aws-cdk-lib.aws_s3_assets

AWS CDK Assets

Assets are local files or directories which are needed by a CDK app. A common example is a directory which contains the handler code for a Lambda function, but assets can represent any artifact that is needed for the app's operation.

When deploying a CDK app that includes constructs with assets, the CDK toolkit will first upload all the assets to S3, and only then deploy the stacks. The S3 locations of the uploaded assets will be passed in as CloudFormation Parameters to the relevant stacks.

The following JavaScript example defines a directory asset which is archived as a .zip file and uploaded to S3 during deployment.

const asset = new assets.Asset(this, 'SampleAsset', {
  path: path.join(__dirname, 'sample-asset-directory'),
});

asset = assets.Asset(self, "SampleAsset",
    path=path.join(__dirname, "sample-asset-directory")
)

Asset asset = Asset.Builder.create(this, "SampleAsset")
        .path(join(__dirname, "sample-asset-directory"))
        .build();

var asset = new Asset(this, "SampleAsset", new AssetProps {
    Path = Join(__dirname, "sample-asset-directory")
});

asset := assets.NewAsset(this, jsii.String("SampleAsset"), &AssetProps{
	Path: path.join(__dirname, jsii.String("sample-asset-directory")),
})

The following JavaScript example defines a file asset, which is uploaded as-is to an S3 bucket during deployment.

    const asset = new assets.Asset(this, 'SampleAsset', {
      path: path.join(__dirname, 'file-asset.txt'),

      // Optional: describe the purpose of the asset with a human-readable string
      displayName: 'My file',
    });

asset = assets.Asset(self, "SampleAsset",
    path=path.join(__dirname, "file-asset.txt"),

    # Optional: describe the purpose of the asset with a human-readable string
    display_name="My file"
)

Asset asset = Asset.Builder.create(this, "SampleAsset")
        .path(join(__dirname, "file-asset.txt"))

        // Optional: describe the purpose of the asset with a human-readable string
        .displayName("My file")
        .build();

var asset = new Asset(this, "SampleAsset", new AssetProps {
    Path = Join(__dirname, "file-asset.txt"),

    // Optional: describe the purpose of the asset with a human-readable string
    DisplayName = "My file"
});

asset := assets.NewAsset(this, jsii.String("SampleAsset"), &AssetProps{
	Path: path.join(__dirname, jsii.String("file-asset.txt")),

	// Optional: describe the purpose of the asset with a human-readable string
	DisplayName: jsii.String("My file"),
})

Attributes

Asset constructs expose the following deploy-time attributes:

• s3BucketName - the name of the assets S3 bucket.
• s3ObjectKey - the S3 object key of the asset file (whether it's a file or a zip archive)
• s3ObjectUrl - the S3 object URL of the asset (i.e. s3://amzn-s3-demo-bucket/mykey.zip)
• httpUrl - the S3 HTTP URL of the asset (i.e. https://s3.us-east-1.amazonaws.com/amzn-s3-demo-bucket/mykey.zip)

In the following example, the various asset attributes are exported as stack outputs:

    const asset = new assets.Asset(this, 'SampleAsset', {
      path: path.join(__dirname, 'sample-asset-directory'),
    });

    new cdk.CfnOutput(this, 'S3BucketName', { value: asset.s3BucketName });
    new cdk.CfnOutput(this, 'S3ObjectKey', { value: asset.s3ObjectKey });
    new cdk.CfnOutput(this, 'S3HttpURL', { value: asset.httpUrl });
    new cdk.CfnOutput(this, 'S3ObjectURL', { value: asset.s3ObjectUrl });

asset = assets.Asset(self, "SampleAsset",
    path=path.join(__dirname, "sample-asset-directory")
)

cdk.CfnOutput(self, "S3BucketName", value=asset.s3_bucket_name)
cdk.CfnOutput(self, "S3ObjectKey", value=asset.s3_object_key)
cdk.CfnOutput(self, "S3HttpURL", value=asset.http_url)
cdk.CfnOutput(self, "S3ObjectURL", value=asset.s3_object_url)

Asset asset = Asset.Builder.create(this, "SampleAsset")
        .path(join(__dirname, "sample-asset-directory"))
        .build();

CfnOutput.Builder.create(this, "S3BucketName").value(asset.getS3BucketName()).build();
CfnOutput.Builder.create(this, "S3ObjectKey").value(asset.getS3ObjectKey()).build();
CfnOutput.Builder.create(this, "S3HttpURL").value(asset.getHttpUrl()).build();
CfnOutput.Builder.create(this, "S3ObjectURL").value(asset.getS3ObjectUrl()).build();

var asset = new Asset(this, "SampleAsset", new AssetProps {
    Path = Join(__dirname, "sample-asset-directory")
});

new CfnOutput(this, "S3BucketName", new CfnOutputProps { Value = asset.S3BucketName });
new CfnOutput(this, "S3ObjectKey", new CfnOutputProps { Value = asset.S3ObjectKey });
new CfnOutput(this, "S3HttpURL", new CfnOutputProps { Value = asset.HttpUrl });
new CfnOutput(this, "S3ObjectURL", new CfnOutputProps { Value = asset.S3ObjectUrl });

asset := assets.NewAsset(this, jsii.String("SampleAsset"), &AssetProps{
	Path: path.join(__dirname, jsii.String("sample-asset-directory")),
})

cdk.NewCfnOutput(this, jsii.String("S3BucketName"), &CfnOutputProps{
	Value: asset.S3BucketName,
})
cdk.NewCfnOutput(this, jsii.String("S3ObjectKey"), &CfnOutputProps{
	Value: asset.S3ObjectKey,
})
cdk.NewCfnOutput(this, jsii.String("S3HttpURL"), &CfnOutputProps{
	Value: asset.HttpUrl,
})
cdk.NewCfnOutput(this, jsii.String("S3ObjectURL"), &CfnOutputProps{
	Value: asset.S3ObjectUrl,
})

Permissions

IAM roles, users or groups which need to be able to read assets in runtime will should be granted IAM permissions. To do that use the asset.grantRead(principal) method:

The following example grants an IAM group read permissions on an asset:

const group = new iam.Group(this, 'MyUserGroup');
asset.grantRead(group);

group = iam.Group(self, "MyUserGroup")
asset.grant_read(group)

Group group = new Group(this, "MyUserGroup");
asset.grantRead(group);

var group = new Group(this, "MyUserGroup");
asset.GrantRead(group);

group := iam.NewGroup(this, jsii.String("MyUserGroup"))
asset.GrantRead(group)

How does it work

When an asset is defined in a construct, a construct metadata entry aws:cdk:asset is emitted with instructions on where to find the asset and what type of packaging to perform (zip or file). Furthermore, the synthesized CloudFormation template will also include two CloudFormation parameters: one for the asset's bucket and one for the asset S3 key. Those parameters are used to reference the deploy-time values of the asset (using { Ref: "Param" }).

Then, when the stack is deployed, the toolkit will package the asset (i.e. zip the directory), calculate an MD5 hash of the contents and will render an S3 key for this asset within the toolkit's asset store. If the file doesn't exist in the asset store, it is uploaded during deployment.

The toolkit's asset store is an S3 bucket created by the toolkit for each environment the toolkit operates in (environment = account + region).

Now, when the toolkit deploys the stack, it will set the relevant CloudFormation Parameters to point to the actual bucket and key for each asset.

Asset Bundling

When defining an asset, you can use the bundling option to specify a command to run inside a docker container. The command can read the contents of the asset source from /asset-input and is expected to write files under /asset-output (directories mapped inside the container). The files under /asset-output will be zipped and uploaded to S3 as the asset.

The following example uses custom asset bundling to convert a markdown file to html:

const asset = new assets.Asset(this, 'BundledAsset', {
  path: path.join(__dirname, 'markdown-asset'), // /asset-input and working directory in the container
  bundling: {
    image: DockerImage.fromBuild(path.join(__dirname, 'alpine-markdown')), // Build an image
    command: [
      'sh', '-c', `
        markdown index.md > /asset-output/index.html
      `,
    ],
  },
});

asset = assets.Asset(self, "BundledAsset",
    path=path.join(__dirname, "markdown-asset"),  # /asset-input and working directory in the container
    bundling=assets.BundlingOptions(
        image=DockerImage.from_build(path.join(__dirname, "alpine-markdown")),  # Build an image
        command=["sh", "-c", """
                        markdown index.md > /asset-output/index.html
                      """
        ]
    )
)

Asset asset = Asset.Builder.create(this, "BundledAsset")
        .path(join(__dirname, "markdown-asset")) // /asset-input and working directory in the container
        .bundling(BundlingOptions.builder()
                .image(DockerImage.fromBuild(join(__dirname, "alpine-markdown"))) // Build an image
                .command(List.of("sh", "-c", "\n            markdown index.md > /asset-output/index.html\n          "))
                .build())
        .build();

var asset = new Asset(this, "BundledAsset", new AssetProps {
    Path = Join(__dirname, "markdown-asset"),  // /asset-input and working directory in the container
    Bundling = new BundlingOptions {
        Image = DockerImage.FromBuild(Join(__dirname, "alpine-markdown")),  // Build an image
        Command = new [] { "sh", "-c", @"
                        markdown index.md > /asset-output/index.html
                      " }
    }
});

asset := assets.NewAsset(this, jsii.String("BundledAsset"), &AssetProps{
	Path: path.join(__dirname, jsii.String("markdown-asset")),
	 // /asset-input and working directory in the container
	Bundling: &BundlingOptions{
		Image: awscdk.DockerImage_FromBuild(path.join(__dirname, jsii.String("alpine-markdown"))),
		 // Build an image
		Command: []*string{
			jsii.String("sh"),
			jsii.String("-c"),
			jsii.String(`
			            markdown index.md > /asset-output/index.html
			          `),
		},
	},
})

The bundling docker image (image) can either come from a registry (DockerImage.fromRegistry) or it can be built from a Dockerfile located inside your project (DockerImage.fromBuild).

You can set the CDK_DOCKER environment variable in order to provide a custom docker program to execute. This may sometime be needed when building in environments where the standard docker cannot be executed (see https://github.com/aws/aws-cdk/issues/8460 for details).

Use local to specify a local bundling provider. The provider implements a method tryBundle() which should return true if local bundling was performed. If false is returned, docker bundling will be done:

import * as cdk from 'aws-cdk-lib';

class MyBundle implements cdk.ILocalBundling {
  public tryBundle(outputDir: string, options: cdk.BundlingOptions) {
    const canRunLocally = true // replace with actual logic
    if (canRunLocally) {
      // perform local bundling here
      return true;
    }
    return false;
  }
}

new Asset(this, 'BundledAsset', {
  path: '/path/to/asset',
  bundling: {
    local: new MyBundle(),
    // Docker bundling fallback
    image: cdk.DockerImage.fromRegistry('alpine'),
    entrypoint: ['/bin/sh', '-c'],
    command: ['bundle'],
  },
});

import aws_cdk as cdk


@jsii.implements(cdk.ILocalBundling)
class MyBundle:
    def try_bundle(self, output_dir, *, image, entrypoint=None, command=None, volumes=None, volumesFrom=None, environment=None, workingDirectory=None, user=None, local=None, outputType=None, securityOpt=None, network=None, bundlingFileAccess=None, platform=None):
        can_run_locally = True # replace with actual logic
        if can_run_locally:
            # perform local bundling here
            return True
        return False

Asset(self, "BundledAsset",
    path="/path/to/asset",
    bundling=cdk.BundlingOptions(
        local=MyBundle(),
        # Docker bundling fallback
        image=cdk.DockerImage.from_registry("alpine"),
        entrypoint=["/bin/sh", "-c"],
        command=["bundle"]
    )
)

import software.amazon.awscdk.*;


public class MyBundle implements ILocalBundling {
    public boolean tryBundle(String outputDir, BundlingOptions options) {
        boolean canRunLocally = true; // replace with actual logic
        if (canRunLocally) {
            // perform local bundling here
            return true;
        }
        return false;
    }
}

Asset.Builder.create(this, "BundledAsset")
        .path("/path/to/asset")
        .bundling(BundlingOptions.builder()
                .local(new MyBundle())
                // Docker bundling fallback
                .image(DockerImage.fromRegistry("alpine"))
                .entrypoint(List.of("/bin/sh", "-c"))
                .command(List.of("bundle"))
                .build())
        .build();

using Amazon.CDK;


class MyBundle : ILocalBundling
{
    public boolean TryBundle(string outputDir, BundlingOptions options)
    {
        var canRunLocally = true; // replace with actual logic
        if (canRunLocally)
        {
            // perform local bundling here
            return true;
        }
        return false;
    }
}

new Asset(this, "BundledAsset", new AssetProps {
    Path = "/path/to/asset",
    Bundling = new BundlingOptions {
        Local = new MyBundle(),
        // Docker bundling fallback
        Image = DockerImage.FromRegistry("alpine"),
        Entrypoint = new [] { "/bin/sh", "-c" },
        Command = new [] { "bundle" }
    }
});

import "github.com/aws/aws-cdk-go/awscdk"


type myBundle struct {
}

func (this *myBundle) tryBundle(outputDir *string, options BundlingOptions) *bool {
	canRunLocally := true // replace with actual logic
	if canRunLocally {
		// perform local bundling here
		return jsii.Boolean(true)
	}
	return jsii.Boolean(false)
}

awscdk.NewAsset(this, jsii.String("BundledAsset"), &AssetProps{
	Path: jsii.String("/path/to/asset"),
	Bundling: &BundlingOptions{
		Local: NewMyBundle(),
		// Docker bundling fallback
		Image: cdk.DockerImage_FromRegistry(jsii.String("alpine")),
		Entrypoint: []*string{
			jsii.String("/bin/sh"),
			jsii.String("-c"),
		},
		Command: []*string{
			jsii.String("bundle"),
		},
	},
})

Although optional, it's recommended to provide a local bundling method which can greatly improve performance.

If the bundling output contains a single archive file (zip or jar) it will be uploaded to S3 as-is and will not be zipped. Otherwise the contents of the output directory will be zipped and the zip file will be uploaded to S3. This is the default behavior for bundling.outputType (BundlingOutput.AUTO_DISCOVER).

Use BundlingOutput.NOT_ARCHIVED if the bundling output must always be zipped:

import * as cdk from 'aws-cdk-lib';

const asset = new Asset(this, 'BundledAsset', {
  path: '/path/to/asset',
  bundling: {
    image: cdk.DockerImage.fromRegistry('alpine'),
    command: ['command-that-produces-an-archive.sh'],
    outputType: cdk.BundlingOutput.NOT_ARCHIVED, // Bundling output will be zipped even though it produces a single archive file.
  },
});

import aws_cdk as cdk


asset = Asset(self, "BundledAsset",
    path="/path/to/asset",
    bundling=cdk.BundlingOptions(
        image=cdk.DockerImage.from_registry("alpine"),
        command=["command-that-produces-an-archive.sh"],
        output_type=cdk.BundlingOutput.NOT_ARCHIVED
    )
)

import software.amazon.awscdk.*;


Asset asset = Asset.Builder.create(this, "BundledAsset")
        .path("/path/to/asset")
        .bundling(BundlingOptions.builder()
                .image(DockerImage.fromRegistry("alpine"))
                .command(List.of("command-that-produces-an-archive.sh"))
                .outputType(BundlingOutput.NOT_ARCHIVED)
                .build())
        .build();

using Amazon.CDK;


var asset = new Asset(this, "BundledAsset", new AssetProps {
    Path = "/path/to/asset",
    Bundling = new BundlingOptions {
        Image = DockerImage.FromRegistry("alpine"),
        Command = new [] { "command-that-produces-an-archive.sh" },
        OutputType = BundlingOutput.NOT_ARCHIVED
    }
});

import "github.com/aws/aws-cdk-go/awscdk"


asset := awscdk.NewAsset(this, jsii.String("BundledAsset"), &AssetProps{
	Path: jsii.String("/path/to/asset"),
	Bundling: &BundlingOptions{
		Image: cdk.DockerImage_FromRegistry(jsii.String("alpine")),
		Command: []*string{
			jsii.String("command-that-produces-an-archive.sh"),
		},
		OutputType: cdk.BundlingOutput_NOT_ARCHIVED,
	},
})

Use BundlingOutput.ARCHIVED if the bundling output contains a single archive file and you don't want it to be zipped.

Docker options

Depending on your build environment, you may need to pass certain docker options to the docker run command that bundles assets. This can be done using BundlingOptions properties.

Some optional properties to pass to the docker bundling

import * as lambda from 'aws-cdk-lib/aws-lambda';

const asset = new Asset(this, 'BundledAsset', {
  path: '/path/to/asset',
  bundling: {
    image: lambda.Runtime.PYTHON_3_9.bundlingImage,
    command: [
      'bash', '-c',
      'pip install -r requirements.txt -t /asset-output && cp -au . /asset-output'
    ],
    securityOpt: 'no-new-privileges:true', // https://docs.docker.com/engine/reference/commandline/run/#optional-security-options---security-opt
    network: 'host', //https://docs.docker.com/engine/reference/commandline/run/#connect-a-container-to-a-network---network
  },
});

from aws_cdk import BundlingOptions
import aws_cdk.aws_lambda as lambda_


asset = Asset(self, "BundledAsset",
    path="/path/to/asset",
    bundling=BundlingOptions(
        image=lambda_.Runtime.PYTHON_3_9.bundling_image,
        command=["bash", "-c", "pip install -r requirements.txt -t /asset-output && cp -au . /asset-output"
        ],
        security_opt="no-new-privileges:true",  # https://docs.docker.com/engine/reference/commandline/run/#optional-security-options---security-opt
        network="host"
    )
)

import software.amazon.awscdk.services.lambda.*;


Asset asset = Asset.Builder.create(this, "BundledAsset")
        .path("/path/to/asset")
        .bundling(BundlingOptions.builder()
                .image(Runtime.PYTHON_3_9.getBundlingImage())
                .command(List.of("bash", "-c", "pip install -r requirements.txt -t /asset-output && cp -au . /asset-output"))
                .securityOpt("no-new-privileges:true") // https://docs.docker.com/engine/reference/commandline/run/#optional-security-options---security-opt
                .network("host")
                .build())
        .build();

using Amazon.CDK.AWS.Lambda;


var asset = new Asset(this, "BundledAsset", new AssetProps {
    Path = "/path/to/asset",
    Bundling = new BundlingOptions {
        Image = Runtime.PYTHON_3_9.BundlingImage,
        Command = new [] { "bash", "-c", "pip install -r requirements.txt -t /asset-output && cp -au . /asset-output" },
        SecurityOpt = "no-new-privileges:true",  // https://docs.docker.com/engine/reference/commandline/run/#optional-security-options---security-opt
        Network = "host"
    }
});

import lambda "github.com/aws/aws-cdk-go/awscdk"


asset := awscdk.NewAsset(this, jsii.String("BundledAsset"), &AssetProps{
	Path: jsii.String("/path/to/asset"),
	Bundling: &BundlingOptions{
		Image: lambda.Runtime_PYTHON_3_9().BundlingImage,
		Command: []*string{
			jsii.String("bash"),
			jsii.String("-c"),
			jsii.String("pip install -r requirements.txt -t /asset-output && cp -au . /asset-output"),
		},
		SecurityOpt: jsii.String("no-new-privileges:true"),
		 // https://docs.docker.com/engine/reference/commandline/run/#optional-security-options---security-opt
		Network: jsii.String("host"),
	},
})

CloudFormation Resource Metadata

NOTE: This section is relevant for authors of AWS Resource Constructs.

In certain situations, it is desirable for tools to be able to know that a certain CloudFormation resource is using a local asset. For example, SAM CLI can be used to invoke AWS Lambda functions locally for debugging purposes.

To enable such use cases, external tools will consult a set of metadata entries on AWS CloudFormation resources:

• aws:asset:path points to the local path of the asset.
• aws:asset:property is the name of the resource property where the asset is used

Using these two metadata entries, tools will be able to identify that assets are used by a certain resource, and enable advanced local experiences.

To add these metadata entries to a resource, use the asset.addResourceMetadata(resource, property) method.

See https://github.com/aws/aws-cdk/issues/1432 for more details

Types

Name	Kind	Summary
Asset	Construct	An asset represents a local file or directory, which is automatically uploaded to S3 and then can be referenced within a CDK application.
AssetOptions	Struct
AssetProps	Struct