuleCondition
An implementation forRoutingRuleCondition
Storage class to move an object to.Tag.A builder forTag
An implementation forTag
The key format for the log object.Options for creating a Transfer Acceleration URL.A builder forTransferAccelerationUrlOptions
An implementation forTransferAccelerationUrlOptions
Describes when an object transitions to a specified storage class.A builder forTransition
An implementation forTransition
Options for creating Virtual-Hosted style URL.A builder forVirtualHostedStyleUrlOptions
An implementation forVirtualHostedStyleUrlOptions