@aws-blocks/bb-file-bucket 0.1.4 → 0.2.0

package/src/file-server.test.ts

@@ -49,6 +49,28 @@ afterEach(() => {
 	server.close();
 });
 
+
+// ── CORS headers ────────────────────────────────────────────────────────────
+
+describe('file-server: CORS headers', () => {
+	test('OPTIONS preflight does NOT send Access-Control-Allow-Credentials', async () => {
+		// Reflecting an arbitrary Origin together with credentials:true is an
+		// unsafe combination; the dev server must not advertise credentialed CORS.
+		const res = await fetch(`http://localhost:${port}/.bb-file-bucket/fsrv-cors/ping.txt`, {
+			method: 'OPTIONS',
+			headers: { Origin: 'https://evil.example.com' },
+		});
+		assert.strictEqual(res.status, 200);
+		assert.strictEqual(
+			res.headers.get('access-control-allow-credentials'),
+			null,
+			'dev server must not send Access-Control-Allow-Credentials',
+		);
+		// The other CORS headers remain intact.
+		assert.strictEqual(res.headers.get('access-control-allow-origin'), 'https://evil.example.com');
+		assert.ok(res.headers.get('access-control-allow-methods'));
+	});
+});
 // ── Basic presigned URL round-trip ──────────────────────────────────────────
 
 describe('file-server: basic GET/PUT', () => {

package/src/file-server.ts

@@ -70,10 +70,19 @@ export function attach(httpServer: Server) {
 
 		// CORS for browser uploads/downloads
 		const origin = req.headers.origin || '*';
+		// Reflecting the request Origin (falling back to '*') is intentional: it
+		// lets a localhost cross-port dev server (e.g. Vite/webpack on a different
+		// port) call this local file-server. This dev file-server is local tooling
+		// only and NEVER deploys to AWS / production.
+		// It is safe because Access-Control-Allow-Credentials is deliberately NOT
+		// set, so the reflected origin carries no ambient credentials: presigned-URL
+		// auth is a query-string token, not a cookie / ambient session. That is what
+		// makes reflecting an arbitrary origin here safe.
+		// WARNING: do not re-add Access-Control-Allow-Credentials and do not
+		// 'tighten' this reflection without understanding the above.
 		res.setHeader('Access-Control-Allow-Origin', origin);
 		res.setHeader('Access-Control-Allow-Methods', 'GET, PUT, OPTIONS');
 		res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-		res.setHeader('Access-Control-Allow-Credentials', 'true');
 
 		if (req.method === 'OPTIONS') {
 			res.writeHead(200);

package/src/index.cdk.test.ts

@@ -12,30 +12,45 @@ import { test } from 'node:test';
 import assert from 'node:assert';
 import * as cdk from 'aws-cdk-lib';
 import type { Construct } from 'constructs';
-import { Template } from 'aws-cdk-lib/assertions';
-import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import { Template, Match } from 'aws-cdk-lib/assertions';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Scope, DEFAULT_NODE_RUNTIME, BlocksPresets, type BlocksDefaults } from '@aws-blocks/core/cdk';
 import { FileBucket } from './index.cdk.js';
 
+// Minimal BlocksStack-shaped parent. The production code path uses BlocksStack,
+// which exposes the shared `executionRole` (blocks grant to it) plus `handler`,
+// both living inside a `cdk.Stack`. We reproduce them here so FileBucket can
+// call grantReadWrite(this.executionRole) and still synth into a real stack. It
+// also carries `defaults` — Building Blocks resolve `scope.defaults` by walking
+// up to the owning BlocksStack/BlocksBackend, falling back to
+// `globalThis.CURRENT_BLOCKS_STACK`, which is this stub in these tests.
 class StubBlocksStack extends cdk.Stack {
   public readonly handler: cdk.aws_lambda.Function;
+  public readonly executionRole: cdk.aws_iam.IRole;
   public readonly id: string;
+  public defaults: BlocksDefaults = BlocksPresets.production;
   constructor(scope: Construct, id: string) {
     super(scope, id);
     this.id = id;
     (globalThis as any).CURRENT_BLOCKS_STACK = this;
+    this.executionRole = new cdk.aws_iam.Role(this, 'BlocksRole', {
+      assumedBy: new cdk.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
+    });
     this.handler = new cdk.aws_lambda.Function(this, 'StubHandler', {
       runtime: DEFAULT_NODE_RUNTIME,
       handler: 'index.handler',
       code: cdk.aws_lambda.Code.fromInline('exports.handler = async () => {};'),
+      role: this.executionRole,
     });
   }
 }
 
-function setup(): { stack: StubBlocksStack; parent: Scope } {
+function setup(defaults: BlocksDefaults = BlocksPresets.production): { stack: StubBlocksStack; parent: Scope } {
   const app = new cdk.App();
   // S3 bucket names must be lowercase. The default-mode FileBucket derives
   // its bucket name from the scope chain, so keep ids lowercase.
   const stack = new StubBlocksStack(app, 'teststack');
+  stack.defaults = defaults;
   const parent = new Scope('app');
   return { stack, parent };
 }
@@ -82,3 +97,337 @@ test('CDK: fromExisting skips derived-name validation even when the chain is ove
     }),
   );
 });
+
+// ── Security hardening: secure defaults ─────────────────────────────────────
+
+test('CDK: default FileBucket enforces SSL (aws:SecureTransport deny)', () => {
+  const { stack, parent } = setup();
+  new FileBucket(parent, 'uploads');
+  const template = Template.fromStack(stack);
+  // enforceSSL:true makes CDK attach a bucket policy denying non-TLS requests.
+  template.hasResourceProperties('AWS::S3::BucketPolicy', Match.objectLike({
+    PolicyDocument: Match.objectLike({
+      Statement: Match.arrayWith([
+        Match.objectLike({
+          Effect: 'Deny',
+          Condition: { Bool: { 'aws:SecureTransport': 'false' } },
+        }),
+      ]),
+    }),
+  }));
+});
+
+test('CDK: default FileBucket enables versioning (new secure default)', () => {
+  const { stack, parent } = setup();
+  new FileBucket(parent, 'uploads');
+  const template = Template.fromStack(stack);
+  template.hasResourceProperties('AWS::S3::Bucket', Match.objectLike({
+    VersioningConfiguration: { Status: 'Enabled' },
+  }));
+});
+
+test('CDK: versioned:false opt-out disables versioning', () => {
+  const { stack, parent } = setup();
+  new FileBucket(parent, 'uploads', { versioned: false });
+  const template = Template.fromStack(stack);
+  // No VersioningConfiguration is emitted when versioning is disabled.
+  const buckets = template.findResources('AWS::S3::Bucket');
+  const props = Object.values(buckets)[0].Properties ?? {};
+  assert.strictEqual((props as any).VersioningConfiguration, undefined);
+});
+
+// ── Posture routed through BlocksDefaults (PR review comment C) ──────────────
+
+test('CDK: default FileBucket adopts the SANDBOX removal posture (DESTROY + autoDelete)', () => {
+  const { stack, parent } = setup(BlocksPresets.sandbox);
+  new FileBucket(parent, 'uploads');
+  const template = Template.fromStack(stack);
+  // DESTROY removal policy plus the auto-delete custom resource CDK wires in
+  // only when autoDeleteObjects is true.
+  template.hasResource('AWS::S3::Bucket', { DeletionPolicy: 'Delete' });
+  template.resourceCountIs('Custom::S3AutoDeleteObjects', 1);
+});
+
+test('CDK: default FileBucket adopts the PRODUCTION removal posture (RETAIN, no autoDelete)', () => {
+  const { stack, parent } = setup(BlocksPresets.production);
+  new FileBucket(parent, 'uploads');
+  const template = Template.fromStack(stack);
+  template.hasResource('AWS::S3::Bucket', { DeletionPolicy: 'Retain' });
+  template.resourceCountIs('Custom::S3AutoDeleteObjects', 0);
+});
+
+test('CDK: per-block removalPolicy overrides the resolved default', () => {
+  const { stack, parent } = setup(BlocksPresets.production);
+  new FileBucket(parent, 'uploads', { removalPolicy: 'destroy' });
+  const template = Template.fromStack(stack);
+  // Per-block 'destroy' wins over the production RETAIN default and enables
+  // autoDeleteObjects alongside it.
+  template.hasResource('AWS::S3::Bucket', { DeletionPolicy: 'Delete' });
+  template.resourceCountIs('Custom::S3AutoDeleteObjects', 1);
+});
+
+test('CDK: accessLogging provisions a locked-down log bucket with lifecycle + logging config', () => {
+  const { stack, parent } = setup();
+  new FileBucket(parent, 'uploads', { accessLogging: true });
+  const template = Template.fromStack(stack);
+  // Main bucket + dedicated access-log bucket.
+  template.resourceCountIs('AWS::S3::Bucket', 2);
+  // Both buckets are TLS-enforced: enforceSSL:true attaches a bucket policy
+  // with an aws:SecureTransport deny to EACH bucket (main + log bucket), so
+  // the log bucket is provably locked down, not just the main one.
+  template.resourceCountIs('AWS::S3::BucketPolicy', 2);
+  const policies = template.findResources('AWS::S3::BucketPolicy');
+  for (const policy of Object.values(policies)) {
+    assert.ok(
+      (policy.Properties.PolicyDocument.Statement as any[]).some(
+        (s) =>
+          s.Effect === 'Deny' &&
+          s.Condition?.Bool?.['aws:SecureTransport'] === 'false',
+      ),
+      'every bucket (main + log) must have an enforceSSL deny statement',
+    );
+  }
+  // Distinguish the two buckets: the main bucket carries the derived
+  // BucketName; the log bucket does not. Prove the MAIN bucket's
+  // LoggingConfiguration points at the LOG bucket specifically.
+  const buckets = template.findResources('AWS::S3::Bucket');
+  const entries = Object.entries(buckets);
+  const mainEntry = entries.find(([, r]) => (r.Properties as any).BucketName !== undefined);
+  const logEntry = entries.find(([id]) => id !== mainEntry?.[0]);
+  assert.ok(mainEntry && logEntry, 'expected one named main bucket and one log bucket');
+  const [logLogicalId, logResource] = logEntry;
+  // Main bucket delivers its access logs to the log bucket under access-logs/.
+  assert.deepStrictEqual(
+    (mainEntry[1].Properties as any).LoggingConfiguration,
+    { DestinationBucketName: { Ref: logLogicalId }, LogFilePrefix: 'access-logs/' },
+  );
+  // Log bucket expires access logs after the framework logRetention default
+  // (production preset => ONE_YEAR => 365 days).
+  assert.ok(
+    ((logResource.Properties as any).LifecycleConfiguration.Rules as any[]).some(
+      (r) => r.ExpirationInDays === 365 && r.Status === 'Enabled',
+    ),
+    'log bucket must expire access logs after the production logRetention (365 days)',
+  );
+  // Log bucket blocks all public access.
+  assert.deepStrictEqual((logResource.Properties as any).PublicAccessBlockConfiguration, {
+    BlockPublicAcls: true,
+    BlockPublicPolicy: true,
+    IgnorePublicAcls: true,
+    RestrictPublicBuckets: true,
+  });
+});
+
+test('CDK: accessLogging resolves from defaults — a preset opting in creates the log bucket with no per-block option', () => {
+  const { stack, parent } = setup({ ...BlocksPresets.production, accessLogging: true });
+  new FileBucket(parent, 'uploads');
+  const template = Template.fromStack(stack);
+  // No per-block accessLogging option, yet the resolved default enables it.
+  template.resourceCountIs('AWS::S3::Bucket', 2);
+});
+
+test('CDK: access-log lifecycle expiration equals Duration.days(defaults.logRetention) — sandbox = 7', () => {
+  const { stack, parent } = setup({ ...BlocksPresets.sandbox, accessLogging: true });
+  new FileBucket(parent, 'uploads', { removalPolicy: 'retain' });
+  const template = Template.fromStack(stack);
+  // The per-block 'retain' override wins over the sandbox DESTROY default: the
+  // main bucket is retained on teardown.
+  template.hasResource('AWS::S3::Bucket', { DeletionPolicy: 'Retain' });
+  const buckets = template.findResources('AWS::S3::Bucket');
+  const logEntry = Object.values(buckets).find(
+    (r) => (r.Properties as any).BucketName === undefined,
+  );
+  assert.ok(logEntry, 'expected a log bucket');
+  assert.ok(
+    ((logEntry!.Properties as any).LifecycleConfiguration.Rules as any[]).some(
+      (r) => r.ExpirationInDays === 7 && r.Status === 'Enabled',
+    ),
+    'log bucket must expire access logs after the sandbox logRetention (ONE_WEEK = 7 days)',
+  );
+});
+
+test('CDK: no access-log bucket is created when accessLogging resolves false', () => {
+  const { stack, parent } = setup();
+  new FileBucket(parent, 'uploads');
+  const template = Template.fromStack(stack);
+  template.resourceCountIs('AWS::S3::Bucket', 1);
+});
+
+test('CDK: logRetention INFINITE omits the access-log lifecycle rule (logs kept indefinitely)', () => {
+  const { stack, parent } = setup({
+    ...BlocksPresets.production,
+    logRetention: RetentionDays.INFINITE,
+    accessLogging: true,
+  });
+  new FileBucket(parent, 'uploads');
+  const template = Template.fromStack(stack);
+  // Main bucket + log bucket both exist.
+  template.resourceCountIs('AWS::S3::Bucket', 2);
+  // The access-LOG bucket (the one without a derived BucketName) must carry NO
+  // LifecycleConfiguration at all — INFINITE means "never expire", so the rule
+  // is omitted rather than emitted at a spurious 9999-day expiry.
+  const buckets = template.findResources('AWS::S3::Bucket');
+  const logEntry = Object.values(buckets).find(
+    (r) => (r.Properties as any).BucketName === undefined,
+  );
+  assert.ok(logEntry, 'expected a log bucket');
+  assert.strictEqual(
+    (logEntry!.Properties as any).LifecycleConfiguration,
+    undefined,
+    'INFINITE logRetention must omit the access-log LifecycleConfiguration entirely',
+  );
+});
+
+test('CDK: per-block accessLogging:false overrides a defaults-enabled preset (?? treats explicit false as non-nullish)', () => {
+  const { stack, parent } = setup({ ...BlocksPresets.production, accessLogging: true });
+  new FileBucket(parent, 'uploads', { accessLogging: false });
+  const template = Template.fromStack(stack);
+  // Defaults opt logging in, but the explicit per-block `false` wins: only the
+  // main bucket is provisioned, no dedicated access-log bucket.
+  template.resourceCountIs('AWS::S3::Bucket', 1);
+});
+
+// ── Noncurrent-version expiration (PR review comment A) ──────────────────────
+
+test('CDK: versioned bucket expires noncurrent versions after the default 90 days', () => {
+  const { stack, parent } = setup();
+  new FileBucket(parent, 'uploads');
+  const template = Template.fromStack(stack);
+  template.hasResourceProperties('AWS::S3::Bucket', Match.objectLike({
+    VersioningConfiguration: { Status: 'Enabled' },
+    LifecycleConfiguration: Match.objectLike({
+      Rules: Match.arrayWith([
+        Match.objectLike({
+          NoncurrentVersionExpiration: { NoncurrentDays: 90 },
+          Status: 'Enabled',
+        }),
+      ]),
+    }),
+  }));
+});
+
+test('CDK: noncurrentVersionExpirationDays is honored', () => {
+  const { stack, parent } = setup();
+  new FileBucket(parent, 'uploads', { noncurrentVersionExpirationDays: 30 });
+  const template = Template.fromStack(stack);
+  template.hasResourceProperties('AWS::S3::Bucket', Match.objectLike({
+    LifecycleConfiguration: Match.objectLike({
+      Rules: Match.arrayWith([
+        Match.objectLike({ NoncurrentVersionExpiration: { NoncurrentDays: 30 } }),
+      ]),
+    }),
+  }));
+});
+
+test('CDK: noncurrentVersionExpirationDays of 0 throws at synth', () => {
+  const { parent } = setup();
+  assert.throws(
+    () => new FileBucket(parent, 'uploads', { noncurrentVersionExpirationDays: 0 }),
+    (err: unknown) =>
+      err instanceof Error &&
+      /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+      /got 0/.test(err.message),
+  );
+});
+
+test('CDK: negative noncurrentVersionExpirationDays throws at synth', () => {
+  const { parent } = setup();
+  assert.throws(
+    () => new FileBucket(parent, 'uploads', { noncurrentVersionExpirationDays: -1 }),
+    (err: unknown) =>
+      err instanceof Error &&
+      /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+      /got -1/.test(err.message),
+  );
+});
+
+test('CDK: non-integer noncurrentVersionExpirationDays throws at synth', () => {
+  const { parent } = setup();
+  assert.throws(
+    () => new FileBucket(parent, 'uploads', { noncurrentVersionExpirationDays: 1.5 }),
+    (err: unknown) =>
+      err instanceof Error &&
+      /noncurrentVersionExpirationDays must be a positive integer/.test(err.message),
+  );
+});
+
+test('CDK: versioned:false bucket has NO noncurrent-version expiration rule', () => {
+  const { stack, parent } = setup();
+  new FileBucket(parent, 'uploads', { versioned: false });
+  const template = Template.fromStack(stack);
+  const buckets = template.findResources('AWS::S3::Bucket');
+  const props = (Object.values(buckets)[0].Properties ?? {}) as any;
+  const rules: any[] = props.LifecycleConfiguration?.Rules ?? [];
+  assert.ok(
+    !rules.some((r) => r.NoncurrentVersionExpiration !== undefined),
+    'a non-versioned bucket must not carry a noncurrent-version expiration rule',
+  );
+});
+
+test('CDK: noncurrentVersionExpirationDays FORMAT is validated even when versioned:false', () => {
+  // The format guard is decoupled from the `versioned` gate: a malformed value
+  // must fail loudly at synth regardless of whether versioning is on, rather
+  // than being silently ignored because the rule would not be applied.
+  for (const bad of [0, -1, 1.5]) {
+    const { parent } = setup();
+    assert.throws(
+      () => new FileBucket(parent, 'uploads', { versioned: false, noncurrentVersionExpirationDays: bad }),
+      (err: unknown) =>
+        err instanceof Error &&
+        /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+        new RegExp(`got ${bad}`).test(err.message),
+      `versioned:false with noncurrentVersionExpirationDays=${bad} must throw at synth`,
+    );
+  }
+});
+
+test('CDK: versioned:false with NO noncurrent option does not throw and adds no noncurrent rule', () => {
+  const { stack, parent } = setup();
+  assert.doesNotThrow(() => new FileBucket(parent, 'uploads', { versioned: false }));
+  const template = Template.fromStack(stack);
+  const buckets = template.findResources('AWS::S3::Bucket');
+  const props = (Object.values(buckets)[0].Properties ?? {}) as any;
+  const rules: any[] = props.LifecycleConfiguration?.Rules ?? [];
+  assert.ok(
+    !rules.some((r) => r.NoncurrentVersionExpiration !== undefined),
+    'versioned:false with no noncurrent option must add no noncurrent-version expiration rule',
+  );
+});
+
+// ── CORS synth guard (unchanged behavior) ───────────────────────────────────
+
+test('CDK: wildcard-origin CORS with a mutating method throws at synth', () => {
+  const { parent } = setup();
+  assert.throws(
+    () =>
+      new FileBucket(parent, 'uploads', {
+        corsRules: [
+          { allowedOrigins: ['*'], allowedMethods: ['GET', 'PUT'] },
+        ],
+      }),
+    (err: unknown) =>
+      err instanceof Error &&
+      /\*/.test(err.message) &&
+      /PUT/.test(err.message),
+  );
+});
+
+test('CDK: wildcard-origin CORS with only safe methods is allowed', () => {
+  const { parent } = setup();
+  assert.doesNotThrow(() =>
+    new FileBucket(parent, 'uploads', {
+      corsRules: [{ allowedOrigins: ['*'], allowedMethods: ['GET', 'HEAD'] }],
+    }),
+  );
+});
+
+test('CDK: explicit-origin CORS with a mutating method is allowed', () => {
+  const { parent } = setup();
+  assert.doesNotThrow(() =>
+    new FileBucket(parent, 'uploads', {
+      corsRules: [
+        { allowedOrigins: ['https://app.example.com'], allowedMethods: ['PUT', 'POST'] },
+      ],
+    }),
+  );
+});

package/src/index.cdk.ts

@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import * as s3 from 'aws-cdk-lib/aws-s3';
-import * as cdk from 'aws-cdk-lib';
 import { Duration, RemovalPolicy } from 'aws-cdk-lib';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { Scope } from '@aws-blocks/core/cdk';
 import type { ScopeParent } from '@aws-blocks/core';
 import type { FileBucketOptions, CorsRule, LifecycleRule, ExternalBucketRef } from './types.js';
@@ -20,6 +20,12 @@ const httpMethodMap: Record<string, s3.HttpMethods> = {
 	HEAD: s3.HttpMethods.HEAD,
 };
 
+/** Default number of days after which noncurrent object versions expire. */
+const DEFAULT_NONCURRENT_VERSION_EXPIRATION_DAYS = 90;
+
+/** HTTP methods that mutate bucket state; unsafe to expose to wildcard origins. */
+const MUTATING_CORS_METHODS: ReadonlyArray<CorsRule['allowedMethods'][number]> = ['PUT', 'POST', 'DELETE'];
+
 export class FileBucket<O extends FileBucketOptions = FileBucketOptions> extends Scope {
 	private bucket: s3.IBucket;
 
@@ -39,34 +45,139 @@ export class FileBucket<O extends FileBucketOptions = FileBucketOptions> extends
 			// `fromExisting`: don't provision; bind to the pre-existing bucket and
 			// grant read/write to the Blocks runtime Lambda.
 			this.bucket = s3.Bucket.fromBucketName(this, 'bucket', options.bucket.bucketName);
-			this.bucket.grantReadWrite(this.handler);
+			this.bucket.grantReadWrite(this.executionRole);
 			return;
 		}
 
-		// In sandbox mode, default to DESTROY + autoDeleteObjects so
-		// `cdk destroy` can fully clean up without manual bucket emptying.
-		// Explicit `removalPolicy` from the customer takes precedence.
-		// `autoDeleteObjects: true` is only valid paired with DESTROY (CDK
-		// validates this at construct time), so we tie the two together.
-		const isSandbox = cdk.Stack.of(this).node.tryGetContext('sandboxMode') === 'true';
-		const destroy = options?.removalPolicy === 'destroy' || (isSandbox && options?.removalPolicy === undefined);
+		// Resolve durability from the per-block option (a `'destroy'|'retain'`
+		// string, normalized to a CDK RemovalPolicy) falling back to the
+		// stack-wide `defaults`. This replaces the old `sandboxMode` context
+		// read — the sandbox posture now flows in through the chosen preset,
+		// exactly like bb-kv-store. Explicit `removalPolicy` from the customer
+		// still takes precedence. `autoDeleteObjects: true` is only valid paired
+		// with DESTROY (CDK validates this at construct time), so we derive the
+		// two from the same resolved policy.
+		const removalPolicy =
+			options?.removalPolicy === 'destroy'
+				? RemovalPolicy.DESTROY
+				: options?.removalPolicy === 'retain'
+					? RemovalPolicy.RETAIN
+					: this.defaults.removalPolicy;
+		const destroy = removalPolicy === RemovalPolicy.DESTROY;
 
 		// Bucket name is derived from the scope chain. Validate against S3's
 		// naming rules at synth so an invalid name fails here rather than at
 		// `cdk deploy` (where CloudFormation rejects it with a cryptic error).
+		// Run this first: an unusable bucket name is the most fundamental synth
+		// error, so surface it before the option-level guards below.
 		validateBucketName(this.fullId);
 
+		// Reject unsafe CORS at synth: a wildcard origin ('*') combined with a
+		// mutating method (PUT/POST/DELETE) lets any site issue state-changing
+		// cross-origin requests. Fail loud here rather than deploying it.
+		for (const rule of options?.corsRules ?? []) {
+			if (rule.allowedOrigins.includes('*')) {
+				const mutating = rule.allowedMethods.filter(m => MUTATING_CORS_METHODS.includes(m));
+				if (mutating.length > 0) {
+					throw new Error(
+						`FileBucket "${this.fullId}": CORS rule with wildcard origin '*' must not allow mutating method(s) ${mutating.join(', ')}. ` +
+						`Specify explicit allowedOrigins (e.g. 'https://app.example.com') for ${mutating.join(', ')} instead of '*'.`,
+					);
+				}
+			}
+		}
+
+		// Reject a non-positive or non-integer noncurrent-version expiration at
+		// synth whenever the option is provided. A zero, negative, or fractional
+		// value would produce a degenerate lifecycle expiration
+		// (Duration.days(0) / negative) that only surfaces at deploy. The FORMAT
+		// is validated regardless of `versioned` so a malformed value is caught
+		// even when versioning is off; the rule itself is only APPLIED when
+		// versioning is on (see the main-bucket lifecycle rules below).
+		if (options?.noncurrentVersionExpirationDays !== undefined) {
+			const days = options.noncurrentVersionExpirationDays;
+			if (!Number.isInteger(days) || days <= 0) {
+				throw new Error(
+					`FileBucket "${this.fullId}": noncurrentVersionExpirationDays must be a positive integer (got ${days}). ` +
+					`Omit it to use the default of ${DEFAULT_NONCURRENT_VERSION_EXPIRATION_DAYS} days.`,
+				);
+			}
+		}
+
+		// Versioning stays on by default (secure default): a posture-driven
+		// `versioned` default would require a new `BlocksDefaults` field in
+		// core, which is out of scope for this change, so we keep the
+		// default-on and bound its cost with a noncurrent-version expiration
+		// below.
+		const versioned = options?.versioned ?? true;
+
+		// Opt-in server access logging: provision a dedicated, locked-down log
+		// bucket and expire its logs after the framework retention. Kept
+		// separate from the data bucket so log delivery can't loop back on it.
+		// Resolves from the stack `defaults.accessLogging` when no per-block
+		// option is given, so a production-postured stack opts every FileBucket
+		// in without a per-block flag.
+		const accessLogging = options?.accessLogging ?? this.defaults.accessLogging;
+		let serverAccessLogsBucket: s3.Bucket | undefined;
+		if (accessLogging) {
+			// The access-log lifecycle expiry derives from the framework-wide
+			// `logRetention` default (a `RetentionDays` enum). `RetentionDays`
+			// is a numeric enum whose member value IS the day count
+			// (ONE_WEEK === 7, ONE_YEAR === 365), so it maps directly to
+			// `Duration.days(...)`. The one non-day member is INFINITE (=== 9999,
+			// "retain forever"): for it we omit the lifecycle rule so logs are
+			// never expired, rather than expiring them at a spurious 9999 days.
+			const logRetention = this.defaults.logRetention;
+			const logLifecycleRules =
+				logRetention === RetentionDays.INFINITE
+					? undefined
+					: [{ id: 'expire-access-logs', expiration: Duration.days(logRetention) }];
+			serverAccessLogsBucket = new s3.Bucket(this, 'access-logs', {
+				blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+				encryption: s3.BucketEncryption.S3_MANAGED,
+				enforceSSL: true,
+				removalPolicy,
+				autoDeleteObjects: destroy,
+				lifecycleRules: logLifecycleRules,
+			});
+		}
+
+		// Main-bucket lifecycle rules: the noncurrent-version expiration (only
+		// when versioning is on, to bound version-storage growth) merged with
+		// any customer-supplied lifecycle rules into a single array.
+		const lifecycleRules: s3.LifecycleRule[] = [];
+		if (versioned) {
+			lifecycleRules.push({
+				id: 'ExpireNoncurrentVersions',
+				enabled: true,
+				noncurrentVersionExpiration: Duration.days(
+					options?.noncurrentVersionExpirationDays ?? DEFAULT_NONCURRENT_VERSION_EXPIRATION_DAYS,
+				),
+			});
+		}
+		for (const rule of options?.lifecycleRules ?? []) {
+			lifecycleRules.push({
+				prefix: rule.prefix,
+				expiration: rule.expirationDays ? Duration.days(rule.expirationDays) : undefined,
+				transitions: rule.transitionToIaDays ? [{
+					storageClass: s3.StorageClass.INFREQUENT_ACCESS,
+					transitionAfter: Duration.days(rule.transitionToIaDays),
+				}] : undefined,
+			});
+		}
+
 		this.bucket = new s3.Bucket(this, 'bucket', {
 			bucketName: this.fullId,
 			blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
 			encryption: s3.BucketEncryption.S3_MANAGED,
-			versioned: options?.versioned ?? false,
-			removalPolicy: destroy
-				? RemovalPolicy.DESTROY
-				: options?.removalPolicy === 'retain'
-					? RemovalPolicy.RETAIN
-					: undefined,
+			// All FileBucket traffic (SDK calls + presigned URLs) is HTTPS, so
+			// enforce TLS to close the in-transit exposure gap unconditionally.
+			enforceSSL: true,
+			versioned,
+			removalPolicy,
 			autoDeleteObjects: destroy,
+			serverAccessLogsBucket,
+			serverAccessLogsPrefix: serverAccessLogsBucket ? 'access-logs/' : undefined,
 			cors: options?.corsRules?.map((rule: CorsRule) => ({
 				allowedOrigins: rule.allowedOrigins,
 				allowedMethods: rule.allowedMethods.map(m => httpMethodMap[m]),
@@ -74,16 +185,9 @@ export class FileBucket<O extends FileBucketOptions = FileBucketOptions> extends
 				exposedHeaders: rule.exposedHeaders,
 				maxAge: rule.maxAge,
 			})),
-			lifecycleRules: options?.lifecycleRules?.map((rule: LifecycleRule) => ({
-				prefix: rule.prefix,
-				expiration: rule.expirationDays ? Duration.days(rule.expirationDays) : undefined,
-				transitions: rule.transitionToIaDays ? [{
-					storageClass: s3.StorageClass.INFREQUENT_ACCESS,
-					transitionAfter: Duration.days(rule.transitionToIaDays),
-				}] : undefined,
-			})),
+			lifecycleRules: lifecycleRules.length > 0 ? lifecycleRules : undefined,
 		});
 
-		this.bucket.grantReadWrite(this.handler);
+		this.bucket.grantReadWrite(this.executionRole);
 	}
 }