@gammarers/aws-secure-bucket 1.4.5 → 1.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.jsii +8 -178
- package/API.md +354 -40
- package/lib/index.d.ts +1 -40
- package/lib/index.js +20 -62
- package/package.json +7 -7
package/.jsii
CHANGED
|
@@ -3453,7 +3453,7 @@
|
|
|
3453
3453
|
"stability": "stable"
|
|
3454
3454
|
},
|
|
3455
3455
|
"homepage": "https://github.com/gammarers/aws-secure-bucket.git",
|
|
3456
|
-
"jsiiVersion": "5.
|
|
3456
|
+
"jsiiVersion": "5.4.25 (build 09cecf6)",
|
|
3457
3457
|
"keywords": [
|
|
3458
3458
|
"aws",
|
|
3459
3459
|
"aws-cdk",
|
|
@@ -3508,7 +3508,7 @@
|
|
|
3508
3508
|
},
|
|
3509
3509
|
"locationInModule": {
|
|
3510
3510
|
"filename": "src/index.ts",
|
|
3511
|
-
"line":
|
|
3511
|
+
"line": 8
|
|
3512
3512
|
},
|
|
3513
3513
|
"parameters": [
|
|
3514
3514
|
{
|
|
@@ -3535,41 +3535,11 @@
|
|
|
3535
3535
|
"kind": "class",
|
|
3536
3536
|
"locationInModule": {
|
|
3537
3537
|
"filename": "src/index.ts",
|
|
3538
|
-
"line":
|
|
3538
|
+
"line": 7
|
|
3539
3539
|
},
|
|
3540
3540
|
"name": "SecureBucket",
|
|
3541
3541
|
"symbolId": "src/index:SecureBucket"
|
|
3542
3542
|
},
|
|
3543
|
-
"@gammarers/aws-secure-bucket.SecureBucketEncryption": {
|
|
3544
|
-
"assembly": "@gammarers/aws-secure-bucket",
|
|
3545
|
-
"docs": {
|
|
3546
|
-
"stability": "stable"
|
|
3547
|
-
},
|
|
3548
|
-
"fqn": "@gammarers/aws-secure-bucket.SecureBucketEncryption",
|
|
3549
|
-
"kind": "enum",
|
|
3550
|
-
"locationInModule": {
|
|
3551
|
-
"filename": "src/index.ts",
|
|
3552
|
-
"line": 14
|
|
3553
|
-
},
|
|
3554
|
-
"members": [
|
|
3555
|
-
{
|
|
3556
|
-
"docs": {
|
|
3557
|
-
"stability": "stable",
|
|
3558
|
-
"summary": "Server-side KMS encryption with a master key managed by KMS."
|
|
3559
|
-
},
|
|
3560
|
-
"name": "KMS_MANAGED"
|
|
3561
|
-
},
|
|
3562
|
-
{
|
|
3563
|
-
"docs": {
|
|
3564
|
-
"stability": "stable",
|
|
3565
|
-
"summary": "Server-side encryption with a master key managed by S3."
|
|
3566
|
-
},
|
|
3567
|
-
"name": "S3_MANAGED"
|
|
3568
|
-
}
|
|
3569
|
-
],
|
|
3570
|
-
"name": "SecureBucketEncryption",
|
|
3571
|
-
"symbolId": "src/index:SecureBucketEncryption"
|
|
3572
|
-
},
|
|
3573
3543
|
"@gammarers/aws-secure-bucket.SecureBucketProps": {
|
|
3574
3544
|
"assembly": "@gammarers/aws-secure-bucket",
|
|
3575
3545
|
"datatype": true,
|
|
@@ -3577,158 +3547,18 @@
|
|
|
3577
3547
|
"stability": "stable"
|
|
3578
3548
|
},
|
|
3579
3549
|
"fqn": "@gammarers/aws-secure-bucket.SecureBucketProps",
|
|
3550
|
+
"interfaces": [
|
|
3551
|
+
"aws-cdk-lib.aws_s3.BucketProps"
|
|
3552
|
+
],
|
|
3580
3553
|
"kind": "interface",
|
|
3581
3554
|
"locationInModule": {
|
|
3582
3555
|
"filename": "src/index.ts",
|
|
3583
3556
|
"line": 5
|
|
3584
3557
|
},
|
|
3585
3558
|
"name": "SecureBucketProps",
|
|
3586
|
-
"properties": [
|
|
3587
|
-
{
|
|
3588
|
-
"abstract": true,
|
|
3589
|
-
"docs": {
|
|
3590
|
-
"stability": "stable"
|
|
3591
|
-
},
|
|
3592
|
-
"immutable": true,
|
|
3593
|
-
"locationInModule": {
|
|
3594
|
-
"filename": "src/index.ts",
|
|
3595
|
-
"line": 6
|
|
3596
|
-
},
|
|
3597
|
-
"name": "bucketName",
|
|
3598
|
-
"optional": true,
|
|
3599
|
-
"type": {
|
|
3600
|
-
"primitive": "string"
|
|
3601
|
-
}
|
|
3602
|
-
},
|
|
3603
|
-
{
|
|
3604
|
-
"abstract": true,
|
|
3605
|
-
"docs": {
|
|
3606
|
-
"stability": "stable"
|
|
3607
|
-
},
|
|
3608
|
-
"immutable": true,
|
|
3609
|
-
"locationInModule": {
|
|
3610
|
-
"filename": "src/index.ts",
|
|
3611
|
-
"line": 7
|
|
3612
|
-
},
|
|
3613
|
-
"name": "encryption",
|
|
3614
|
-
"optional": true,
|
|
3615
|
-
"type": {
|
|
3616
|
-
"fqn": "@gammarers/aws-secure-bucket.SecureBucketEncryption"
|
|
3617
|
-
}
|
|
3618
|
-
},
|
|
3619
|
-
{
|
|
3620
|
-
"abstract": true,
|
|
3621
|
-
"docs": {
|
|
3622
|
-
"stability": "stable"
|
|
3623
|
-
},
|
|
3624
|
-
"immutable": true,
|
|
3625
|
-
"locationInModule": {
|
|
3626
|
-
"filename": "src/index.ts",
|
|
3627
|
-
"line": 9
|
|
3628
|
-
},
|
|
3629
|
-
"name": "eventBridgeEnabled",
|
|
3630
|
-
"optional": true,
|
|
3631
|
-
"type": {
|
|
3632
|
-
"primitive": "boolean"
|
|
3633
|
-
}
|
|
3634
|
-
},
|
|
3635
|
-
{
|
|
3636
|
-
"abstract": true,
|
|
3637
|
-
"docs": {
|
|
3638
|
-
"stability": "stable"
|
|
3639
|
-
},
|
|
3640
|
-
"immutable": true,
|
|
3641
|
-
"locationInModule": {
|
|
3642
|
-
"filename": "src/index.ts",
|
|
3643
|
-
"line": 10
|
|
3644
|
-
},
|
|
3645
|
-
"name": "lifecycleRules",
|
|
3646
|
-
"optional": true,
|
|
3647
|
-
"type": {
|
|
3648
|
-
"collection": {
|
|
3649
|
-
"elementtype": {
|
|
3650
|
-
"fqn": "aws-cdk-lib.aws_s3.LifecycleRule"
|
|
3651
|
-
},
|
|
3652
|
-
"kind": "array"
|
|
3653
|
-
}
|
|
3654
|
-
}
|
|
3655
|
-
},
|
|
3656
|
-
{
|
|
3657
|
-
"abstract": true,
|
|
3658
|
-
"docs": {
|
|
3659
|
-
"stability": "stable"
|
|
3660
|
-
},
|
|
3661
|
-
"immutable": true,
|
|
3662
|
-
"locationInModule": {
|
|
3663
|
-
"filename": "src/index.ts",
|
|
3664
|
-
"line": 11
|
|
3665
|
-
},
|
|
3666
|
-
"name": "objectOwnership",
|
|
3667
|
-
"optional": true,
|
|
3668
|
-
"type": {
|
|
3669
|
-
"fqn": "@gammarers/aws-secure-bucket.SecureObjectOwnership"
|
|
3670
|
-
}
|
|
3671
|
-
},
|
|
3672
|
-
{
|
|
3673
|
-
"abstract": true,
|
|
3674
|
-
"docs": {
|
|
3675
|
-
"stability": "stable"
|
|
3676
|
-
},
|
|
3677
|
-
"immutable": true,
|
|
3678
|
-
"locationInModule": {
|
|
3679
|
-
"filename": "src/index.ts",
|
|
3680
|
-
"line": 8
|
|
3681
|
-
},
|
|
3682
|
-
"name": "versioned",
|
|
3683
|
-
"optional": true,
|
|
3684
|
-
"type": {
|
|
3685
|
-
"primitive": "boolean"
|
|
3686
|
-
}
|
|
3687
|
-
}
|
|
3688
|
-
],
|
|
3689
3559
|
"symbolId": "src/index:SecureBucketProps"
|
|
3690
|
-
},
|
|
3691
|
-
"@gammarers/aws-secure-bucket.SecureObjectOwnership": {
|
|
3692
|
-
"assembly": "@gammarers/aws-secure-bucket",
|
|
3693
|
-
"docs": {
|
|
3694
|
-
"see": "https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html",
|
|
3695
|
-
"stability": "stable",
|
|
3696
|
-
"summary": "The ObjectOwnership of the bucket."
|
|
3697
|
-
},
|
|
3698
|
-
"fqn": "@gammarers/aws-secure-bucket.SecureObjectOwnership",
|
|
3699
|
-
"kind": "enum",
|
|
3700
|
-
"locationInModule": {
|
|
3701
|
-
"filename": "src/index.ts",
|
|
3702
|
-
"line": 31
|
|
3703
|
-
},
|
|
3704
|
-
"members": [
|
|
3705
|
-
{
|
|
3706
|
-
"docs": {
|
|
3707
|
-
"remarks": "ACLs no longer affect permissions to data in the S3 bucket.\nThe bucket uses policies to define access control.",
|
|
3708
|
-
"stability": "stable",
|
|
3709
|
-
"summary": "ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket."
|
|
3710
|
-
},
|
|
3711
|
-
"name": "BUCKET_OWNER_ENFORCED"
|
|
3712
|
-
},
|
|
3713
|
-
{
|
|
3714
|
-
"docs": {
|
|
3715
|
-
"stability": "stable",
|
|
3716
|
-
"summary": "Objects uploaded to the bucket change ownership to the bucket owner ."
|
|
3717
|
-
},
|
|
3718
|
-
"name": "BUCKET_OWNER_PREFERRED"
|
|
3719
|
-
},
|
|
3720
|
-
{
|
|
3721
|
-
"docs": {
|
|
3722
|
-
"stability": "stable",
|
|
3723
|
-
"summary": "The uploading account will own the object."
|
|
3724
|
-
},
|
|
3725
|
-
"name": "OBJECT_WRITER"
|
|
3726
|
-
}
|
|
3727
|
-
],
|
|
3728
|
-
"name": "SecureObjectOwnership",
|
|
3729
|
-
"symbolId": "src/index:SecureObjectOwnership"
|
|
3730
3560
|
}
|
|
3731
3561
|
},
|
|
3732
|
-
"version": "1.
|
|
3733
|
-
"fingerprint": "
|
|
3562
|
+
"version": "1.5.0",
|
|
3563
|
+
"fingerprint": "00U9Z9anDN+BtiTCdXYYIGT+4QCs1GthPmsFjAH4CH4="
|
|
3734
3564
|
}
|
package/API.md
CHANGED
|
@@ -1135,12 +1135,103 @@ const secureBucketProps: SecureBucketProps = { ... }
|
|
|
1135
1135
|
|
|
1136
1136
|
| **Name** | **Type** | **Description** |
|
|
1137
1137
|
| --- | --- | --- |
|
|
1138
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.
|
|
1139
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.
|
|
1140
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.
|
|
1141
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.
|
|
1142
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.
|
|
1143
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.
|
|
1138
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.accessControl">accessControl</a></code> | <code>aws-cdk-lib.aws_s3.BucketAccessControl</code> | Specifies a canned ACL that grants predefined permissions to the bucket. |
|
|
1139
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.autoDeleteObjects">autoDeleteObjects</a></code> | <code>boolean</code> | Whether all objects should be automatically deleted when the bucket is removed from the stack or when the stack is deleted. |
|
|
1140
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.blockPublicAccess">blockPublicAccess</a></code> | <code>aws-cdk-lib.aws_s3.BlockPublicAccess</code> | The block public access configuration of this bucket. |
|
|
1141
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.bucketKeyEnabled">bucketKeyEnabled</a></code> | <code>boolean</code> | Whether Amazon S3 should use its own intermediary key to generate data keys. |
|
|
1142
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.bucketName">bucketName</a></code> | <code>string</code> | Physical name of this bucket. |
|
|
1143
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.cors">cors</a></code> | <code>aws-cdk-lib.aws_s3.CorsRule[]</code> | The CORS configuration of this bucket. |
|
|
1144
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.encryption">encryption</a></code> | <code>aws-cdk-lib.aws_s3.BucketEncryption</code> | The kind of server-side encryption to apply to this bucket. |
|
|
1145
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | External KMS key to use for bucket encryption. |
|
|
1146
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.enforceSSL">enforceSSL</a></code> | <code>boolean</code> | Enforces SSL for requests. |
|
|
1147
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.eventBridgeEnabled">eventBridgeEnabled</a></code> | <code>boolean</code> | Whether this bucket should send notifications to Amazon EventBridge or not. |
|
|
1148
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.intelligentTieringConfigurations">intelligentTieringConfigurations</a></code> | <code>aws-cdk-lib.aws_s3.IntelligentTieringConfiguration[]</code> | Inteligent Tiering Configurations. |
|
|
1149
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.inventories">inventories</a></code> | <code>aws-cdk-lib.aws_s3.Inventory[]</code> | The inventory configuration of the bucket. |
|
|
1150
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.lifecycleRules">lifecycleRules</a></code> | <code>aws-cdk-lib.aws_s3.LifecycleRule[]</code> | Rules that define how Amazon S3 manages objects during their lifetime. |
|
|
1151
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.metrics">metrics</a></code> | <code>aws-cdk-lib.aws_s3.BucketMetrics[]</code> | The metrics configuration of this bucket. |
|
|
1152
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.notificationsHandlerRole">notificationsHandlerRole</a></code> | <code>aws-cdk-lib.aws_iam.IRole</code> | The role to be used by the notifications handler. |
|
|
1153
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.objectLockDefaultRetention">objectLockDefaultRetention</a></code> | <code>aws-cdk-lib.aws_s3.ObjectLockRetention</code> | The default retention mode and rules for S3 Object Lock. |
|
|
1154
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.objectLockEnabled">objectLockEnabled</a></code> | <code>boolean</code> | Enable object lock on the bucket. |
|
|
1155
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.objectOwnership">objectOwnership</a></code> | <code>aws-cdk-lib.aws_s3.ObjectOwnership</code> | The objectOwnership of the bucket. |
|
|
1156
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.publicReadAccess">publicReadAccess</a></code> | <code>boolean</code> | Grants public read access to all objects in the bucket. |
|
|
1157
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.removalPolicy">removalPolicy</a></code> | <code>aws-cdk-lib.RemovalPolicy</code> | Policy to apply when the bucket is removed from this stack. |
|
|
1158
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.serverAccessLogsBucket">serverAccessLogsBucket</a></code> | <code>aws-cdk-lib.aws_s3.IBucket</code> | Destination bucket for the server access logs. |
|
|
1159
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.serverAccessLogsPrefix">serverAccessLogsPrefix</a></code> | <code>string</code> | Optional log file prefix to use for the bucket's access logs. |
|
|
1160
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.transferAcceleration">transferAcceleration</a></code> | <code>boolean</code> | Whether this bucket should have transfer acceleration turned on or not. |
|
|
1161
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.versioned">versioned</a></code> | <code>boolean</code> | Whether this bucket should have versioning turned on or not. |
|
|
1162
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.websiteErrorDocument">websiteErrorDocument</a></code> | <code>string</code> | The name of the error document (e.g. "404.html") for the website. `websiteIndexDocument` must also be set if this is set. |
|
|
1163
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.websiteIndexDocument">websiteIndexDocument</a></code> | <code>string</code> | The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket. |
|
|
1164
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.websiteRedirect">websiteRedirect</a></code> | <code>aws-cdk-lib.aws_s3.RedirectTarget</code> | Specifies the redirect behavior of all requests to a website endpoint of a bucket. |
|
|
1165
|
+
| <code><a href="#@gammarers/aws-secure-bucket.SecureBucketProps.property.websiteRoutingRules">websiteRoutingRules</a></code> | <code>aws-cdk-lib.aws_s3.RoutingRule[]</code> | Rules that define when a redirect is applied and the redirect behavior. |
|
|
1166
|
+
|
|
1167
|
+
---
|
|
1168
|
+
|
|
1169
|
+
##### `accessControl`<sup>Optional</sup> <a name="accessControl" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.accessControl"></a>
|
|
1170
|
+
|
|
1171
|
+
```typescript
|
|
1172
|
+
public readonly accessControl: BucketAccessControl;
|
|
1173
|
+
```
|
|
1174
|
+
|
|
1175
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketAccessControl
|
|
1176
|
+
- *Default:* BucketAccessControl.PRIVATE
|
|
1177
|
+
|
|
1178
|
+
Specifies a canned ACL that grants predefined permissions to the bucket.
|
|
1179
|
+
|
|
1180
|
+
---
|
|
1181
|
+
|
|
1182
|
+
##### `autoDeleteObjects`<sup>Optional</sup> <a name="autoDeleteObjects" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.autoDeleteObjects"></a>
|
|
1183
|
+
|
|
1184
|
+
```typescript
|
|
1185
|
+
public readonly autoDeleteObjects: boolean;
|
|
1186
|
+
```
|
|
1187
|
+
|
|
1188
|
+
- *Type:* boolean
|
|
1189
|
+
- *Default:* false
|
|
1190
|
+
|
|
1191
|
+
Whether all objects should be automatically deleted when the bucket is removed from the stack or when the stack is deleted.
|
|
1192
|
+
|
|
1193
|
+
Requires the `removalPolicy` to be set to `RemovalPolicy.DESTROY`.
|
|
1194
|
+
|
|
1195
|
+
**Warning** if you have deployed a bucket with `autoDeleteObjects: true`,
|
|
1196
|
+
switching this to `false` in a CDK version *before* `1.126.0` will lead to
|
|
1197
|
+
all objects in the bucket being deleted. Be sure to update your bucket resources
|
|
1198
|
+
by deploying with CDK version `1.126.0` or later **before** switching this value to `false`.
|
|
1199
|
+
|
|
1200
|
+
---
|
|
1201
|
+
|
|
1202
|
+
##### `blockPublicAccess`<sup>Optional</sup> <a name="blockPublicAccess" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.blockPublicAccess"></a>
|
|
1203
|
+
|
|
1204
|
+
```typescript
|
|
1205
|
+
public readonly blockPublicAccess: BlockPublicAccess;
|
|
1206
|
+
```
|
|
1207
|
+
|
|
1208
|
+
- *Type:* aws-cdk-lib.aws_s3.BlockPublicAccess
|
|
1209
|
+
- *Default:* CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
|
|
1210
|
+
|
|
1211
|
+
The block public access configuration of this bucket.
|
|
1212
|
+
|
|
1213
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html)
|
|
1214
|
+
|
|
1215
|
+
---
|
|
1216
|
+
|
|
1217
|
+
##### `bucketKeyEnabled`<sup>Optional</sup> <a name="bucketKeyEnabled" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.bucketKeyEnabled"></a>
|
|
1218
|
+
|
|
1219
|
+
```typescript
|
|
1220
|
+
public readonly bucketKeyEnabled: boolean;
|
|
1221
|
+
```
|
|
1222
|
+
|
|
1223
|
+
- *Type:* boolean
|
|
1224
|
+
- *Default:* false
|
|
1225
|
+
|
|
1226
|
+
Whether Amazon S3 should use its own intermediary key to generate data keys.
|
|
1227
|
+
|
|
1228
|
+
Only relevant when using KMS for encryption.
|
|
1229
|
+
|
|
1230
|
+
- If not enabled, every object GET and PUT will cause an API call to KMS (with the
|
|
1231
|
+
attendant cost implications of that).
|
|
1232
|
+
- If enabled, S3 will use its own time-limited key instead.
|
|
1233
|
+
|
|
1234
|
+
Only relevant, when Encryption is set to `BucketEncryption.KMS` or `BucketEncryption.KMS_MANAGED`.
|
|
1144
1235
|
|
|
1145
1236
|
---
|
|
1146
1237
|
|
|
@@ -1151,16 +1242,74 @@ public readonly bucketName: string;
|
|
|
1151
1242
|
```
|
|
1152
1243
|
|
|
1153
1244
|
- *Type:* string
|
|
1245
|
+
- *Default:* Assigned by CloudFormation (recommended).
|
|
1246
|
+
|
|
1247
|
+
Physical name of this bucket.
|
|
1248
|
+
|
|
1249
|
+
---
|
|
1250
|
+
|
|
1251
|
+
##### `cors`<sup>Optional</sup> <a name="cors" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.cors"></a>
|
|
1252
|
+
|
|
1253
|
+
```typescript
|
|
1254
|
+
public readonly cors: CorsRule[];
|
|
1255
|
+
```
|
|
1256
|
+
|
|
1257
|
+
- *Type:* aws-cdk-lib.aws_s3.CorsRule[]
|
|
1258
|
+
- *Default:* No CORS configuration.
|
|
1259
|
+
|
|
1260
|
+
The CORS configuration of this bucket.
|
|
1261
|
+
|
|
1262
|
+
> [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-cors.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-cors.html)
|
|
1154
1263
|
|
|
1155
1264
|
---
|
|
1156
1265
|
|
|
1157
1266
|
##### `encryption`<sup>Optional</sup> <a name="encryption" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.encryption"></a>
|
|
1158
1267
|
|
|
1159
1268
|
```typescript
|
|
1160
|
-
public readonly encryption:
|
|
1269
|
+
public readonly encryption: BucketEncryption;
|
|
1161
1270
|
```
|
|
1162
1271
|
|
|
1163
|
-
- *Type:*
|
|
1272
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketEncryption
|
|
1273
|
+
- *Default:* `Kms` if `encryptionKey` is specified, or `Managed` otherwise.
|
|
1274
|
+
|
|
1275
|
+
The kind of server-side encryption to apply to this bucket.
|
|
1276
|
+
|
|
1277
|
+
If you choose KMS, you can specify a KMS key via `encryptionKey`. If
|
|
1278
|
+
encryption key is not specified, a key will automatically be created.
|
|
1279
|
+
|
|
1280
|
+
---
|
|
1281
|
+
|
|
1282
|
+
##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.encryptionKey"></a>
|
|
1283
|
+
|
|
1284
|
+
```typescript
|
|
1285
|
+
public readonly encryptionKey: IKey;
|
|
1286
|
+
```
|
|
1287
|
+
|
|
1288
|
+
- *Type:* aws-cdk-lib.aws_kms.IKey
|
|
1289
|
+
- *Default:* If encryption is set to "Kms" and this property is undefined, a new KMS key will be created and associated with this bucket.
|
|
1290
|
+
|
|
1291
|
+
External KMS key to use for bucket encryption.
|
|
1292
|
+
|
|
1293
|
+
The 'encryption' property must be either not specified or set to "Kms".
|
|
1294
|
+
An error will be emitted if encryption is set to "Unencrypted" or
|
|
1295
|
+
"Managed".
|
|
1296
|
+
|
|
1297
|
+
---
|
|
1298
|
+
|
|
1299
|
+
##### `enforceSSL`<sup>Optional</sup> <a name="enforceSSL" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.enforceSSL"></a>
|
|
1300
|
+
|
|
1301
|
+
```typescript
|
|
1302
|
+
public readonly enforceSSL: boolean;
|
|
1303
|
+
```
|
|
1304
|
+
|
|
1305
|
+
- *Type:* boolean
|
|
1306
|
+
- *Default:* false
|
|
1307
|
+
|
|
1308
|
+
Enforces SSL for requests.
|
|
1309
|
+
|
|
1310
|
+
S3.5 of the AWS Foundational Security Best Practices Regarding S3.
|
|
1311
|
+
|
|
1312
|
+
> [https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html](https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html)
|
|
1164
1313
|
|
|
1165
1314
|
---
|
|
1166
1315
|
|
|
@@ -1171,6 +1320,39 @@ public readonly eventBridgeEnabled: boolean;
|
|
|
1171
1320
|
```
|
|
1172
1321
|
|
|
1173
1322
|
- *Type:* boolean
|
|
1323
|
+
- *Default:* false
|
|
1324
|
+
|
|
1325
|
+
Whether this bucket should send notifications to Amazon EventBridge or not.
|
|
1326
|
+
|
|
1327
|
+
---
|
|
1328
|
+
|
|
1329
|
+
##### `intelligentTieringConfigurations`<sup>Optional</sup> <a name="intelligentTieringConfigurations" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.intelligentTieringConfigurations"></a>
|
|
1330
|
+
|
|
1331
|
+
```typescript
|
|
1332
|
+
public readonly intelligentTieringConfigurations: IntelligentTieringConfiguration[];
|
|
1333
|
+
```
|
|
1334
|
+
|
|
1335
|
+
- *Type:* aws-cdk-lib.aws_s3.IntelligentTieringConfiguration[]
|
|
1336
|
+
- *Default:* No Intelligent Tiiering Configurations.
|
|
1337
|
+
|
|
1338
|
+
Inteligent Tiering Configurations.
|
|
1339
|
+
|
|
1340
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering.html)
|
|
1341
|
+
|
|
1342
|
+
---
|
|
1343
|
+
|
|
1344
|
+
##### `inventories`<sup>Optional</sup> <a name="inventories" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.inventories"></a>
|
|
1345
|
+
|
|
1346
|
+
```typescript
|
|
1347
|
+
public readonly inventories: Inventory[];
|
|
1348
|
+
```
|
|
1349
|
+
|
|
1350
|
+
- *Type:* aws-cdk-lib.aws_s3.Inventory[]
|
|
1351
|
+
- *Default:* No inventory configuration
|
|
1352
|
+
|
|
1353
|
+
The inventory configuration of the bucket.
|
|
1354
|
+
|
|
1355
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html)
|
|
1174
1356
|
|
|
1175
1357
|
---
|
|
1176
1358
|
|
|
@@ -1181,94 +1363,226 @@ public readonly lifecycleRules: LifecycleRule[];
|
|
|
1181
1363
|
```
|
|
1182
1364
|
|
|
1183
1365
|
- *Type:* aws-cdk-lib.aws_s3.LifecycleRule[]
|
|
1366
|
+
- *Default:* No lifecycle rules.
|
|
1367
|
+
|
|
1368
|
+
Rules that define how Amazon S3 manages objects during their lifetime.
|
|
1369
|
+
|
|
1370
|
+
---
|
|
1371
|
+
|
|
1372
|
+
##### `metrics`<sup>Optional</sup> <a name="metrics" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.metrics"></a>
|
|
1373
|
+
|
|
1374
|
+
```typescript
|
|
1375
|
+
public readonly metrics: BucketMetrics[];
|
|
1376
|
+
```
|
|
1377
|
+
|
|
1378
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketMetrics[]
|
|
1379
|
+
- *Default:* No metrics configuration.
|
|
1380
|
+
|
|
1381
|
+
The metrics configuration of this bucket.
|
|
1382
|
+
|
|
1383
|
+
> [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-metricsconfiguration.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-metricsconfiguration.html)
|
|
1384
|
+
|
|
1385
|
+
---
|
|
1386
|
+
|
|
1387
|
+
##### `notificationsHandlerRole`<sup>Optional</sup> <a name="notificationsHandlerRole" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.notificationsHandlerRole"></a>
|
|
1388
|
+
|
|
1389
|
+
```typescript
|
|
1390
|
+
public readonly notificationsHandlerRole: IRole;
|
|
1391
|
+
```
|
|
1392
|
+
|
|
1393
|
+
- *Type:* aws-cdk-lib.aws_iam.IRole
|
|
1394
|
+
- *Default:* a new role will be created.
|
|
1395
|
+
|
|
1396
|
+
The role to be used by the notifications handler.
|
|
1397
|
+
|
|
1398
|
+
---
|
|
1399
|
+
|
|
1400
|
+
##### `objectLockDefaultRetention`<sup>Optional</sup> <a name="objectLockDefaultRetention" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.objectLockDefaultRetention"></a>
|
|
1401
|
+
|
|
1402
|
+
```typescript
|
|
1403
|
+
public readonly objectLockDefaultRetention: ObjectLockRetention;
|
|
1404
|
+
```
|
|
1405
|
+
|
|
1406
|
+
- *Type:* aws-cdk-lib.aws_s3.ObjectLockRetention
|
|
1407
|
+
- *Default:* no default retention period
|
|
1408
|
+
|
|
1409
|
+
The default retention mode and rules for S3 Object Lock.
|
|
1410
|
+
|
|
1411
|
+
Default retention can be configured after a bucket is created if the bucket already
|
|
1412
|
+
has object lock enabled. Enabling object lock for existing buckets is not supported.
|
|
1413
|
+
|
|
1414
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-config-enable](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-config-enable)
|
|
1415
|
+
|
|
1416
|
+
---
|
|
1417
|
+
|
|
1418
|
+
##### `objectLockEnabled`<sup>Optional</sup> <a name="objectLockEnabled" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.objectLockEnabled"></a>
|
|
1419
|
+
|
|
1420
|
+
```typescript
|
|
1421
|
+
public readonly objectLockEnabled: boolean;
|
|
1422
|
+
```
|
|
1423
|
+
|
|
1424
|
+
- *Type:* boolean
|
|
1425
|
+
- *Default:* false, unless objectLockDefaultRetention is set (then, true)
|
|
1426
|
+
|
|
1427
|
+
Enable object lock on the bucket.
|
|
1428
|
+
|
|
1429
|
+
Enabling object lock for existing buckets is not supported. Object lock must be
|
|
1430
|
+
enabled when the bucket is created.
|
|
1431
|
+
|
|
1432
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-config-enable](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-config-enable)
|
|
1184
1433
|
|
|
1185
1434
|
---
|
|
1186
1435
|
|
|
1187
1436
|
##### `objectOwnership`<sup>Optional</sup> <a name="objectOwnership" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.objectOwnership"></a>
|
|
1188
1437
|
|
|
1189
1438
|
```typescript
|
|
1190
|
-
public readonly objectOwnership:
|
|
1439
|
+
public readonly objectOwnership: ObjectOwnership;
|
|
1191
1440
|
```
|
|
1192
1441
|
|
|
1193
|
-
- *Type:*
|
|
1442
|
+
- *Type:* aws-cdk-lib.aws_s3.ObjectOwnership
|
|
1443
|
+
- *Default:* No ObjectOwnership configuration, uploading account will own the object.
|
|
1444
|
+
|
|
1445
|
+
The objectOwnership of the bucket.
|
|
1446
|
+
|
|
1447
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html)
|
|
1194
1448
|
|
|
1195
1449
|
---
|
|
1196
1450
|
|
|
1197
|
-
##### `
|
|
1451
|
+
##### `publicReadAccess`<sup>Optional</sup> <a name="publicReadAccess" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.publicReadAccess"></a>
|
|
1198
1452
|
|
|
1199
1453
|
```typescript
|
|
1200
|
-
public readonly
|
|
1454
|
+
public readonly publicReadAccess: boolean;
|
|
1201
1455
|
```
|
|
1202
1456
|
|
|
1203
1457
|
- *Type:* boolean
|
|
1458
|
+
- *Default:* false
|
|
1459
|
+
|
|
1460
|
+
Grants public read access to all objects in the bucket.
|
|
1461
|
+
|
|
1462
|
+
Similar to calling `bucket.grantPublicAccess()`
|
|
1204
1463
|
|
|
1205
1464
|
---
|
|
1206
1465
|
|
|
1466
|
+
##### `removalPolicy`<sup>Optional</sup> <a name="removalPolicy" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.removalPolicy"></a>
|
|
1467
|
+
|
|
1468
|
+
```typescript
|
|
1469
|
+
public readonly removalPolicy: RemovalPolicy;
|
|
1470
|
+
```
|
|
1471
|
+
|
|
1472
|
+
- *Type:* aws-cdk-lib.RemovalPolicy
|
|
1473
|
+
- *Default:* The bucket will be orphaned.
|
|
1207
1474
|
|
|
1475
|
+
Policy to apply when the bucket is removed from this stack.
|
|
1208
1476
|
|
|
1209
|
-
|
|
1477
|
+
---
|
|
1210
1478
|
|
|
1211
|
-
|
|
1479
|
+
##### `serverAccessLogsBucket`<sup>Optional</sup> <a name="serverAccessLogsBucket" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.serverAccessLogsBucket"></a>
|
|
1212
1480
|
|
|
1213
|
-
|
|
1481
|
+
```typescript
|
|
1482
|
+
public readonly serverAccessLogsBucket: IBucket;
|
|
1483
|
+
```
|
|
1214
1484
|
|
|
1215
|
-
|
|
1216
|
-
|
|
1217
|
-
|
|
1218
|
-
|
|
1485
|
+
- *Type:* aws-cdk-lib.aws_s3.IBucket
|
|
1486
|
+
- *Default:* If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
|
|
1487
|
+
|
|
1488
|
+
Destination bucket for the server access logs.
|
|
1219
1489
|
|
|
1220
1490
|
---
|
|
1221
1491
|
|
|
1222
|
-
##### `
|
|
1492
|
+
##### `serverAccessLogsPrefix`<sup>Optional</sup> <a name="serverAccessLogsPrefix" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.serverAccessLogsPrefix"></a>
|
|
1493
|
+
|
|
1494
|
+
```typescript
|
|
1495
|
+
public readonly serverAccessLogsPrefix: string;
|
|
1496
|
+
```
|
|
1223
1497
|
|
|
1224
|
-
|
|
1498
|
+
- *Type:* string
|
|
1499
|
+
- *Default:* No log file prefix
|
|
1500
|
+
|
|
1501
|
+
Optional log file prefix to use for the bucket's access logs.
|
|
1502
|
+
|
|
1503
|
+
If defined without "serverAccessLogsBucket", enables access logs to current bucket with this prefix.
|
|
1225
1504
|
|
|
1226
1505
|
---
|
|
1227
1506
|
|
|
1507
|
+
##### `transferAcceleration`<sup>Optional</sup> <a name="transferAcceleration" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.transferAcceleration"></a>
|
|
1508
|
+
|
|
1509
|
+
```typescript
|
|
1510
|
+
public readonly transferAcceleration: boolean;
|
|
1511
|
+
```
|
|
1228
1512
|
|
|
1229
|
-
|
|
1513
|
+
- *Type:* boolean
|
|
1514
|
+
- *Default:* false
|
|
1230
1515
|
|
|
1231
|
-
|
|
1516
|
+
Whether this bucket should have transfer acceleration turned on or not.
|
|
1232
1517
|
|
|
1233
1518
|
---
|
|
1234
1519
|
|
|
1520
|
+
##### `versioned`<sup>Optional</sup> <a name="versioned" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.versioned"></a>
|
|
1521
|
+
|
|
1522
|
+
```typescript
|
|
1523
|
+
public readonly versioned: boolean;
|
|
1524
|
+
```
|
|
1525
|
+
|
|
1526
|
+
- *Type:* boolean
|
|
1527
|
+
- *Default:* false (unless object lock is enabled, then true)
|
|
1528
|
+
|
|
1529
|
+
Whether this bucket should have versioning turned on or not.
|
|
1235
1530
|
|
|
1236
|
-
|
|
1531
|
+
---
|
|
1237
1532
|
|
|
1238
|
-
|
|
1533
|
+
##### `websiteErrorDocument`<sup>Optional</sup> <a name="websiteErrorDocument" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.websiteErrorDocument"></a>
|
|
1239
1534
|
|
|
1240
|
-
|
|
1535
|
+
```typescript
|
|
1536
|
+
public readonly websiteErrorDocument: string;
|
|
1537
|
+
```
|
|
1241
1538
|
|
|
1242
|
-
|
|
1539
|
+
- *Type:* string
|
|
1540
|
+
- *Default:* No error document.
|
|
1243
1541
|
|
|
1244
|
-
|
|
1245
|
-
| --- | --- |
|
|
1246
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureObjectOwnership.BUCKET_OWNER_ENFORCED">BUCKET_OWNER_ENFORCED</a></code> | ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. |
|
|
1247
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureObjectOwnership.BUCKET_OWNER_PREFERRED">BUCKET_OWNER_PREFERRED</a></code> | Objects uploaded to the bucket change ownership to the bucket owner . |
|
|
1248
|
-
| <code><a href="#@gammarers/aws-secure-bucket.SecureObjectOwnership.OBJECT_WRITER">OBJECT_WRITER</a></code> | The uploading account will own the object. |
|
|
1542
|
+
The name of the error document (e.g. "404.html") for the website. `websiteIndexDocument` must also be set if this is set.
|
|
1249
1543
|
|
|
1250
1544
|
---
|
|
1251
1545
|
|
|
1252
|
-
##### `
|
|
1546
|
+
##### `websiteIndexDocument`<sup>Optional</sup> <a name="websiteIndexDocument" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.websiteIndexDocument"></a>
|
|
1253
1547
|
|
|
1254
|
-
|
|
1548
|
+
```typescript
|
|
1549
|
+
public readonly websiteIndexDocument: string;
|
|
1550
|
+
```
|
|
1255
1551
|
|
|
1256
|
-
|
|
1257
|
-
|
|
1552
|
+
- *Type:* string
|
|
1553
|
+
- *Default:* No index document.
|
|
1554
|
+
|
|
1555
|
+
The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket.
|
|
1258
1556
|
|
|
1259
1557
|
---
|
|
1260
1558
|
|
|
1559
|
+
##### `websiteRedirect`<sup>Optional</sup> <a name="websiteRedirect" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.websiteRedirect"></a>
|
|
1560
|
+
|
|
1561
|
+
```typescript
|
|
1562
|
+
public readonly websiteRedirect: RedirectTarget;
|
|
1563
|
+
```
|
|
1564
|
+
|
|
1565
|
+
- *Type:* aws-cdk-lib.aws_s3.RedirectTarget
|
|
1566
|
+
- *Default:* No redirection.
|
|
1261
1567
|
|
|
1262
|
-
|
|
1568
|
+
Specifies the redirect behavior of all requests to a website endpoint of a bucket.
|
|
1263
1569
|
|
|
1264
|
-
|
|
1570
|
+
If you specify this property, you can't specify "websiteIndexDocument", "websiteErrorDocument" nor , "websiteRoutingRules".
|
|
1265
1571
|
|
|
1266
1572
|
---
|
|
1267
1573
|
|
|
1574
|
+
##### `websiteRoutingRules`<sup>Optional</sup> <a name="websiteRoutingRules" id="@gammarers/aws-secure-bucket.SecureBucketProps.property.websiteRoutingRules"></a>
|
|
1268
1575
|
|
|
1269
|
-
|
|
1576
|
+
```typescript
|
|
1577
|
+
public readonly websiteRoutingRules: RoutingRule[];
|
|
1578
|
+
```
|
|
1579
|
+
|
|
1580
|
+
- *Type:* aws-cdk-lib.aws_s3.RoutingRule[]
|
|
1581
|
+
- *Default:* No redirection rules.
|
|
1270
1582
|
|
|
1271
|
-
|
|
1583
|
+
Rules that define when a redirect is applied and the redirect behavior.
|
|
1272
1584
|
|
|
1273
1585
|
---
|
|
1274
1586
|
|
|
1587
|
+
|
|
1588
|
+
|
package/lib/index.d.ts
CHANGED
|
@@ -1,45 +1,6 @@
|
|
|
1
1
|
import * as s3 from 'aws-cdk-lib/aws-s3';
|
|
2
2
|
import { Construct } from 'constructs';
|
|
3
|
-
export interface SecureBucketProps {
|
|
4
|
-
readonly bucketName?: string;
|
|
5
|
-
readonly encryption?: SecureBucketEncryption;
|
|
6
|
-
readonly versioned?: boolean;
|
|
7
|
-
readonly eventBridgeEnabled?: boolean;
|
|
8
|
-
readonly lifecycleRules?: s3.LifecycleRule[];
|
|
9
|
-
readonly objectOwnership?: SecureObjectOwnership;
|
|
10
|
-
}
|
|
11
|
-
export declare enum SecureBucketEncryption {
|
|
12
|
-
/**
|
|
13
|
-
* Server-side KMS encryption with a master key managed by KMS.
|
|
14
|
-
*/
|
|
15
|
-
KMS_MANAGED = "KMS_MANAGED",
|
|
16
|
-
/**
|
|
17
|
-
* Server-side encryption with a master key managed by S3.
|
|
18
|
-
*/
|
|
19
|
-
S3_MANAGED = "S3_MANAGED"
|
|
20
|
-
}
|
|
21
|
-
/**
|
|
22
|
-
* The ObjectOwnership of the bucket.
|
|
23
|
-
*
|
|
24
|
-
* @see https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html
|
|
25
|
-
*
|
|
26
|
-
*/
|
|
27
|
-
export declare enum SecureObjectOwnership {
|
|
28
|
-
/**
|
|
29
|
-
* ACLs are disabled, and the bucket owner automatically owns
|
|
30
|
-
* and has full control over every object in the bucket.
|
|
31
|
-
* ACLs no longer affect permissions to data in the S3 bucket.
|
|
32
|
-
* The bucket uses policies to define access control.
|
|
33
|
-
*/
|
|
34
|
-
BUCKET_OWNER_ENFORCED = "BucketOwnerEnforced",
|
|
35
|
-
/**
|
|
36
|
-
* Objects uploaded to the bucket change ownership to the bucket owner .
|
|
37
|
-
*/
|
|
38
|
-
BUCKET_OWNER_PREFERRED = "BucketOwnerPreferred",
|
|
39
|
-
/**
|
|
40
|
-
* The uploading account will own the object.
|
|
41
|
-
*/
|
|
42
|
-
OBJECT_WRITER = "ObjectWriter"
|
|
3
|
+
export interface SecureBucketProps extends s3.BucketProps {
|
|
43
4
|
}
|
|
44
5
|
export declare class SecureBucket extends s3.Bucket {
|
|
45
6
|
constructor(scope: Construct, id: string, props?: SecureBucketProps);
|
package/lib/index.js
CHANGED
|
@@ -1,77 +1,40 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
var _a;
|
|
3
3
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
4
|
-
exports.SecureBucket =
|
|
4
|
+
exports.SecureBucket = void 0;
|
|
5
5
|
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
|
|
6
6
|
const cdk = require("aws-cdk-lib");
|
|
7
7
|
const s3 = require("aws-cdk-lib/aws-s3");
|
|
8
|
-
var SecureBucketEncryption;
|
|
9
|
-
(function (SecureBucketEncryption) {
|
|
10
|
-
/**
|
|
11
|
-
* Server-side KMS encryption with a master key managed by KMS.
|
|
12
|
-
*/
|
|
13
|
-
SecureBucketEncryption["KMS_MANAGED"] = "KMS_MANAGED";
|
|
14
|
-
/**
|
|
15
|
-
* Server-side encryption with a master key managed by S3.
|
|
16
|
-
*/
|
|
17
|
-
SecureBucketEncryption["S3_MANAGED"] = "S3_MANAGED";
|
|
18
|
-
})(SecureBucketEncryption || (exports.SecureBucketEncryption = SecureBucketEncryption = {}));
|
|
19
|
-
/**
|
|
20
|
-
* The ObjectOwnership of the bucket.
|
|
21
|
-
*
|
|
22
|
-
* @see https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html
|
|
23
|
-
*
|
|
24
|
-
*/
|
|
25
|
-
var SecureObjectOwnership;
|
|
26
|
-
(function (SecureObjectOwnership) {
|
|
27
|
-
/**
|
|
28
|
-
* ACLs are disabled, and the bucket owner automatically owns
|
|
29
|
-
* and has full control over every object in the bucket.
|
|
30
|
-
* ACLs no longer affect permissions to data in the S3 bucket.
|
|
31
|
-
* The bucket uses policies to define access control.
|
|
32
|
-
*/
|
|
33
|
-
SecureObjectOwnership["BUCKET_OWNER_ENFORCED"] = "BucketOwnerEnforced";
|
|
34
|
-
/**
|
|
35
|
-
* Objects uploaded to the bucket change ownership to the bucket owner .
|
|
36
|
-
*/
|
|
37
|
-
SecureObjectOwnership["BUCKET_OWNER_PREFERRED"] = "BucketOwnerPreferred";
|
|
38
|
-
/**
|
|
39
|
-
* The uploading account will own the object.
|
|
40
|
-
*/
|
|
41
|
-
SecureObjectOwnership["OBJECT_WRITER"] = "ObjectWriter";
|
|
42
|
-
})(SecureObjectOwnership || (exports.SecureObjectOwnership = SecureObjectOwnership = {}));
|
|
43
8
|
class SecureBucket extends s3.Bucket {
|
|
44
9
|
constructor(scope, id, props) {
|
|
45
10
|
super(scope, id, {
|
|
46
|
-
|
|
47
|
-
accessControl: s3.BucketAccessControl.PRIVATE,
|
|
11
|
+
...props,
|
|
48
12
|
removalPolicy: cdk.RemovalPolicy.RETAIN,
|
|
49
13
|
encryption: (() => {
|
|
50
|
-
if (props?.encryption) {
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
14
|
+
if (!props?.encryption) {
|
|
15
|
+
return s3.BucketEncryption.KMS_MANAGED;
|
|
16
|
+
}
|
|
17
|
+
else {
|
|
18
|
+
if (props.encryption === s3.BucketEncryption.UNENCRYPTED) {
|
|
19
|
+
throw new Error('DeplicatedArgumentFoundError: BucketEncryption.UNENCRYPTED is deplicated, Bucket cano not be unencrypted.');
|
|
56
20
|
}
|
|
57
21
|
}
|
|
58
|
-
return
|
|
22
|
+
return props.encryption;
|
|
23
|
+
})(),
|
|
24
|
+
accessControl: (() => {
|
|
25
|
+
if (!props?.accessControl) {
|
|
26
|
+
return s3.BucketAccessControl.PRIVATE;
|
|
27
|
+
}
|
|
28
|
+
return props.accessControl;
|
|
59
29
|
})(),
|
|
30
|
+
eventBridgeEnabled: undefined,
|
|
60
31
|
publicReadAccess: false,
|
|
61
32
|
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
|
|
62
33
|
enforceSSL: true,
|
|
63
|
-
versioned: props?.versioned ? props.versioned : true,
|
|
64
|
-
lifecycleRules: props?.lifecycleRules,
|
|
34
|
+
versioned: props?.versioned !== undefined ? props.versioned : true,
|
|
65
35
|
objectOwnership: (() => {
|
|
66
36
|
if (props?.objectOwnership) {
|
|
67
|
-
|
|
68
|
-
case SecureObjectOwnership.BUCKET_OWNER_ENFORCED:
|
|
69
|
-
return s3.ObjectOwnership.BUCKET_OWNER_ENFORCED;
|
|
70
|
-
case SecureObjectOwnership.BUCKET_OWNER_PREFERRED:
|
|
71
|
-
return s3.ObjectOwnership.BUCKET_OWNER_PREFERRED;
|
|
72
|
-
case SecureObjectOwnership.OBJECT_WRITER:
|
|
73
|
-
return s3.ObjectOwnership.OBJECT_WRITER;
|
|
74
|
-
}
|
|
37
|
+
return props.objectOwnership;
|
|
75
38
|
}
|
|
76
39
|
return s3.ObjectOwnership.BUCKET_OWNER_ENFORCED;
|
|
77
40
|
})(),
|
|
@@ -81,14 +44,9 @@ class SecureBucket extends s3.Bucket {
|
|
|
81
44
|
if (props?.eventBridgeEnabled === true) {
|
|
82
45
|
cfnBucket.addPropertyOverride('NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled', true);
|
|
83
46
|
}
|
|
84
|
-
// todo: cloudTrailEnabled
|
|
85
|
-
// const trail = new cloudtrail.Trail(this, 'Trail');
|
|
86
|
-
// trail.addS3EventSelector([{ bucket: this }], {
|
|
87
|
-
// readWriteType: cloudtrail.ReadWriteType.ALL,
|
|
88
|
-
// });
|
|
89
47
|
}
|
|
90
48
|
}
|
|
91
49
|
exports.SecureBucket = SecureBucket;
|
|
92
50
|
_a = JSII_RTTI_SYMBOL_1;
|
|
93
|
-
SecureBucket[_a] = { fqn: "@gammarers/aws-secure-bucket.SecureBucket", version: "1.
|
|
94
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
51
|
+
SecureBucket[_a] = { fqn: "@gammarers/aws-secure-bucket.SecureBucket", version: "1.5.0" };
|
|
52
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxtQ0FBbUM7QUFDbkMseUNBQXlDO0FBS3pDLE1BQWEsWUFBYSxTQUFRLEVBQUUsQ0FBQyxNQUFNO0lBQ3pDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBeUI7UUFDakUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixHQUFHLEtBQUs7WUFDUixhQUFhLEVBQUUsR0FBRyxDQUFDLGFBQWEsQ0FBQyxNQUFNO1lBQ3ZDLFVBQVUsRUFBRSxDQUFDLEdBQUcsRUFBRTtnQkFDaEIsSUFBSSxDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsQ0FBQztvQkFDdkIsT0FBTyxFQUFFLENBQUMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDO2dCQUN6QyxDQUFDO3FCQUFNLENBQUM7b0JBQ04sSUFBSSxLQUFLLENBQUMsVUFBVSxLQUFLLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxXQUFXLEVBQUUsQ0FBQzt3QkFDekQsTUFBTSxJQUFJLEtBQUssQ0FBQywyR0FBMkcsQ0FBQyxDQUFDO29CQUMvSCxDQUFDO2dCQUNILENBQUM7Z0JBQ0QsT0FBTyxLQUFLLENBQUMsVUFBVSxDQUFDO1lBQzFCLENBQUMsQ0FBQyxFQUFFO1lBQ0osYUFBYSxFQUFFLENBQUMsR0FBRyxFQUFFO2dCQUNuQixJQUFJLENBQUMsS0FBSyxFQUFFLGFBQWEsRUFBRSxDQUFDO29CQUMxQixPQUFPLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLENBQUM7Z0JBQ3hDLENBQUM7Z0JBQ0QsT0FBTyxLQUFLLENBQUMsYUFBYSxDQUFDO1lBQzdCLENBQUMsQ0FBQyxFQUFFO1lBQ0osa0JBQWtCLEVBQUUsU0FBUztZQUM3QixnQkFBZ0IsRUFBRSxLQUFLO1lBQ3ZCLGlCQUFpQixFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTO1lBQ2pELFVBQVUsRUFBRSxJQUFJO1lBQ2hCLFNBQVMsRUFBRSxLQUFLLEVBQUUsU0FBUyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUNsRSxlQUFlLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ3JCLElBQUksS0FBSyxFQUFFLGVBQWUsRUFBRSxDQUFDO29CQUMzQixPQUFPLEtBQUssQ0FBQyxlQUFlLENBQUM7Z0JBQy9CLENBQUM7Z0JBQ0QsT0FBTyxFQUFFLENBQUMsZUFBZSxDQUFDLHFCQUFxQixDQUFDO1lBQ2xELENBQUMsQ0FBQyxFQUFFO1NBQ0wsQ0FBQyxDQUFDO1FBRUgsZ0JBQWdCO1FBQ2hCLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsWUFBNEIsQ0FBQztRQUN6RCxJQUFJLEtBQUssRUFBRSxrQkFBa0IsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUN2QyxTQUFTLENBQUMsbUJBQW1CLENBQUMsdUVBQXVFLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDL0csQ0FBQztJQUNILENBQUM7O0FBdkNILG9DQXdDQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGNkayBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBzMyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtczMnO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgU2VjdXJlQnVja2V0UHJvcHMgZXh0ZW5kcyBzMy5CdWNrZXRQcm9wcyB7fVxuXG5leHBvcnQgY2xhc3MgU2VjdXJlQnVja2V0IGV4dGVuZHMgczMuQnVja2V0IHtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM/OiBTZWN1cmVCdWNrZXRQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICByZW1vdmFsUG9saWN5OiBjZGsuUmVtb3ZhbFBvbGljeS5SRVRBSU4sXG4gICAgICBlbmNyeXB0aW9uOiAoKCkgPT4ge1xuICAgICAgICBpZiAoIXByb3BzPy5lbmNyeXB0aW9uKSB7XG4gICAgICAgICAgcmV0dXJuIHMzLkJ1Y2tldEVuY3J5cHRpb24uS01TX01BTkFHRUQ7XG4gICAgICAgIH0gZWxzZSB7XG4gICAgICAgICAgaWYgKHByb3BzLmVuY3J5cHRpb24gPT09IHMzLkJ1Y2tldEVuY3J5cHRpb24uVU5FTkNSWVBURUQpIHtcbiAgICAgICAgICAgIHRocm93IG5ldyBFcnJvcignRGVwbGljYXRlZEFyZ3VtZW50Rm91bmRFcnJvcjogQnVja2V0RW5jcnlwdGlvbi5VTkVOQ1JZUFRFRCBpcyBkZXBsaWNhdGVkLCBCdWNrZXQgY2FubyBub3QgYmUgdW5lbmNyeXB0ZWQuJyk7XG4gICAgICAgICAgfVxuICAgICAgICB9XG4gICAgICAgIHJldHVybiBwcm9wcy5lbmNyeXB0aW9uO1xuICAgICAgfSkoKSxcbiAgICAgIGFjY2Vzc0NvbnRyb2w6ICgoKSA9PiB7XG4gICAgICAgIGlmICghcHJvcHM/LmFjY2Vzc0NvbnRyb2wpIHtcbiAgICAgICAgICByZXR1cm4gczMuQnVja2V0QWNjZXNzQ29udHJvbC5QUklWQVRFO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBwcm9wcy5hY2Nlc3NDb250cm9sO1xuICAgICAgfSkoKSxcbiAgICAgIGV2ZW50QnJpZGdlRW5hYmxlZDogdW5kZWZpbmVkLFxuICAgICAgcHVibGljUmVhZEFjY2VzczogZmFsc2UsXG4gICAgICBibG9ja1B1YmxpY0FjY2VzczogczMuQmxvY2tQdWJsaWNBY2Nlc3MuQkxPQ0tfQUxMLFxuICAgICAgZW5mb3JjZVNTTDogdHJ1ZSxcbiAgICAgIHZlcnNpb25lZDogcHJvcHM/LnZlcnNpb25lZCAhPT0gdW5kZWZpbmVkID8gcHJvcHMudmVyc2lvbmVkIDogdHJ1ZSxcbiAgICAgIG9iamVjdE93bmVyc2hpcDogKCgpID0+IHtcbiAgICAgICAgaWYgKHByb3BzPy5vYmplY3RPd25lcnNoaXApIHtcbiAgICAgICAgICByZXR1cm4gcHJvcHMub2JqZWN0T3duZXJzaGlwO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBzMy5PYmplY3RPd25lcnNoaXAuQlVDS0VUX09XTkVSX0VORk9SQ0VEO1xuICAgICAgfSkoKSxcbiAgICB9KTtcblxuICAgIC8vIEdldCBDZm5CdWNrZXRcbiAgICBjb25zdCBjZm5CdWNrZXQgPSB0aGlzLm5vZGUuZGVmYXVsdENoaWxkIGFzIHMzLkNmbkJ1Y2tldDtcbiAgICBpZiAocHJvcHM/LmV2ZW50QnJpZGdlRW5hYmxlZCA9PT0gdHJ1ZSkge1xuICAgICAgY2ZuQnVja2V0LmFkZFByb3BlcnR5T3ZlcnJpZGUoJ05vdGlmaWNhdGlvbkNvbmZpZ3VyYXRpb24uRXZlbnRCcmlkZ2VDb25maWd1cmF0aW9uLkV2ZW50QnJpZGdlRW5hYmxlZCcsIHRydWUpO1xuICAgIH1cbiAgfVxufSJdfQ==
|
package/package.json
CHANGED
|
@@ -48,16 +48,16 @@
|
|
|
48
48
|
"eslint-plugin-import": "^2.29.1",
|
|
49
49
|
"jest": "^29.7.0",
|
|
50
50
|
"jest-junit": "^15",
|
|
51
|
-
"jsii": "5.
|
|
52
|
-
"jsii-diff": "^1.
|
|
53
|
-
"jsii-docgen": "^10.4.
|
|
54
|
-
"jsii-pacmak": "^1.
|
|
55
|
-
"jsii-rosetta": "5.
|
|
51
|
+
"jsii": "5.4.x",
|
|
52
|
+
"jsii-diff": "^1.101.0",
|
|
53
|
+
"jsii-docgen": "^10.4.17",
|
|
54
|
+
"jsii-pacmak": "^1.101.0",
|
|
55
|
+
"jsii-rosetta": "5.4.x",
|
|
56
56
|
"projen": "^0.82.8",
|
|
57
57
|
"standard-version": "^9",
|
|
58
58
|
"ts-jest": "^29.1.5",
|
|
59
59
|
"ts-node": "^10.9.2",
|
|
60
|
-
"typescript": "5.
|
|
60
|
+
"typescript": "5.4.x"
|
|
61
61
|
},
|
|
62
62
|
"peerDependencies": {
|
|
63
63
|
"aws-cdk-lib": "^2.80.0",
|
|
@@ -80,7 +80,7 @@
|
|
|
80
80
|
"publishConfig": {
|
|
81
81
|
"access": "public"
|
|
82
82
|
},
|
|
83
|
-
"version": "1.
|
|
83
|
+
"version": "1.5.0",
|
|
84
84
|
"jest": {
|
|
85
85
|
"coverageProvider": "v8",
|
|
86
86
|
"testMatch": [
|