s3-secure-bucket 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.jsii +8561 -0
- package/API.md +1910 -0
- package/LICENSE +202 -0
- package/README.md +87 -0
- package/lib/index.d.ts +43 -0
- package/lib/index.js +134 -0
- package/package.json +139 -0
package/API.md
ADDED
|
@@ -0,0 +1,1910 @@
|
|
|
1
|
+
# API Reference <a name="API Reference" id="api-reference"></a>
|
|
2
|
+
|
|
3
|
+
## Constructs <a name="Constructs" id="Constructs"></a>
|
|
4
|
+
|
|
5
|
+
### S3SecureBucket <a name="S3SecureBucket" id="s3-secure-bucket.S3SecureBucket"></a>
|
|
6
|
+
|
|
7
|
+
An S3 bucket with secure defaults: private access, SSL enforced, public access blocked, and encryption required.
|
|
8
|
+
|
|
9
|
+
#### Initializers <a name="Initializers" id="s3-secure-bucket.S3SecureBucket.Initializer"></a>
|
|
10
|
+
|
|
11
|
+
```typescript
|
|
12
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
13
|
+
|
|
14
|
+
new S3SecureBucket(scope: Construct, id: string, props?: S3SecureBucketProps)
|
|
15
|
+
```
|
|
16
|
+
|
|
17
|
+
| **Name** | **Type** | **Description** |
|
|
18
|
+
| --- | --- | --- |
|
|
19
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.scope">scope</a></code> | <code>constructs.Construct</code> | *No description.* |
|
|
20
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.id">id</a></code> | <code>string</code> | *No description.* |
|
|
21
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.props">props</a></code> | <code><a href="#s3-secure-bucket.S3SecureBucketProps">S3SecureBucketProps</a></code> | *No description.* |
|
|
22
|
+
|
|
23
|
+
---
|
|
24
|
+
|
|
25
|
+
##### `scope`<sup>Required</sup> <a name="scope" id="s3-secure-bucket.S3SecureBucket.Initializer.parameter.scope"></a>
|
|
26
|
+
|
|
27
|
+
- *Type:* constructs.Construct
|
|
28
|
+
|
|
29
|
+
---
|
|
30
|
+
|
|
31
|
+
##### `id`<sup>Required</sup> <a name="id" id="s3-secure-bucket.S3SecureBucket.Initializer.parameter.id"></a>
|
|
32
|
+
|
|
33
|
+
- *Type:* string
|
|
34
|
+
|
|
35
|
+
---
|
|
36
|
+
|
|
37
|
+
##### `props`<sup>Optional</sup> <a name="props" id="s3-secure-bucket.S3SecureBucket.Initializer.parameter.props"></a>
|
|
38
|
+
|
|
39
|
+
- *Type:* <a href="#s3-secure-bucket.S3SecureBucketProps">S3SecureBucketProps</a>
|
|
40
|
+
|
|
41
|
+
---
|
|
42
|
+
|
|
43
|
+
#### Methods <a name="Methods" id="Methods"></a>
|
|
44
|
+
|
|
45
|
+
| **Name** | **Description** |
|
|
46
|
+
| --- | --- |
|
|
47
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.toString">toString</a></code> | Returns a string representation of this construct. |
|
|
48
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.with">with</a></code> | Applies one or more mixins to this construct. |
|
|
49
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.applyRemovalPolicy">applyRemovalPolicy</a></code> | Apply the given removal policy to this resource. |
|
|
50
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addEventNotification">addEventNotification</a></code> | Adds a bucket notification event destination. |
|
|
51
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addObjectCreatedNotification">addObjectCreatedNotification</a></code> | Subscribes a destination to receive notifications when an object is created in the bucket. |
|
|
52
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addObjectRemovedNotification">addObjectRemovedNotification</a></code> | Subscribes a destination to receive notifications when an object is removed from the bucket. |
|
|
53
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addReplicationPolicy">addReplicationPolicy</a></code> | Function to add required permissions to the destination bucket for cross account replication. |
|
|
54
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addToResourcePolicy">addToResourcePolicy</a></code> | Adds a statement to the resource policy for a principal (i.e. account/role/service) to perform actions on this bucket and/or its contents. Use `bucketArn` and `arnForObjects(keys)` to obtain ARNs for this bucket or objects. |
|
|
55
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.arnForObjects">arnForObjects</a></code> | Returns an ARN that represents all objects within the bucket that match the key pattern specified. |
|
|
56
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.enableEventBridgeNotification">enableEventBridgeNotification</a></code> | Enables event bridge notification, causing all events below to be sent to EventBridge:. |
|
|
57
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantDelete">grantDelete</a></code> | Grants s3:DeleteObject* permission to an IAM principal for objects in this bucket. |
|
|
58
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantOnKey">grantOnKey</a></code> | Gives permissions to a grantable entity to perform actions on the encryption key. |
|
|
59
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantPublicAccess">grantPublicAccess</a></code> | Allows unrestricted access to objects from this bucket. |
|
|
60
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantPut">grantPut</a></code> | Grants s3:PutObject* and s3:Abort* permissions for this bucket to an IAM principal. |
|
|
61
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantPutAcl">grantPutAcl</a></code> | Grant the given IAM identity permissions to modify the ACLs of objects in the given Bucket. |
|
|
62
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantRead">grantRead</a></code> | Grant read permissions for this bucket and it's contents to an IAM principal (Role/Group/User). |
|
|
63
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantReadWrite">grantReadWrite</a></code> | Grants read/write permissions for this bucket and it's contents to an IAM principal (Role/Group/User). |
|
|
64
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantReplicationPermission">grantReplicationPermission</a></code> | Grant replication permission to a principal. This method allows the principal to perform replication operations on this bucket. |
|
|
65
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.grantWrite">grantWrite</a></code> | Grant write permissions to this bucket to an IAM principal. |
|
|
66
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.onCloudTrailEvent">onCloudTrailEvent</a></code> | Define a CloudWatch event that triggers when something happens to this repository. |
|
|
67
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.onCloudTrailPutObject">onCloudTrailPutObject</a></code> | Defines an AWS CloudWatch event that triggers when an object is uploaded to the specified paths (keys) in this bucket using the PutObject API call. |
|
|
68
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.onCloudTrailWriteObject">onCloudTrailWriteObject</a></code> | Defines an AWS CloudWatch event that triggers when an object at the specified paths (keys) in this bucket are written to. |
|
|
69
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.s3UrlForObject">s3UrlForObject</a></code> | The S3 URL of an S3 object. For example:. |
|
|
70
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.transferAccelerationUrlForObject">transferAccelerationUrlForObject</a></code> | The https Transfer Acceleration URL of an S3 object. |
|
|
71
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.urlForObject">urlForObject</a></code> | The https URL of an S3 object. Specify `regional: false` at the options for non-regional URLs. For example:. |
|
|
72
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.virtualHostedUrlForObject">virtualHostedUrlForObject</a></code> | The virtual hosted-style URL of an S3 object. Specify `regional: false` at the options for non-regional URL. For example:. |
|
|
73
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addCorsRule">addCorsRule</a></code> | Adds a cross-origin access configuration for objects in an Amazon S3 bucket. |
|
|
74
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addInventory">addInventory</a></code> | Add an inventory configuration. |
|
|
75
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addLifecycleRule">addLifecycleRule</a></code> | Add a lifecycle rule to the bucket. |
|
|
76
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.addMetric">addMetric</a></code> | Adds a metrics configuration for the CloudWatch request metrics from the bucket. |
|
|
77
|
+
|
|
78
|
+
---
|
|
79
|
+
|
|
80
|
+
##### `toString` <a name="toString" id="s3-secure-bucket.S3SecureBucket.toString"></a>
|
|
81
|
+
|
|
82
|
+
```typescript
|
|
83
|
+
public toString(): string
|
|
84
|
+
```
|
|
85
|
+
|
|
86
|
+
Returns a string representation of this construct.
|
|
87
|
+
|
|
88
|
+
##### `with` <a name="with" id="s3-secure-bucket.S3SecureBucket.with"></a>
|
|
89
|
+
|
|
90
|
+
```typescript
|
|
91
|
+
public with(mixins: ...IMixin[]): IConstruct
|
|
92
|
+
```
|
|
93
|
+
|
|
94
|
+
Applies one or more mixins to this construct.
|
|
95
|
+
|
|
96
|
+
Mixins are applied in order. The list of constructs is captured at the
|
|
97
|
+
start of the call, so constructs added by a mixin will not be visited.
|
|
98
|
+
Use multiple `with()` calls if subsequent mixins should apply to added
|
|
99
|
+
constructs.
|
|
100
|
+
|
|
101
|
+
###### `mixins`<sup>Required</sup> <a name="mixins" id="s3-secure-bucket.S3SecureBucket.with.parameter.mixins"></a>
|
|
102
|
+
|
|
103
|
+
- *Type:* ...constructs.IMixin[]
|
|
104
|
+
|
|
105
|
+
The mixins to apply.
|
|
106
|
+
|
|
107
|
+
---
|
|
108
|
+
|
|
109
|
+
##### `applyRemovalPolicy` <a name="applyRemovalPolicy" id="s3-secure-bucket.S3SecureBucket.applyRemovalPolicy"></a>
|
|
110
|
+
|
|
111
|
+
```typescript
|
|
112
|
+
public applyRemovalPolicy(policy: RemovalPolicy): void
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
Apply the given removal policy to this resource.
|
|
116
|
+
|
|
117
|
+
The Removal Policy controls what happens to this resource when it stops
|
|
118
|
+
being managed by CloudFormation, either because you've removed it from the
|
|
119
|
+
CDK application or because you've made a change that requires the resource
|
|
120
|
+
to be replaced.
|
|
121
|
+
|
|
122
|
+
The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
|
|
123
|
+
account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
|
|
124
|
+
|
|
125
|
+
###### `policy`<sup>Required</sup> <a name="policy" id="s3-secure-bucket.S3SecureBucket.applyRemovalPolicy.parameter.policy"></a>
|
|
126
|
+
|
|
127
|
+
- *Type:* aws-cdk-lib.RemovalPolicy
|
|
128
|
+
|
|
129
|
+
---
|
|
130
|
+
|
|
131
|
+
##### `addEventNotification` <a name="addEventNotification" id="s3-secure-bucket.S3SecureBucket.addEventNotification"></a>
|
|
132
|
+
|
|
133
|
+
```typescript
|
|
134
|
+
public addEventNotification(event: EventType, dest: IBucketNotificationDestination, filters: ...NotificationKeyFilter[]): void
|
|
135
|
+
```
|
|
136
|
+
|
|
137
|
+
Adds a bucket notification event destination.
|
|
138
|
+
|
|
139
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
|
|
140
|
+
|
|
141
|
+
*Example*
|
|
142
|
+
|
|
143
|
+
```typescript
|
|
144
|
+
declare const myLambda: lambda.Function;
|
|
145
|
+
const bucket = new s3.Bucket(this, 'MyBucket');
|
|
146
|
+
bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.LambdaDestination(myLambda), {prefix: 'home/myusername/*'});
|
|
147
|
+
```
|
|
148
|
+
|
|
149
|
+
|
|
150
|
+
###### `event`<sup>Required</sup> <a name="event" id="s3-secure-bucket.S3SecureBucket.addEventNotification.parameter.event"></a>
|
|
151
|
+
|
|
152
|
+
- *Type:* aws-cdk-lib.aws_s3.EventType
|
|
153
|
+
|
|
154
|
+
The event to trigger the notification.
|
|
155
|
+
|
|
156
|
+
---
|
|
157
|
+
|
|
158
|
+
###### `dest`<sup>Required</sup> <a name="dest" id="s3-secure-bucket.S3SecureBucket.addEventNotification.parameter.dest"></a>
|
|
159
|
+
|
|
160
|
+
- *Type:* aws-cdk-lib.aws_s3.IBucketNotificationDestination
|
|
161
|
+
|
|
162
|
+
The notification destination (Lambda, SNS Topic or SQS Queue).
|
|
163
|
+
|
|
164
|
+
---
|
|
165
|
+
|
|
166
|
+
###### `filters`<sup>Required</sup> <a name="filters" id="s3-secure-bucket.S3SecureBucket.addEventNotification.parameter.filters"></a>
|
|
167
|
+
|
|
168
|
+
- *Type:* ...aws-cdk-lib.aws_s3.NotificationKeyFilter[]
|
|
169
|
+
|
|
170
|
+
S3 object key filter rules to determine which objects trigger this event.
|
|
171
|
+
|
|
172
|
+
Each filter must include a `prefix` and/or `suffix`
|
|
173
|
+
that will be matched against the s3 object key. Refer to the S3 Developer Guide
|
|
174
|
+
for details about allowed filter rules.
|
|
175
|
+
|
|
176
|
+
---
|
|
177
|
+
|
|
178
|
+
##### `addObjectCreatedNotification` <a name="addObjectCreatedNotification" id="s3-secure-bucket.S3SecureBucket.addObjectCreatedNotification"></a>
|
|
179
|
+
|
|
180
|
+
```typescript
|
|
181
|
+
public addObjectCreatedNotification(dest: IBucketNotificationDestination, filters: ...NotificationKeyFilter[]): void
|
|
182
|
+
```
|
|
183
|
+
|
|
184
|
+
Subscribes a destination to receive notifications when an object is created in the bucket.
|
|
185
|
+
|
|
186
|
+
This is identical to calling
|
|
187
|
+
`onEvent(EventType.OBJECT_CREATED)`.
|
|
188
|
+
|
|
189
|
+
###### `dest`<sup>Required</sup> <a name="dest" id="s3-secure-bucket.S3SecureBucket.addObjectCreatedNotification.parameter.dest"></a>
|
|
190
|
+
|
|
191
|
+
- *Type:* aws-cdk-lib.aws_s3.IBucketNotificationDestination
|
|
192
|
+
|
|
193
|
+
The notification destination (see onEvent).
|
|
194
|
+
|
|
195
|
+
---
|
|
196
|
+
|
|
197
|
+
###### `filters`<sup>Required</sup> <a name="filters" id="s3-secure-bucket.S3SecureBucket.addObjectCreatedNotification.parameter.filters"></a>
|
|
198
|
+
|
|
199
|
+
- *Type:* ...aws-cdk-lib.aws_s3.NotificationKeyFilter[]
|
|
200
|
+
|
|
201
|
+
Filters (see onEvent).
|
|
202
|
+
|
|
203
|
+
---
|
|
204
|
+
|
|
205
|
+
##### `addObjectRemovedNotification` <a name="addObjectRemovedNotification" id="s3-secure-bucket.S3SecureBucket.addObjectRemovedNotification"></a>
|
|
206
|
+
|
|
207
|
+
```typescript
|
|
208
|
+
public addObjectRemovedNotification(dest: IBucketNotificationDestination, filters: ...NotificationKeyFilter[]): void
|
|
209
|
+
```
|
|
210
|
+
|
|
211
|
+
Subscribes a destination to receive notifications when an object is removed from the bucket.
|
|
212
|
+
|
|
213
|
+
This is identical to calling
|
|
214
|
+
`onEvent(EventType.OBJECT_REMOVED)`.
|
|
215
|
+
|
|
216
|
+
###### `dest`<sup>Required</sup> <a name="dest" id="s3-secure-bucket.S3SecureBucket.addObjectRemovedNotification.parameter.dest"></a>
|
|
217
|
+
|
|
218
|
+
- *Type:* aws-cdk-lib.aws_s3.IBucketNotificationDestination
|
|
219
|
+
|
|
220
|
+
The notification destination (see onEvent).
|
|
221
|
+
|
|
222
|
+
---
|
|
223
|
+
|
|
224
|
+
###### `filters`<sup>Required</sup> <a name="filters" id="s3-secure-bucket.S3SecureBucket.addObjectRemovedNotification.parameter.filters"></a>
|
|
225
|
+
|
|
226
|
+
- *Type:* ...aws-cdk-lib.aws_s3.NotificationKeyFilter[]
|
|
227
|
+
|
|
228
|
+
Filters (see onEvent).
|
|
229
|
+
|
|
230
|
+
---
|
|
231
|
+
|
|
232
|
+
##### `addReplicationPolicy` <a name="addReplicationPolicy" id="s3-secure-bucket.S3SecureBucket.addReplicationPolicy"></a>
|
|
233
|
+
|
|
234
|
+
```typescript
|
|
235
|
+
public addReplicationPolicy(roleArn: string, accessControlTransition?: boolean, account?: string): void
|
|
236
|
+
```
|
|
237
|
+
|
|
238
|
+
Function to add required permissions to the destination bucket for cross account replication.
|
|
239
|
+
|
|
240
|
+
These permissions will be added as a resource based policy on the bucket
|
|
241
|
+
|
|
242
|
+
> [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-accesscontroltranslation.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-accesscontroltranslation.html)
|
|
243
|
+
|
|
244
|
+
###### `roleArn`<sup>Required</sup> <a name="roleArn" id="s3-secure-bucket.S3SecureBucket.addReplicationPolicy.parameter.roleArn"></a>
|
|
245
|
+
|
|
246
|
+
- *Type:* string
|
|
247
|
+
|
|
248
|
+
---
|
|
249
|
+
|
|
250
|
+
###### `accessControlTransition`<sup>Optional</sup> <a name="accessControlTransition" id="s3-secure-bucket.S3SecureBucket.addReplicationPolicy.parameter.accessControlTransition"></a>
|
|
251
|
+
|
|
252
|
+
- *Type:* boolean
|
|
253
|
+
|
|
254
|
+
---
|
|
255
|
+
|
|
256
|
+
###### `account`<sup>Optional</sup> <a name="account" id="s3-secure-bucket.S3SecureBucket.addReplicationPolicy.parameter.account"></a>
|
|
257
|
+
|
|
258
|
+
- *Type:* string
|
|
259
|
+
|
|
260
|
+
---
|
|
261
|
+
|
|
262
|
+
##### `addToResourcePolicy` <a name="addToResourcePolicy" id="s3-secure-bucket.S3SecureBucket.addToResourcePolicy"></a>
|
|
263
|
+
|
|
264
|
+
```typescript
|
|
265
|
+
public addToResourcePolicy(permission: PolicyStatement): AddToResourcePolicyResult
|
|
266
|
+
```
|
|
267
|
+
|
|
268
|
+
Adds a statement to the resource policy for a principal (i.e. account/role/service) to perform actions on this bucket and/or its contents. Use `bucketArn` and `arnForObjects(keys)` to obtain ARNs for this bucket or objects.
|
|
269
|
+
|
|
270
|
+
Note that the policy statement may or may not be added to the policy.
|
|
271
|
+
For example, when an `IBucket` is created from an existing bucket,
|
|
272
|
+
it's not possible to tell whether the bucket already has a policy
|
|
273
|
+
attached, let alone to re-use that policy to add more statements to it.
|
|
274
|
+
So it's safest to do nothing in these cases.
|
|
275
|
+
|
|
276
|
+
###### `permission`<sup>Required</sup> <a name="permission" id="s3-secure-bucket.S3SecureBucket.addToResourcePolicy.parameter.permission"></a>
|
|
277
|
+
|
|
278
|
+
- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
|
|
279
|
+
|
|
280
|
+
the policy statement to be added to the bucket's policy.
|
|
281
|
+
|
|
282
|
+
---
|
|
283
|
+
|
|
284
|
+
##### `arnForObjects` <a name="arnForObjects" id="s3-secure-bucket.S3SecureBucket.arnForObjects"></a>
|
|
285
|
+
|
|
286
|
+
```typescript
|
|
287
|
+
public arnForObjects(keyPattern: string): string
|
|
288
|
+
```
|
|
289
|
+
|
|
290
|
+
Returns an ARN that represents all objects within the bucket that match the key pattern specified.
|
|
291
|
+
|
|
292
|
+
To represent all keys, specify ``"*"``.
|
|
293
|
+
|
|
294
|
+
If you need to specify a keyPattern with multiple components, concatenate them into a single string, e.g.:
|
|
295
|
+
|
|
296
|
+
arnForObjects(`home/${team}/${user}/*`)
|
|
297
|
+
|
|
298
|
+
###### `keyPattern`<sup>Required</sup> <a name="keyPattern" id="s3-secure-bucket.S3SecureBucket.arnForObjects.parameter.keyPattern"></a>
|
|
299
|
+
|
|
300
|
+
- *Type:* string
|
|
301
|
+
|
|
302
|
+
---
|
|
303
|
+
|
|
304
|
+
##### `enableEventBridgeNotification` <a name="enableEventBridgeNotification" id="s3-secure-bucket.S3SecureBucket.enableEventBridgeNotification"></a>
|
|
305
|
+
|
|
306
|
+
```typescript
|
|
307
|
+
public enableEventBridgeNotification(): void
|
|
308
|
+
```
|
|
309
|
+
|
|
310
|
+
Enables event bridge notification, causing all events below to be sent to EventBridge:.
|
|
311
|
+
|
|
312
|
+
Object Deleted (DeleteObject)
|
|
313
|
+
- Object Deleted (Lifecycle expiration)
|
|
314
|
+
- Object Restore Initiated
|
|
315
|
+
- Object Restore Completed
|
|
316
|
+
- Object Restore Expired
|
|
317
|
+
- Object Storage Class Changed
|
|
318
|
+
- Object Access Tier Changed
|
|
319
|
+
- Object ACL Updated
|
|
320
|
+
- Object Tags Added
|
|
321
|
+
- Object Tags Deleted
|
|
322
|
+
|
|
323
|
+
##### `grantDelete` <a name="grantDelete" id="s3-secure-bucket.S3SecureBucket.grantDelete"></a>
|
|
324
|
+
|
|
325
|
+
```typescript
|
|
326
|
+
public grantDelete(identity: IGrantable, objectsKeyPattern?: any): Grant
|
|
327
|
+
```
|
|
328
|
+
|
|
329
|
+
Grants s3:DeleteObject* permission to an IAM principal for objects in this bucket.
|
|
330
|
+
|
|
331
|
+
###### `identity`<sup>Required</sup> <a name="identity" id="s3-secure-bucket.S3SecureBucket.grantDelete.parameter.identity"></a>
|
|
332
|
+
|
|
333
|
+
- *Type:* aws-cdk-lib.aws_iam.IGrantable
|
|
334
|
+
|
|
335
|
+
The principal.
|
|
336
|
+
|
|
337
|
+
---
|
|
338
|
+
|
|
339
|
+
###### `objectsKeyPattern`<sup>Optional</sup> <a name="objectsKeyPattern" id="s3-secure-bucket.S3SecureBucket.grantDelete.parameter.objectsKeyPattern"></a>
|
|
340
|
+
|
|
341
|
+
- *Type:* any
|
|
342
|
+
|
|
343
|
+
Restrict the permission to a certain key pattern (default '*').
|
|
344
|
+
|
|
345
|
+
Parameter type is `any` but `string` should be passed in.
|
|
346
|
+
|
|
347
|
+
---
|
|
348
|
+
|
|
349
|
+
##### `grantOnKey` <a name="grantOnKey" id="s3-secure-bucket.S3SecureBucket.grantOnKey"></a>
|
|
350
|
+
|
|
351
|
+
```typescript
|
|
352
|
+
public grantOnKey(grantee: IGrantable, actions: ...string[]): GrantOnKeyResult
|
|
353
|
+
```
|
|
354
|
+
|
|
355
|
+
Gives permissions to a grantable entity to perform actions on the encryption key.
|
|
356
|
+
|
|
357
|
+
###### `grantee`<sup>Required</sup> <a name="grantee" id="s3-secure-bucket.S3SecureBucket.grantOnKey.parameter.grantee"></a>
|
|
358
|
+
|
|
359
|
+
- *Type:* aws-cdk-lib.aws_iam.IGrantable
|
|
360
|
+
|
|
361
|
+
---
|
|
362
|
+
|
|
363
|
+
###### `actions`<sup>Required</sup> <a name="actions" id="s3-secure-bucket.S3SecureBucket.grantOnKey.parameter.actions"></a>
|
|
364
|
+
|
|
365
|
+
- *Type:* ...string[]
|
|
366
|
+
|
|
367
|
+
---
|
|
368
|
+
|
|
369
|
+
##### `grantPublicAccess` <a name="grantPublicAccess" id="s3-secure-bucket.S3SecureBucket.grantPublicAccess"></a>
|
|
370
|
+
|
|
371
|
+
```typescript
|
|
372
|
+
public grantPublicAccess(allowedActions: ...string[], keyPrefix?: string): Grant
|
|
373
|
+
```
|
|
374
|
+
|
|
375
|
+
Allows unrestricted access to objects from this bucket.
|
|
376
|
+
|
|
377
|
+
IMPORTANT: This permission allows anyone to perform actions on S3 objects
|
|
378
|
+
in this bucket, which is useful for when you configure your bucket as a
|
|
379
|
+
website and want everyone to be able to read objects in the bucket without
|
|
380
|
+
needing to authenticate.
|
|
381
|
+
|
|
382
|
+
Without arguments, this method will grant read ("s3:GetObject") access to
|
|
383
|
+
all objects ("*") in the bucket.
|
|
384
|
+
|
|
385
|
+
The method returns the `iam.Grant` object, which can then be modified
|
|
386
|
+
as needed. For example, you can add a condition that will restrict access only
|
|
387
|
+
to an IPv4 range like this:
|
|
388
|
+
|
|
389
|
+
const grant = bucket.grantPublicAccess();
|
|
390
|
+
grant.resourceStatement!.addCondition(‘IpAddress’, { “aws:SourceIp”: “54.240.143.0/24” });
|
|
391
|
+
|
|
392
|
+
Note that if this `IBucket` refers to an existing bucket, possibly not
|
|
393
|
+
managed by CloudFormation, this method will have no effect, since it's
|
|
394
|
+
impossible to modify the policy of an existing bucket.
|
|
395
|
+
|
|
396
|
+
###### `allowedActions`<sup>Required</sup> <a name="allowedActions" id="s3-secure-bucket.S3SecureBucket.grantPublicAccess.parameter.allowedActions"></a>
|
|
397
|
+
|
|
398
|
+
- *Type:* ...string[]
|
|
399
|
+
|
|
400
|
+
the set of S3 actions to allow.
|
|
401
|
+
|
|
402
|
+
Default is "s3:GetObject".
|
|
403
|
+
|
|
404
|
+
---
|
|
405
|
+
|
|
406
|
+
###### `keyPrefix`<sup>Optional</sup> <a name="keyPrefix" id="s3-secure-bucket.S3SecureBucket.grantPublicAccess.parameter.keyPrefix"></a>
|
|
407
|
+
|
|
408
|
+
- *Type:* string
|
|
409
|
+
|
|
410
|
+
the prefix of S3 object keys (e.g. `home/*`). Default is "*".
|
|
411
|
+
|
|
412
|
+
---
|
|
413
|
+
|
|
414
|
+
##### `grantPut` <a name="grantPut" id="s3-secure-bucket.S3SecureBucket.grantPut"></a>
|
|
415
|
+
|
|
416
|
+
```typescript
|
|
417
|
+
public grantPut(identity: IGrantable, objectsKeyPattern?: any): Grant
|
|
418
|
+
```
|
|
419
|
+
|
|
420
|
+
Grants s3:PutObject* and s3:Abort* permissions for this bucket to an IAM principal.
|
|
421
|
+
|
|
422
|
+
If encryption is used, permission to use the key to encrypt the contents
|
|
423
|
+
of written files will also be granted to the same principal.
|
|
424
|
+
|
|
425
|
+
###### `identity`<sup>Required</sup> <a name="identity" id="s3-secure-bucket.S3SecureBucket.grantPut.parameter.identity"></a>
|
|
426
|
+
|
|
427
|
+
- *Type:* aws-cdk-lib.aws_iam.IGrantable
|
|
428
|
+
|
|
429
|
+
The principal.
|
|
430
|
+
|
|
431
|
+
---
|
|
432
|
+
|
|
433
|
+
###### `objectsKeyPattern`<sup>Optional</sup> <a name="objectsKeyPattern" id="s3-secure-bucket.S3SecureBucket.grantPut.parameter.objectsKeyPattern"></a>
|
|
434
|
+
|
|
435
|
+
- *Type:* any
|
|
436
|
+
|
|
437
|
+
Restrict the permission to a certain key pattern (default '*').
|
|
438
|
+
|
|
439
|
+
Parameter type is `any` but `string` should be passed in.
|
|
440
|
+
|
|
441
|
+
---
|
|
442
|
+
|
|
443
|
+
##### `grantPutAcl` <a name="grantPutAcl" id="s3-secure-bucket.S3SecureBucket.grantPutAcl"></a>
|
|
444
|
+
|
|
445
|
+
```typescript
|
|
446
|
+
public grantPutAcl(identity: IGrantable, objectsKeyPattern?: string): Grant
|
|
447
|
+
```
|
|
448
|
+
|
|
449
|
+
Grant the given IAM identity permissions to modify the ACLs of objects in the given Bucket.
|
|
450
|
+
|
|
451
|
+
If your application has the '@aws-cdk/aws-s3:grantWriteWithoutAcl' feature flag set,
|
|
452
|
+
calling `grantWrite` or `grantReadWrite` no longer grants permissions to modify the ACLs of the objects;
|
|
453
|
+
in this case, if you need to modify object ACLs, call this method explicitly.
|
|
454
|
+
|
|
455
|
+
###### `identity`<sup>Required</sup> <a name="identity" id="s3-secure-bucket.S3SecureBucket.grantPutAcl.parameter.identity"></a>
|
|
456
|
+
|
|
457
|
+
- *Type:* aws-cdk-lib.aws_iam.IGrantable
|
|
458
|
+
|
|
459
|
+
---
|
|
460
|
+
|
|
461
|
+
###### `objectsKeyPattern`<sup>Optional</sup> <a name="objectsKeyPattern" id="s3-secure-bucket.S3SecureBucket.grantPutAcl.parameter.objectsKeyPattern"></a>
|
|
462
|
+
|
|
463
|
+
- *Type:* string
|
|
464
|
+
|
|
465
|
+
---
|
|
466
|
+
|
|
467
|
+
##### `grantRead` <a name="grantRead" id="s3-secure-bucket.S3SecureBucket.grantRead"></a>
|
|
468
|
+
|
|
469
|
+
```typescript
|
|
470
|
+
public grantRead(identity: IGrantable, objectsKeyPattern?: any): Grant
|
|
471
|
+
```
|
|
472
|
+
|
|
473
|
+
Grant read permissions for this bucket and it's contents to an IAM principal (Role/Group/User).
|
|
474
|
+
|
|
475
|
+
If encryption is used, permission to use the key to decrypt the contents
|
|
476
|
+
of the bucket will also be granted to the same principal.
|
|
477
|
+
|
|
478
|
+
###### `identity`<sup>Required</sup> <a name="identity" id="s3-secure-bucket.S3SecureBucket.grantRead.parameter.identity"></a>
|
|
479
|
+
|
|
480
|
+
- *Type:* aws-cdk-lib.aws_iam.IGrantable
|
|
481
|
+
|
|
482
|
+
The principal.
|
|
483
|
+
|
|
484
|
+
---
|
|
485
|
+
|
|
486
|
+
###### `objectsKeyPattern`<sup>Optional</sup> <a name="objectsKeyPattern" id="s3-secure-bucket.S3SecureBucket.grantRead.parameter.objectsKeyPattern"></a>
|
|
487
|
+
|
|
488
|
+
- *Type:* any
|
|
489
|
+
|
|
490
|
+
Restrict the permission to a certain key pattern (default '*').
|
|
491
|
+
|
|
492
|
+
Parameter type is `any` but `string` should be passed in.
|
|
493
|
+
|
|
494
|
+
---
|
|
495
|
+
|
|
496
|
+
##### `grantReadWrite` <a name="grantReadWrite" id="s3-secure-bucket.S3SecureBucket.grantReadWrite"></a>
|
|
497
|
+
|
|
498
|
+
```typescript
|
|
499
|
+
public grantReadWrite(identity: IGrantable, objectsKeyPattern?: any): Grant
|
|
500
|
+
```
|
|
501
|
+
|
|
502
|
+
Grants read/write permissions for this bucket and it's contents to an IAM principal (Role/Group/User).
|
|
503
|
+
|
|
504
|
+
If an encryption key is used, permission to use the key for
|
|
505
|
+
encrypt/decrypt will also be granted.
|
|
506
|
+
|
|
507
|
+
Before CDK version 1.85.0, this method granted the `s3:PutObject*` permission that included `s3:PutObjectAcl`,
|
|
508
|
+
which could be used to grant read/write object access to IAM principals in other accounts.
|
|
509
|
+
If you want to get rid of that behavior, update your CDK version to 1.85.0 or later,
|
|
510
|
+
and make sure the `@aws-cdk/aws-s3:grantWriteWithoutAcl` feature flag is set to `true`
|
|
511
|
+
in the `context` key of your cdk.json file.
|
|
512
|
+
If you've already updated, but still need the principal to have permissions to modify the ACLs,
|
|
513
|
+
use the `grantPutAcl` method.
|
|
514
|
+
|
|
515
|
+
###### `identity`<sup>Required</sup> <a name="identity" id="s3-secure-bucket.S3SecureBucket.grantReadWrite.parameter.identity"></a>
|
|
516
|
+
|
|
517
|
+
- *Type:* aws-cdk-lib.aws_iam.IGrantable
|
|
518
|
+
|
|
519
|
+
---
|
|
520
|
+
|
|
521
|
+
###### `objectsKeyPattern`<sup>Optional</sup> <a name="objectsKeyPattern" id="s3-secure-bucket.S3SecureBucket.grantReadWrite.parameter.objectsKeyPattern"></a>
|
|
522
|
+
|
|
523
|
+
- *Type:* any
|
|
524
|
+
|
|
525
|
+
---
|
|
526
|
+
|
|
527
|
+
##### `grantReplicationPermission` <a name="grantReplicationPermission" id="s3-secure-bucket.S3SecureBucket.grantReplicationPermission"></a>
|
|
528
|
+
|
|
529
|
+
```typescript
|
|
530
|
+
public grantReplicationPermission(identity: IGrantable, props: GrantReplicationPermissionProps): Grant
|
|
531
|
+
```
|
|
532
|
+
|
|
533
|
+
Grant replication permission to a principal. This method allows the principal to perform replication operations on this bucket.
|
|
534
|
+
|
|
535
|
+
Note that when calling this function for source or destination buckets that support KMS encryption,
|
|
536
|
+
you need to specify the KMS key for encryption and the KMS key for decryption, respectively.
|
|
537
|
+
|
|
538
|
+
###### `identity`<sup>Required</sup> <a name="identity" id="s3-secure-bucket.S3SecureBucket.grantReplicationPermission.parameter.identity"></a>
|
|
539
|
+
|
|
540
|
+
- *Type:* aws-cdk-lib.aws_iam.IGrantable
|
|
541
|
+
|
|
542
|
+
The principal to grant replication permission to.
|
|
543
|
+
|
|
544
|
+
---
|
|
545
|
+
|
|
546
|
+
###### `props`<sup>Required</sup> <a name="props" id="s3-secure-bucket.S3SecureBucket.grantReplicationPermission.parameter.props"></a>
|
|
547
|
+
|
|
548
|
+
- *Type:* aws-cdk-lib.aws_s3.GrantReplicationPermissionProps
|
|
549
|
+
|
|
550
|
+
The properties of the replication source and destination buckets.
|
|
551
|
+
|
|
552
|
+
---
|
|
553
|
+
|
|
554
|
+
##### `grantWrite` <a name="grantWrite" id="s3-secure-bucket.S3SecureBucket.grantWrite"></a>
|
|
555
|
+
|
|
556
|
+
```typescript
|
|
557
|
+
public grantWrite(identity: IGrantable, objectsKeyPattern?: any, allowedActionPatterns?: string[]): Grant
|
|
558
|
+
```
|
|
559
|
+
|
|
560
|
+
Grant write permissions to this bucket to an IAM principal.
|
|
561
|
+
|
|
562
|
+
If encryption is used, permission to use the key to encrypt the contents
|
|
563
|
+
of written files will also be granted to the same principal.
|
|
564
|
+
|
|
565
|
+
Before CDK version 1.85.0, this method granted the `s3:PutObject*` permission that included `s3:PutObjectAcl`,
|
|
566
|
+
which could be used to grant read/write object access to IAM principals in other accounts.
|
|
567
|
+
If you want to get rid of that behavior, update your CDK version to 1.85.0 or later,
|
|
568
|
+
and make sure the `@aws-cdk/aws-s3:grantWriteWithoutAcl` feature flag is set to `true`
|
|
569
|
+
in the `context` key of your cdk.json file.
|
|
570
|
+
If you've already updated, but still need the principal to have permissions to modify the ACLs,
|
|
571
|
+
use the `grantPutAcl` method.
|
|
572
|
+
|
|
573
|
+
###### `identity`<sup>Required</sup> <a name="identity" id="s3-secure-bucket.S3SecureBucket.grantWrite.parameter.identity"></a>
|
|
574
|
+
|
|
575
|
+
- *Type:* aws-cdk-lib.aws_iam.IGrantable
|
|
576
|
+
|
|
577
|
+
---
|
|
578
|
+
|
|
579
|
+
###### `objectsKeyPattern`<sup>Optional</sup> <a name="objectsKeyPattern" id="s3-secure-bucket.S3SecureBucket.grantWrite.parameter.objectsKeyPattern"></a>
|
|
580
|
+
|
|
581
|
+
- *Type:* any
|
|
582
|
+
|
|
583
|
+
---
|
|
584
|
+
|
|
585
|
+
###### `allowedActionPatterns`<sup>Optional</sup> <a name="allowedActionPatterns" id="s3-secure-bucket.S3SecureBucket.grantWrite.parameter.allowedActionPatterns"></a>
|
|
586
|
+
|
|
587
|
+
- *Type:* string[]
|
|
588
|
+
|
|
589
|
+
---
|
|
590
|
+
|
|
591
|
+
##### `onCloudTrailEvent` <a name="onCloudTrailEvent" id="s3-secure-bucket.S3SecureBucket.onCloudTrailEvent"></a>
|
|
592
|
+
|
|
593
|
+
```typescript
|
|
594
|
+
public onCloudTrailEvent(id: string, options?: OnCloudTrailBucketEventOptions): Rule
|
|
595
|
+
```
|
|
596
|
+
|
|
597
|
+
Define a CloudWatch event that triggers when something happens to this repository.
|
|
598
|
+
|
|
599
|
+
Requires that there exists at least one CloudTrail Trail in your account
|
|
600
|
+
that captures the event. This method will not create the Trail.
|
|
601
|
+
|
|
602
|
+
###### `id`<sup>Required</sup> <a name="id" id="s3-secure-bucket.S3SecureBucket.onCloudTrailEvent.parameter.id"></a>
|
|
603
|
+
|
|
604
|
+
- *Type:* string
|
|
605
|
+
|
|
606
|
+
The id of the rule.
|
|
607
|
+
|
|
608
|
+
---
|
|
609
|
+
|
|
610
|
+
###### `options`<sup>Optional</sup> <a name="options" id="s3-secure-bucket.S3SecureBucket.onCloudTrailEvent.parameter.options"></a>
|
|
611
|
+
|
|
612
|
+
- *Type:* aws-cdk-lib.aws_s3.OnCloudTrailBucketEventOptions
|
|
613
|
+
|
|
614
|
+
Options for adding the rule.
|
|
615
|
+
|
|
616
|
+
---
|
|
617
|
+
|
|
618
|
+
##### `onCloudTrailPutObject` <a name="onCloudTrailPutObject" id="s3-secure-bucket.S3SecureBucket.onCloudTrailPutObject"></a>
|
|
619
|
+
|
|
620
|
+
```typescript
|
|
621
|
+
public onCloudTrailPutObject(id: string, options?: OnCloudTrailBucketEventOptions): Rule
|
|
622
|
+
```
|
|
623
|
+
|
|
624
|
+
Defines an AWS CloudWatch event that triggers when an object is uploaded to the specified paths (keys) in this bucket using the PutObject API call.
|
|
625
|
+
|
|
626
|
+
Note that some tools like `aws s3 cp` will automatically use either
|
|
627
|
+
PutObject or the multipart upload API depending on the file size,
|
|
628
|
+
so using `onCloudTrailWriteObject` may be preferable.
|
|
629
|
+
|
|
630
|
+
Requires that there exists at least one CloudTrail Trail in your account
|
|
631
|
+
that captures the event. This method will not create the Trail.
|
|
632
|
+
|
|
633
|
+
###### `id`<sup>Required</sup> <a name="id" id="s3-secure-bucket.S3SecureBucket.onCloudTrailPutObject.parameter.id"></a>
|
|
634
|
+
|
|
635
|
+
- *Type:* string
|
|
636
|
+
|
|
637
|
+
The id of the rule.
|
|
638
|
+
|
|
639
|
+
---
|
|
640
|
+
|
|
641
|
+
###### `options`<sup>Optional</sup> <a name="options" id="s3-secure-bucket.S3SecureBucket.onCloudTrailPutObject.parameter.options"></a>
|
|
642
|
+
|
|
643
|
+
- *Type:* aws-cdk-lib.aws_s3.OnCloudTrailBucketEventOptions
|
|
644
|
+
|
|
645
|
+
Options for adding the rule.
|
|
646
|
+
|
|
647
|
+
---
|
|
648
|
+
|
|
649
|
+
##### `onCloudTrailWriteObject` <a name="onCloudTrailWriteObject" id="s3-secure-bucket.S3SecureBucket.onCloudTrailWriteObject"></a>
|
|
650
|
+
|
|
651
|
+
```typescript
|
|
652
|
+
public onCloudTrailWriteObject(id: string, options?: OnCloudTrailBucketEventOptions): Rule
|
|
653
|
+
```
|
|
654
|
+
|
|
655
|
+
Defines an AWS CloudWatch event that triggers when an object at the specified paths (keys) in this bucket are written to.
|
|
656
|
+
|
|
657
|
+
This includes
|
|
658
|
+
the events PutObject, CopyObject, and CompleteMultipartUpload.
|
|
659
|
+
|
|
660
|
+
Note that some tools like `aws s3 cp` will automatically use either
|
|
661
|
+
PutObject or the multipart upload API depending on the file size,
|
|
662
|
+
so using this method may be preferable to `onCloudTrailPutObject`.
|
|
663
|
+
|
|
664
|
+
Requires that there exists at least one CloudTrail Trail in your account
|
|
665
|
+
that captures the event. This method will not create the Trail.
|
|
666
|
+
|
|
667
|
+
###### `id`<sup>Required</sup> <a name="id" id="s3-secure-bucket.S3SecureBucket.onCloudTrailWriteObject.parameter.id"></a>
|
|
668
|
+
|
|
669
|
+
- *Type:* string
|
|
670
|
+
|
|
671
|
+
The id of the rule.
|
|
672
|
+
|
|
673
|
+
---
|
|
674
|
+
|
|
675
|
+
###### `options`<sup>Optional</sup> <a name="options" id="s3-secure-bucket.S3SecureBucket.onCloudTrailWriteObject.parameter.options"></a>
|
|
676
|
+
|
|
677
|
+
- *Type:* aws-cdk-lib.aws_s3.OnCloudTrailBucketEventOptions
|
|
678
|
+
|
|
679
|
+
Options for adding the rule.
|
|
680
|
+
|
|
681
|
+
---
|
|
682
|
+
|
|
683
|
+
##### `s3UrlForObject` <a name="s3UrlForObject" id="s3-secure-bucket.S3SecureBucket.s3UrlForObject"></a>
|
|
684
|
+
|
|
685
|
+
```typescript
|
|
686
|
+
public s3UrlForObject(key?: string): string
|
|
687
|
+
```
|
|
688
|
+
|
|
689
|
+
The S3 URL of an S3 object. For example:.
|
|
690
|
+
|
|
691
|
+
`s3://onlybucket`
|
|
692
|
+
- `s3://bucket/key`
|
|
693
|
+
|
|
694
|
+
###### `key`<sup>Optional</sup> <a name="key" id="s3-secure-bucket.S3SecureBucket.s3UrlForObject.parameter.key"></a>
|
|
695
|
+
|
|
696
|
+
- *Type:* string
|
|
697
|
+
|
|
698
|
+
The S3 key of the object.
|
|
699
|
+
|
|
700
|
+
If not specified, the S3 URL of the
|
|
701
|
+
bucket is returned.
|
|
702
|
+
|
|
703
|
+
---
|
|
704
|
+
|
|
705
|
+
##### `transferAccelerationUrlForObject` <a name="transferAccelerationUrlForObject" id="s3-secure-bucket.S3SecureBucket.transferAccelerationUrlForObject"></a>
|
|
706
|
+
|
|
707
|
+
```typescript
|
|
708
|
+
public transferAccelerationUrlForObject(key?: string, options?: TransferAccelerationUrlOptions): string
|
|
709
|
+
```
|
|
710
|
+
|
|
711
|
+
The https Transfer Acceleration URL of an S3 object.
|
|
712
|
+
|
|
713
|
+
Specify `dualStack: true` at the options
|
|
714
|
+
for dual-stack endpoint (connect to the bucket over IPv6). For example:
|
|
715
|
+
|
|
716
|
+
- `https://bucket.s3-accelerate.amazonaws.com`
|
|
717
|
+
- `https://bucket.s3-accelerate.amazonaws.com/key`
|
|
718
|
+
|
|
719
|
+
###### `key`<sup>Optional</sup> <a name="key" id="s3-secure-bucket.S3SecureBucket.transferAccelerationUrlForObject.parameter.key"></a>
|
|
720
|
+
|
|
721
|
+
- *Type:* string
|
|
722
|
+
|
|
723
|
+
The S3 key of the object.
|
|
724
|
+
|
|
725
|
+
If not specified, the URL of the
|
|
726
|
+
bucket is returned.
|
|
727
|
+
|
|
728
|
+
---
|
|
729
|
+
|
|
730
|
+
###### `options`<sup>Optional</sup> <a name="options" id="s3-secure-bucket.S3SecureBucket.transferAccelerationUrlForObject.parameter.options"></a>
|
|
731
|
+
|
|
732
|
+
- *Type:* aws-cdk-lib.aws_s3.TransferAccelerationUrlOptions
|
|
733
|
+
|
|
734
|
+
Options for generating URL.
|
|
735
|
+
|
|
736
|
+
---
|
|
737
|
+
|
|
738
|
+
##### `urlForObject` <a name="urlForObject" id="s3-secure-bucket.S3SecureBucket.urlForObject"></a>
|
|
739
|
+
|
|
740
|
+
```typescript
|
|
741
|
+
public urlForObject(key?: string): string
|
|
742
|
+
```
|
|
743
|
+
|
|
744
|
+
The https URL of an S3 object. Specify `regional: false` at the options for non-regional URLs. For example:.
|
|
745
|
+
|
|
746
|
+
`https://s3.us-west-1.amazonaws.com/onlybucket`
|
|
747
|
+
- `https://s3.us-west-1.amazonaws.com/bucket/key`
|
|
748
|
+
- `https://s3.cn-north-1.amazonaws.com.cn/china-bucket/mykey`
|
|
749
|
+
|
|
750
|
+
###### `key`<sup>Optional</sup> <a name="key" id="s3-secure-bucket.S3SecureBucket.urlForObject.parameter.key"></a>
|
|
751
|
+
|
|
752
|
+
- *Type:* string
|
|
753
|
+
|
|
754
|
+
The S3 key of the object.
|
|
755
|
+
|
|
756
|
+
If not specified, the URL of the
|
|
757
|
+
bucket is returned.
|
|
758
|
+
|
|
759
|
+
---
|
|
760
|
+
|
|
761
|
+
##### `virtualHostedUrlForObject` <a name="virtualHostedUrlForObject" id="s3-secure-bucket.S3SecureBucket.virtualHostedUrlForObject"></a>
|
|
762
|
+
|
|
763
|
+
```typescript
|
|
764
|
+
public virtualHostedUrlForObject(key?: string, options?: VirtualHostedStyleUrlOptions): string
|
|
765
|
+
```
|
|
766
|
+
|
|
767
|
+
The virtual hosted-style URL of an S3 object. Specify `regional: false` at the options for non-regional URL. For example:.
|
|
768
|
+
|
|
769
|
+
`https://only-bucket.s3.us-west-1.amazonaws.com`
|
|
770
|
+
- `https://bucket.s3.us-west-1.amazonaws.com/key`
|
|
771
|
+
- `https://bucket.s3.amazonaws.com/key`
|
|
772
|
+
- `https://china-bucket.s3.cn-north-1.amazonaws.com.cn/mykey`
|
|
773
|
+
|
|
774
|
+
###### `key`<sup>Optional</sup> <a name="key" id="s3-secure-bucket.S3SecureBucket.virtualHostedUrlForObject.parameter.key"></a>
|
|
775
|
+
|
|
776
|
+
- *Type:* string
|
|
777
|
+
|
|
778
|
+
The S3 key of the object.
|
|
779
|
+
|
|
780
|
+
If not specified, the URL of the
|
|
781
|
+
bucket is returned.
|
|
782
|
+
|
|
783
|
+
---
|
|
784
|
+
|
|
785
|
+
###### `options`<sup>Optional</sup> <a name="options" id="s3-secure-bucket.S3SecureBucket.virtualHostedUrlForObject.parameter.options"></a>
|
|
786
|
+
|
|
787
|
+
- *Type:* aws-cdk-lib.aws_s3.VirtualHostedStyleUrlOptions
|
|
788
|
+
|
|
789
|
+
Options for generating URL.
|
|
790
|
+
|
|
791
|
+
---
|
|
792
|
+
|
|
793
|
+
##### `addCorsRule` <a name="addCorsRule" id="s3-secure-bucket.S3SecureBucket.addCorsRule"></a>
|
|
794
|
+
|
|
795
|
+
```typescript
|
|
796
|
+
public addCorsRule(rule: CorsRule): void
|
|
797
|
+
```
|
|
798
|
+
|
|
799
|
+
Adds a cross-origin access configuration for objects in an Amazon S3 bucket.
|
|
800
|
+
|
|
801
|
+
###### `rule`<sup>Required</sup> <a name="rule" id="s3-secure-bucket.S3SecureBucket.addCorsRule.parameter.rule"></a>
|
|
802
|
+
|
|
803
|
+
- *Type:* aws-cdk-lib.aws_s3.CorsRule
|
|
804
|
+
|
|
805
|
+
The CORS configuration rule to add.
|
|
806
|
+
|
|
807
|
+
---
|
|
808
|
+
|
|
809
|
+
##### `addInventory` <a name="addInventory" id="s3-secure-bucket.S3SecureBucket.addInventory"></a>
|
|
810
|
+
|
|
811
|
+
```typescript
|
|
812
|
+
public addInventory(inventory: Inventory): void
|
|
813
|
+
```
|
|
814
|
+
|
|
815
|
+
Add an inventory configuration.
|
|
816
|
+
|
|
817
|
+
###### `inventory`<sup>Required</sup> <a name="inventory" id="s3-secure-bucket.S3SecureBucket.addInventory.parameter.inventory"></a>
|
|
818
|
+
|
|
819
|
+
- *Type:* aws-cdk-lib.aws_s3.Inventory
|
|
820
|
+
|
|
821
|
+
configuration to add.
|
|
822
|
+
|
|
823
|
+
---
|
|
824
|
+
|
|
825
|
+
##### `addLifecycleRule` <a name="addLifecycleRule" id="s3-secure-bucket.S3SecureBucket.addLifecycleRule"></a>
|
|
826
|
+
|
|
827
|
+
```typescript
|
|
828
|
+
public addLifecycleRule(rule: LifecycleRule): void
|
|
829
|
+
```
|
|
830
|
+
|
|
831
|
+
Add a lifecycle rule to the bucket.
|
|
832
|
+
|
|
833
|
+
###### `rule`<sup>Required</sup> <a name="rule" id="s3-secure-bucket.S3SecureBucket.addLifecycleRule.parameter.rule"></a>
|
|
834
|
+
|
|
835
|
+
- *Type:* aws-cdk-lib.aws_s3.LifecycleRule
|
|
836
|
+
|
|
837
|
+
The rule to add.
|
|
838
|
+
|
|
839
|
+
---
|
|
840
|
+
|
|
841
|
+
##### `addMetric` <a name="addMetric" id="s3-secure-bucket.S3SecureBucket.addMetric"></a>
|
|
842
|
+
|
|
843
|
+
```typescript
|
|
844
|
+
public addMetric(metric: BucketMetrics): void
|
|
845
|
+
```
|
|
846
|
+
|
|
847
|
+
Adds a metrics configuration for the CloudWatch request metrics from the bucket.
|
|
848
|
+
|
|
849
|
+
###### `metric`<sup>Required</sup> <a name="metric" id="s3-secure-bucket.S3SecureBucket.addMetric.parameter.metric"></a>
|
|
850
|
+
|
|
851
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketMetrics
|
|
852
|
+
|
|
853
|
+
The metric configuration to add.
|
|
854
|
+
|
|
855
|
+
---
|
|
856
|
+
|
|
857
|
+
#### Static Functions <a name="Static Functions" id="Static Functions"></a>
|
|
858
|
+
|
|
859
|
+
| **Name** | **Description** |
|
|
860
|
+
| --- | --- |
|
|
861
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.isConstruct">isConstruct</a></code> | Checks if `x` is a construct. |
|
|
862
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.isOwnedResource">isOwnedResource</a></code> | Returns true if the construct was created by CDK, and false otherwise. |
|
|
863
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.isResource">isResource</a></code> | Check whether the given construct is a Resource. |
|
|
864
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.fromBucketArn">fromBucketArn</a></code> | *No description.* |
|
|
865
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.fromBucketAttributes">fromBucketAttributes</a></code> | Creates a Bucket construct that represents an external bucket. |
|
|
866
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.fromBucketName">fromBucketName</a></code> | *No description.* |
|
|
867
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.fromCfnBucket">fromCfnBucket</a></code> | Create a mutable `IBucket` based on a low-level `CfnBucket`. |
|
|
868
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.validateBucketName">validateBucketName</a></code> | Thrown an exception if the given bucket name is not valid. |
|
|
869
|
+
|
|
870
|
+
---
|
|
871
|
+
|
|
872
|
+
##### `isConstruct` <a name="isConstruct" id="s3-secure-bucket.S3SecureBucket.isConstruct"></a>
|
|
873
|
+
|
|
874
|
+
```typescript
|
|
875
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
876
|
+
|
|
877
|
+
S3SecureBucket.isConstruct(x: any)
|
|
878
|
+
```
|
|
879
|
+
|
|
880
|
+
Checks if `x` is a construct.
|
|
881
|
+
|
|
882
|
+
Use this method instead of `instanceof` to properly detect `Construct`
|
|
883
|
+
instances, even when the construct library is symlinked.
|
|
884
|
+
|
|
885
|
+
Explanation: in JavaScript, multiple copies of the `constructs` library on
|
|
886
|
+
disk are seen as independent, completely different libraries. As a
|
|
887
|
+
consequence, the class `Construct` in each copy of the `constructs` library
|
|
888
|
+
is seen as a different class, and an instance of one class will not test as
|
|
889
|
+
`instanceof` the other class. `npm install` will not create installations
|
|
890
|
+
like this, but users may manually symlink construct libraries together or
|
|
891
|
+
use a monorepo tool: in those cases, multiple copies of the `constructs`
|
|
892
|
+
library can be accidentally installed, and `instanceof` will behave
|
|
893
|
+
unpredictably. It is safest to avoid using `instanceof`, and using
|
|
894
|
+
this type-testing method instead.
|
|
895
|
+
|
|
896
|
+
###### `x`<sup>Required</sup> <a name="x" id="s3-secure-bucket.S3SecureBucket.isConstruct.parameter.x"></a>
|
|
897
|
+
|
|
898
|
+
- *Type:* any
|
|
899
|
+
|
|
900
|
+
Any object.
|
|
901
|
+
|
|
902
|
+
---
|
|
903
|
+
|
|
904
|
+
##### `isOwnedResource` <a name="isOwnedResource" id="s3-secure-bucket.S3SecureBucket.isOwnedResource"></a>
|
|
905
|
+
|
|
906
|
+
```typescript
|
|
907
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
908
|
+
|
|
909
|
+
S3SecureBucket.isOwnedResource(construct: IConstruct)
|
|
910
|
+
```
|
|
911
|
+
|
|
912
|
+
Returns true if the construct was created by CDK, and false otherwise.
|
|
913
|
+
|
|
914
|
+
###### `construct`<sup>Required</sup> <a name="construct" id="s3-secure-bucket.S3SecureBucket.isOwnedResource.parameter.construct"></a>
|
|
915
|
+
|
|
916
|
+
- *Type:* constructs.IConstruct
|
|
917
|
+
|
|
918
|
+
---
|
|
919
|
+
|
|
920
|
+
##### `isResource` <a name="isResource" id="s3-secure-bucket.S3SecureBucket.isResource"></a>
|
|
921
|
+
|
|
922
|
+
```typescript
|
|
923
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
924
|
+
|
|
925
|
+
S3SecureBucket.isResource(construct: IConstruct)
|
|
926
|
+
```
|
|
927
|
+
|
|
928
|
+
Check whether the given construct is a Resource.
|
|
929
|
+
|
|
930
|
+
###### `construct`<sup>Required</sup> <a name="construct" id="s3-secure-bucket.S3SecureBucket.isResource.parameter.construct"></a>
|
|
931
|
+
|
|
932
|
+
- *Type:* constructs.IConstruct
|
|
933
|
+
|
|
934
|
+
---
|
|
935
|
+
|
|
936
|
+
##### `fromBucketArn` <a name="fromBucketArn" id="s3-secure-bucket.S3SecureBucket.fromBucketArn"></a>
|
|
937
|
+
|
|
938
|
+
```typescript
|
|
939
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
940
|
+
|
|
941
|
+
S3SecureBucket.fromBucketArn(scope: Construct, id: string, bucketArn: string)
|
|
942
|
+
```
|
|
943
|
+
|
|
944
|
+
###### `scope`<sup>Required</sup> <a name="scope" id="s3-secure-bucket.S3SecureBucket.fromBucketArn.parameter.scope"></a>
|
|
945
|
+
|
|
946
|
+
- *Type:* constructs.Construct
|
|
947
|
+
|
|
948
|
+
---
|
|
949
|
+
|
|
950
|
+
###### `id`<sup>Required</sup> <a name="id" id="s3-secure-bucket.S3SecureBucket.fromBucketArn.parameter.id"></a>
|
|
951
|
+
|
|
952
|
+
- *Type:* string
|
|
953
|
+
|
|
954
|
+
---
|
|
955
|
+
|
|
956
|
+
###### `bucketArn`<sup>Required</sup> <a name="bucketArn" id="s3-secure-bucket.S3SecureBucket.fromBucketArn.parameter.bucketArn"></a>
|
|
957
|
+
|
|
958
|
+
- *Type:* string
|
|
959
|
+
|
|
960
|
+
---
|
|
961
|
+
|
|
962
|
+
##### `fromBucketAttributes` <a name="fromBucketAttributes" id="s3-secure-bucket.S3SecureBucket.fromBucketAttributes"></a>
|
|
963
|
+
|
|
964
|
+
```typescript
|
|
965
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
966
|
+
|
|
967
|
+
S3SecureBucket.fromBucketAttributes(scope: Construct, id: string, attrs: BucketAttributes)
|
|
968
|
+
```
|
|
969
|
+
|
|
970
|
+
Creates a Bucket construct that represents an external bucket.
|
|
971
|
+
|
|
972
|
+
###### `scope`<sup>Required</sup> <a name="scope" id="s3-secure-bucket.S3SecureBucket.fromBucketAttributes.parameter.scope"></a>
|
|
973
|
+
|
|
974
|
+
- *Type:* constructs.Construct
|
|
975
|
+
|
|
976
|
+
The parent creating construct (usually `this`).
|
|
977
|
+
|
|
978
|
+
---
|
|
979
|
+
|
|
980
|
+
###### `id`<sup>Required</sup> <a name="id" id="s3-secure-bucket.S3SecureBucket.fromBucketAttributes.parameter.id"></a>
|
|
981
|
+
|
|
982
|
+
- *Type:* string
|
|
983
|
+
|
|
984
|
+
The construct's name.
|
|
985
|
+
|
|
986
|
+
---
|
|
987
|
+
|
|
988
|
+
###### `attrs`<sup>Required</sup> <a name="attrs" id="s3-secure-bucket.S3SecureBucket.fromBucketAttributes.parameter.attrs"></a>
|
|
989
|
+
|
|
990
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketAttributes
|
|
991
|
+
|
|
992
|
+
A `BucketAttributes` object.
|
|
993
|
+
|
|
994
|
+
Can be obtained from a call to
|
|
995
|
+
`bucket.export()` or manually created.
|
|
996
|
+
|
|
997
|
+
---
|
|
998
|
+
|
|
999
|
+
##### `fromBucketName` <a name="fromBucketName" id="s3-secure-bucket.S3SecureBucket.fromBucketName"></a>
|
|
1000
|
+
|
|
1001
|
+
```typescript
|
|
1002
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
1003
|
+
|
|
1004
|
+
S3SecureBucket.fromBucketName(scope: Construct, id: string, bucketName: string)
|
|
1005
|
+
```
|
|
1006
|
+
|
|
1007
|
+
###### `scope`<sup>Required</sup> <a name="scope" id="s3-secure-bucket.S3SecureBucket.fromBucketName.parameter.scope"></a>
|
|
1008
|
+
|
|
1009
|
+
- *Type:* constructs.Construct
|
|
1010
|
+
|
|
1011
|
+
---
|
|
1012
|
+
|
|
1013
|
+
###### `id`<sup>Required</sup> <a name="id" id="s3-secure-bucket.S3SecureBucket.fromBucketName.parameter.id"></a>
|
|
1014
|
+
|
|
1015
|
+
- *Type:* string
|
|
1016
|
+
|
|
1017
|
+
---
|
|
1018
|
+
|
|
1019
|
+
###### `bucketName`<sup>Required</sup> <a name="bucketName" id="s3-secure-bucket.S3SecureBucket.fromBucketName.parameter.bucketName"></a>
|
|
1020
|
+
|
|
1021
|
+
- *Type:* string
|
|
1022
|
+
|
|
1023
|
+
---
|
|
1024
|
+
|
|
1025
|
+
##### `fromCfnBucket` <a name="fromCfnBucket" id="s3-secure-bucket.S3SecureBucket.fromCfnBucket"></a>
|
|
1026
|
+
|
|
1027
|
+
```typescript
|
|
1028
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
1029
|
+
|
|
1030
|
+
S3SecureBucket.fromCfnBucket(cfnBucket: CfnBucket)
|
|
1031
|
+
```
|
|
1032
|
+
|
|
1033
|
+
Create a mutable `IBucket` based on a low-level `CfnBucket`.
|
|
1034
|
+
|
|
1035
|
+
###### `cfnBucket`<sup>Required</sup> <a name="cfnBucket" id="s3-secure-bucket.S3SecureBucket.fromCfnBucket.parameter.cfnBucket"></a>
|
|
1036
|
+
|
|
1037
|
+
- *Type:* aws-cdk-lib.aws_s3.CfnBucket
|
|
1038
|
+
|
|
1039
|
+
---
|
|
1040
|
+
|
|
1041
|
+
##### `validateBucketName` <a name="validateBucketName" id="s3-secure-bucket.S3SecureBucket.validateBucketName"></a>
|
|
1042
|
+
|
|
1043
|
+
```typescript
|
|
1044
|
+
import { S3SecureBucket } from 's3-secure-bucket'
|
|
1045
|
+
|
|
1046
|
+
S3SecureBucket.validateBucketName(physicalName: string, allowLegacyBucketNaming?: boolean)
|
|
1047
|
+
```
|
|
1048
|
+
|
|
1049
|
+
Thrown an exception if the given bucket name is not valid.
|
|
1050
|
+
|
|
1051
|
+
###### `physicalName`<sup>Required</sup> <a name="physicalName" id="s3-secure-bucket.S3SecureBucket.validateBucketName.parameter.physicalName"></a>
|
|
1052
|
+
|
|
1053
|
+
- *Type:* string
|
|
1054
|
+
|
|
1055
|
+
name of the bucket.
|
|
1056
|
+
|
|
1057
|
+
---
|
|
1058
|
+
|
|
1059
|
+
###### `allowLegacyBucketNaming`<sup>Optional</sup> <a name="allowLegacyBucketNaming" id="s3-secure-bucket.S3SecureBucket.validateBucketName.parameter.allowLegacyBucketNaming"></a>
|
|
1060
|
+
|
|
1061
|
+
- *Type:* boolean
|
|
1062
|
+
|
|
1063
|
+
allow legacy bucket naming style, default is false.
|
|
1064
|
+
|
|
1065
|
+
---
|
|
1066
|
+
|
|
1067
|
+
#### Properties <a name="Properties" id="Properties"></a>
|
|
1068
|
+
|
|
1069
|
+
| **Name** | **Type** | **Description** |
|
|
1070
|
+
| --- | --- | --- |
|
|
1071
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
|
|
1072
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.env">env</a></code> | <code>aws-cdk-lib.interfaces.ResourceEnvironment</code> | The environment this resource belongs to. |
|
|
1073
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.stack">stack</a></code> | <code>aws-cdk-lib.Stack</code> | The stack in which this resource is defined. |
|
|
1074
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.bucketArn">bucketArn</a></code> | <code>string</code> | The ARN of the bucket. |
|
|
1075
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.bucketDomainName">bucketDomainName</a></code> | <code>string</code> | The IPv4 DNS name of the specified bucket. |
|
|
1076
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.bucketDualStackDomainName">bucketDualStackDomainName</a></code> | <code>string</code> | The IPv6 DNS name of the specified bucket. |
|
|
1077
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.bucketName">bucketName</a></code> | <code>string</code> | The name of the bucket. |
|
|
1078
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.bucketRef">bucketRef</a></code> | <code>aws-cdk-lib.interfaces.aws_s3.BucketReference</code> | A reference to a Bucket resource. |
|
|
1079
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.bucketRegionalDomainName">bucketRegionalDomainName</a></code> | <code>string</code> | The regional domain name of the specified bucket. |
|
|
1080
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.bucketWebsiteDomainName">bucketWebsiteDomainName</a></code> | <code>string</code> | The Domain name of the static website. |
|
|
1081
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.bucketWebsiteUrl">bucketWebsiteUrl</a></code> | <code>string</code> | The URL of the static website. |
|
|
1082
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | Optional KMS encryption key associated with this bucket. |
|
|
1083
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.isWebsite">isWebsite</a></code> | <code>boolean</code> | If this bucket has been configured for static website hosting. |
|
|
1084
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.grants">grants</a></code> | <code>aws-cdk-lib.aws_s3.BucketGrants</code> | Collection of grant methods for a Bucket. |
|
|
1085
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.disallowPublicAccess">disallowPublicAccess</a></code> | <code>boolean</code> | Whether to disallow public access. |
|
|
1086
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.policy">policy</a></code> | <code>aws-cdk-lib.aws_s3.BucketPolicy</code> | The resource policy associated with this bucket. |
|
|
1087
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.replicationRoleArn">replicationRoleArn</a></code> | <code>string</code> | Role used to set up permissions on this bucket for replication. |
|
|
1088
|
+
|
|
1089
|
+
---
|
|
1090
|
+
|
|
1091
|
+
##### `node`<sup>Required</sup> <a name="node" id="s3-secure-bucket.S3SecureBucket.property.node"></a>
|
|
1092
|
+
|
|
1093
|
+
```typescript
|
|
1094
|
+
public readonly node: Node;
|
|
1095
|
+
```
|
|
1096
|
+
|
|
1097
|
+
- *Type:* constructs.Node
|
|
1098
|
+
|
|
1099
|
+
The tree node.
|
|
1100
|
+
|
|
1101
|
+
---
|
|
1102
|
+
|
|
1103
|
+
##### `env`<sup>Required</sup> <a name="env" id="s3-secure-bucket.S3SecureBucket.property.env"></a>
|
|
1104
|
+
|
|
1105
|
+
```typescript
|
|
1106
|
+
public readonly env: ResourceEnvironment;
|
|
1107
|
+
```
|
|
1108
|
+
|
|
1109
|
+
- *Type:* aws-cdk-lib.interfaces.ResourceEnvironment
|
|
1110
|
+
|
|
1111
|
+
The environment this resource belongs to.
|
|
1112
|
+
|
|
1113
|
+
For resources that are created and managed in a Stack (those created by
|
|
1114
|
+
creating new class instances like `new Role()`, `new Bucket()`, etc.), this
|
|
1115
|
+
is always the same as the environment of the stack they belong to.
|
|
1116
|
+
|
|
1117
|
+
For referenced resources (those obtained from referencing methods like
|
|
1118
|
+
`Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
|
|
1119
|
+
different than the stack they were imported into.
|
|
1120
|
+
|
|
1121
|
+
---
|
|
1122
|
+
|
|
1123
|
+
##### `stack`<sup>Required</sup> <a name="stack" id="s3-secure-bucket.S3SecureBucket.property.stack"></a>
|
|
1124
|
+
|
|
1125
|
+
```typescript
|
|
1126
|
+
public readonly stack: Stack;
|
|
1127
|
+
```
|
|
1128
|
+
|
|
1129
|
+
- *Type:* aws-cdk-lib.Stack
|
|
1130
|
+
|
|
1131
|
+
The stack in which this resource is defined.
|
|
1132
|
+
|
|
1133
|
+
---
|
|
1134
|
+
|
|
1135
|
+
##### `bucketArn`<sup>Required</sup> <a name="bucketArn" id="s3-secure-bucket.S3SecureBucket.property.bucketArn"></a>
|
|
1136
|
+
|
|
1137
|
+
```typescript
|
|
1138
|
+
public readonly bucketArn: string;
|
|
1139
|
+
```
|
|
1140
|
+
|
|
1141
|
+
- *Type:* string
|
|
1142
|
+
|
|
1143
|
+
The ARN of the bucket.
|
|
1144
|
+
|
|
1145
|
+
---
|
|
1146
|
+
|
|
1147
|
+
##### `bucketDomainName`<sup>Required</sup> <a name="bucketDomainName" id="s3-secure-bucket.S3SecureBucket.property.bucketDomainName"></a>
|
|
1148
|
+
|
|
1149
|
+
```typescript
|
|
1150
|
+
public readonly bucketDomainName: string;
|
|
1151
|
+
```
|
|
1152
|
+
|
|
1153
|
+
- *Type:* string
|
|
1154
|
+
|
|
1155
|
+
The IPv4 DNS name of the specified bucket.
|
|
1156
|
+
|
|
1157
|
+
---
|
|
1158
|
+
|
|
1159
|
+
##### `bucketDualStackDomainName`<sup>Required</sup> <a name="bucketDualStackDomainName" id="s3-secure-bucket.S3SecureBucket.property.bucketDualStackDomainName"></a>
|
|
1160
|
+
|
|
1161
|
+
```typescript
|
|
1162
|
+
public readonly bucketDualStackDomainName: string;
|
|
1163
|
+
```
|
|
1164
|
+
|
|
1165
|
+
- *Type:* string
|
|
1166
|
+
|
|
1167
|
+
The IPv6 DNS name of the specified bucket.
|
|
1168
|
+
|
|
1169
|
+
---
|
|
1170
|
+
|
|
1171
|
+
##### `bucketName`<sup>Required</sup> <a name="bucketName" id="s3-secure-bucket.S3SecureBucket.property.bucketName"></a>
|
|
1172
|
+
|
|
1173
|
+
```typescript
|
|
1174
|
+
public readonly bucketName: string;
|
|
1175
|
+
```
|
|
1176
|
+
|
|
1177
|
+
- *Type:* string
|
|
1178
|
+
|
|
1179
|
+
The name of the bucket.
|
|
1180
|
+
|
|
1181
|
+
---
|
|
1182
|
+
|
|
1183
|
+
##### `bucketRef`<sup>Required</sup> <a name="bucketRef" id="s3-secure-bucket.S3SecureBucket.property.bucketRef"></a>
|
|
1184
|
+
|
|
1185
|
+
```typescript
|
|
1186
|
+
public readonly bucketRef: BucketReference;
|
|
1187
|
+
```
|
|
1188
|
+
|
|
1189
|
+
- *Type:* aws-cdk-lib.interfaces.aws_s3.BucketReference
|
|
1190
|
+
|
|
1191
|
+
A reference to a Bucket resource.
|
|
1192
|
+
|
|
1193
|
+
---
|
|
1194
|
+
|
|
1195
|
+
##### `bucketRegionalDomainName`<sup>Required</sup> <a name="bucketRegionalDomainName" id="s3-secure-bucket.S3SecureBucket.property.bucketRegionalDomainName"></a>
|
|
1196
|
+
|
|
1197
|
+
```typescript
|
|
1198
|
+
public readonly bucketRegionalDomainName: string;
|
|
1199
|
+
```
|
|
1200
|
+
|
|
1201
|
+
- *Type:* string
|
|
1202
|
+
|
|
1203
|
+
The regional domain name of the specified bucket.
|
|
1204
|
+
|
|
1205
|
+
---
|
|
1206
|
+
|
|
1207
|
+
##### `bucketWebsiteDomainName`<sup>Required</sup> <a name="bucketWebsiteDomainName" id="s3-secure-bucket.S3SecureBucket.property.bucketWebsiteDomainName"></a>
|
|
1208
|
+
|
|
1209
|
+
```typescript
|
|
1210
|
+
public readonly bucketWebsiteDomainName: string;
|
|
1211
|
+
```
|
|
1212
|
+
|
|
1213
|
+
- *Type:* string
|
|
1214
|
+
|
|
1215
|
+
The Domain name of the static website.
|
|
1216
|
+
|
|
1217
|
+
---
|
|
1218
|
+
|
|
1219
|
+
##### `bucketWebsiteUrl`<sup>Required</sup> <a name="bucketWebsiteUrl" id="s3-secure-bucket.S3SecureBucket.property.bucketWebsiteUrl"></a>
|
|
1220
|
+
|
|
1221
|
+
```typescript
|
|
1222
|
+
public readonly bucketWebsiteUrl: string;
|
|
1223
|
+
```
|
|
1224
|
+
|
|
1225
|
+
- *Type:* string
|
|
1226
|
+
|
|
1227
|
+
The URL of the static website.
|
|
1228
|
+
|
|
1229
|
+
---
|
|
1230
|
+
|
|
1231
|
+
##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="s3-secure-bucket.S3SecureBucket.property.encryptionKey"></a>
|
|
1232
|
+
|
|
1233
|
+
```typescript
|
|
1234
|
+
public readonly encryptionKey: IKey;
|
|
1235
|
+
```
|
|
1236
|
+
|
|
1237
|
+
- *Type:* aws-cdk-lib.aws_kms.IKey
|
|
1238
|
+
|
|
1239
|
+
Optional KMS encryption key associated with this bucket.
|
|
1240
|
+
|
|
1241
|
+
---
|
|
1242
|
+
|
|
1243
|
+
##### `isWebsite`<sup>Optional</sup> <a name="isWebsite" id="s3-secure-bucket.S3SecureBucket.property.isWebsite"></a>
|
|
1244
|
+
|
|
1245
|
+
```typescript
|
|
1246
|
+
public readonly isWebsite: boolean;
|
|
1247
|
+
```
|
|
1248
|
+
|
|
1249
|
+
- *Type:* boolean
|
|
1250
|
+
|
|
1251
|
+
If this bucket has been configured for static website hosting.
|
|
1252
|
+
|
|
1253
|
+
---
|
|
1254
|
+
|
|
1255
|
+
##### `grants`<sup>Required</sup> <a name="grants" id="s3-secure-bucket.S3SecureBucket.property.grants"></a>
|
|
1256
|
+
|
|
1257
|
+
```typescript
|
|
1258
|
+
public readonly grants: BucketGrants;
|
|
1259
|
+
```
|
|
1260
|
+
|
|
1261
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketGrants
|
|
1262
|
+
|
|
1263
|
+
Collection of grant methods for a Bucket.
|
|
1264
|
+
|
|
1265
|
+
---
|
|
1266
|
+
|
|
1267
|
+
##### `disallowPublicAccess`<sup>Optional</sup> <a name="disallowPublicAccess" id="s3-secure-bucket.S3SecureBucket.property.disallowPublicAccess"></a>
|
|
1268
|
+
|
|
1269
|
+
```typescript
|
|
1270
|
+
public readonly disallowPublicAccess: boolean;
|
|
1271
|
+
```
|
|
1272
|
+
|
|
1273
|
+
- *Type:* boolean
|
|
1274
|
+
|
|
1275
|
+
Whether to disallow public access.
|
|
1276
|
+
|
|
1277
|
+
---
|
|
1278
|
+
|
|
1279
|
+
##### `policy`<sup>Optional</sup> <a name="policy" id="s3-secure-bucket.S3SecureBucket.property.policy"></a>
|
|
1280
|
+
|
|
1281
|
+
```typescript
|
|
1282
|
+
public readonly policy: BucketPolicy;
|
|
1283
|
+
```
|
|
1284
|
+
|
|
1285
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketPolicy
|
|
1286
|
+
|
|
1287
|
+
The resource policy associated with this bucket.
|
|
1288
|
+
|
|
1289
|
+
If `autoCreatePolicy` is true, a `BucketPolicy` will be created upon the
|
|
1290
|
+
first call to addToResourcePolicy(s).
|
|
1291
|
+
|
|
1292
|
+
---
|
|
1293
|
+
|
|
1294
|
+
##### `replicationRoleArn`<sup>Optional</sup> <a name="replicationRoleArn" id="s3-secure-bucket.S3SecureBucket.property.replicationRoleArn"></a>
|
|
1295
|
+
|
|
1296
|
+
```typescript
|
|
1297
|
+
public readonly replicationRoleArn: string;
|
|
1298
|
+
```
|
|
1299
|
+
|
|
1300
|
+
- *Type:* string
|
|
1301
|
+
|
|
1302
|
+
Role used to set up permissions on this bucket for replication.
|
|
1303
|
+
|
|
1304
|
+
---
|
|
1305
|
+
|
|
1306
|
+
#### Constants <a name="Constants" id="Constants"></a>
|
|
1307
|
+
|
|
1308
|
+
| **Name** | **Type** | **Description** |
|
|
1309
|
+
| --- | --- | --- |
|
|
1310
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucket.property.PROPERTY_INJECTION_ID">PROPERTY_INJECTION_ID</a></code> | <code>string</code> | Uniquely identifies this class. |
|
|
1311
|
+
|
|
1312
|
+
---
|
|
1313
|
+
|
|
1314
|
+
##### `PROPERTY_INJECTION_ID`<sup>Required</sup> <a name="PROPERTY_INJECTION_ID" id="s3-secure-bucket.S3SecureBucket.property.PROPERTY_INJECTION_ID"></a>
|
|
1315
|
+
|
|
1316
|
+
```typescript
|
|
1317
|
+
public readonly PROPERTY_INJECTION_ID: string;
|
|
1318
|
+
```
|
|
1319
|
+
|
|
1320
|
+
- *Type:* string
|
|
1321
|
+
|
|
1322
|
+
Uniquely identifies this class.
|
|
1323
|
+
|
|
1324
|
+
---
|
|
1325
|
+
|
|
1326
|
+
## Structs <a name="Structs" id="Structs"></a>
|
|
1327
|
+
|
|
1328
|
+
### S3SecureBucketProps <a name="S3SecureBucketProps" id="s3-secure-bucket.S3SecureBucketProps"></a>
|
|
1329
|
+
|
|
1330
|
+
Props for {@link S3SecureBucket}.
|
|
1331
|
+
|
|
1332
|
+
Extends `s3.BucketProps` with a bucket type for secure defaults.
|
|
1333
|
+
|
|
1334
|
+
#### Initializer <a name="Initializer" id="s3-secure-bucket.S3SecureBucketProps.Initializer"></a>
|
|
1335
|
+
|
|
1336
|
+
```typescript
|
|
1337
|
+
import { S3SecureBucketProps } from 's3-secure-bucket'
|
|
1338
|
+
|
|
1339
|
+
const s3SecureBucketProps: S3SecureBucketProps = { ... }
|
|
1340
|
+
```
|
|
1341
|
+
|
|
1342
|
+
#### Properties <a name="Properties" id="Properties"></a>
|
|
1343
|
+
|
|
1344
|
+
| **Name** | **Type** | **Description** |
|
|
1345
|
+
| --- | --- | --- |
|
|
1346
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.accessControl">accessControl</a></code> | <code>aws-cdk-lib.aws_s3.BucketAccessControl</code> | Specifies a canned ACL that grants predefined permissions to the bucket. |
|
|
1347
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.autoDeleteObjects">autoDeleteObjects</a></code> | <code>boolean</code> | Whether all objects should be automatically deleted when the bucket is removed from the stack or when the stack is deleted. |
|
|
1348
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.blockPublicAccess">blockPublicAccess</a></code> | <code>aws-cdk-lib.aws_s3.BlockPublicAccess</code> | The block public access configuration of this bucket. |
|
|
1349
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.bucketKeyEnabled">bucketKeyEnabled</a></code> | <code>boolean</code> | Whether Amazon S3 should use its own intermediary key to generate data keys. |
|
|
1350
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.bucketName">bucketName</a></code> | <code>string</code> | Physical name of this bucket. |
|
|
1351
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.cors">cors</a></code> | <code>aws-cdk-lib.aws_s3.CorsRule[]</code> | The CORS configuration of this bucket. |
|
|
1352
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.encryption">encryption</a></code> | <code>aws-cdk-lib.aws_s3.BucketEncryption</code> | The kind of server-side encryption to apply to this bucket. |
|
|
1353
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | External KMS key to use for bucket encryption. |
|
|
1354
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.enforceSSL">enforceSSL</a></code> | <code>boolean</code> | Enforces SSL for requests. |
|
|
1355
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.eventBridgeEnabled">eventBridgeEnabled</a></code> | <code>boolean</code> | Whether this bucket should send notifications to Amazon EventBridge or not. |
|
|
1356
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.intelligentTieringConfigurations">intelligentTieringConfigurations</a></code> | <code>aws-cdk-lib.aws_s3.IntelligentTieringConfiguration[]</code> | Intelligent Tiering Configurations. |
|
|
1357
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.inventories">inventories</a></code> | <code>aws-cdk-lib.aws_s3.Inventory[]</code> | The inventory configuration of the bucket. |
|
|
1358
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.lifecycleRules">lifecycleRules</a></code> | <code>aws-cdk-lib.aws_s3.LifecycleRule[]</code> | Rules that define how Amazon S3 manages objects during their lifetime. |
|
|
1359
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.metrics">metrics</a></code> | <code>aws-cdk-lib.aws_s3.BucketMetrics[]</code> | The metrics configuration of this bucket. |
|
|
1360
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.minimumTLSVersion">minimumTLSVersion</a></code> | <code>number</code> | Enforces minimum TLS version for requests. |
|
|
1361
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.notificationsHandlerRole">notificationsHandlerRole</a></code> | <code>aws-cdk-lib.aws_iam.IRole</code> | The role to be used by the notifications handler. |
|
|
1362
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.notificationsSkipDestinationValidation">notificationsSkipDestinationValidation</a></code> | <code>boolean</code> | Skips notification validation of Amazon SQS, Amazon SNS, and Lambda destinations. |
|
|
1363
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.objectLockDefaultRetention">objectLockDefaultRetention</a></code> | <code>aws-cdk-lib.aws_s3.ObjectLockRetention</code> | The default retention mode and rules for S3 Object Lock. |
|
|
1364
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.objectLockEnabled">objectLockEnabled</a></code> | <code>boolean</code> | Enable object lock on the bucket. |
|
|
1365
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.objectOwnership">objectOwnership</a></code> | <code>aws-cdk-lib.aws_s3.ObjectOwnership</code> | The objectOwnership of the bucket. |
|
|
1366
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.publicReadAccess">publicReadAccess</a></code> | <code>boolean</code> | Grants public read access to all objects in the bucket. |
|
|
1367
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.removalPolicy">removalPolicy</a></code> | <code>aws-cdk-lib.RemovalPolicy</code> | Policy to apply when the bucket is removed from this stack. |
|
|
1368
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.replicationRole">replicationRole</a></code> | <code>aws-cdk-lib.aws_iam.IRole</code> | The role to be used by the replication. |
|
|
1369
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.replicationRules">replicationRules</a></code> | <code>aws-cdk-lib.aws_s3.ReplicationRule[]</code> | A container for one or more replication rules. |
|
|
1370
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.serverAccessLogsBucket">serverAccessLogsBucket</a></code> | <code>aws-cdk-lib.aws_s3.IBucket</code> | Destination bucket for the server access logs. |
|
|
1371
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.serverAccessLogsPrefix">serverAccessLogsPrefix</a></code> | <code>string</code> | Optional log file prefix to use for the bucket's access logs. |
|
|
1372
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.targetObjectKeyFormat">targetObjectKeyFormat</a></code> | <code>aws-cdk-lib.aws_s3.TargetObjectKeyFormat</code> | Optional key format for log objects. |
|
|
1373
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.transferAcceleration">transferAcceleration</a></code> | <code>boolean</code> | Whether this bucket should have transfer acceleration turned on or not. |
|
|
1374
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.transitionDefaultMinimumObjectSize">transitionDefaultMinimumObjectSize</a></code> | <code>aws-cdk-lib.aws_s3.TransitionDefaultMinimumObjectSize</code> | Indicates which default minimum object size behavior is applied to the lifecycle configuration. |
|
|
1375
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.versioned">versioned</a></code> | <code>boolean</code> | Whether this bucket should have versioning turned on or not. |
|
|
1376
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteErrorDocument">websiteErrorDocument</a></code> | <code>string</code> | The name of the error document (e.g. "404.html") for the website. `websiteIndexDocument` must also be set if this is set. |
|
|
1377
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteIndexDocument">websiteIndexDocument</a></code> | <code>string</code> | The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket. |
|
|
1378
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteRedirect">websiteRedirect</a></code> | <code>aws-cdk-lib.aws_s3.RedirectTarget</code> | Specifies the redirect behavior of all requests to a website endpoint of a bucket. |
|
|
1379
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteRoutingRules">websiteRoutingRules</a></code> | <code>aws-cdk-lib.aws_s3.RoutingRule[]</code> | Rules that define when a redirect is applied and the redirect behavior. |
|
|
1380
|
+
| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.bucketType">bucketType</a></code> | <code>string</code> | The type of the bucket. |
|
|
1381
|
+
|
|
1382
|
+
---
|
|
1383
|
+
|
|
1384
|
+
##### `accessControl`<sup>Optional</sup> <a name="accessControl" id="s3-secure-bucket.S3SecureBucketProps.property.accessControl"></a>
|
|
1385
|
+
|
|
1386
|
+
```typescript
|
|
1387
|
+
public readonly accessControl: BucketAccessControl;
|
|
1388
|
+
```
|
|
1389
|
+
|
|
1390
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketAccessControl
|
|
1391
|
+
- *Default:* BucketAccessControl.PRIVATE
|
|
1392
|
+
|
|
1393
|
+
Specifies a canned ACL that grants predefined permissions to the bucket.
|
|
1394
|
+
|
|
1395
|
+
---
|
|
1396
|
+
|
|
1397
|
+
##### `autoDeleteObjects`<sup>Optional</sup> <a name="autoDeleteObjects" id="s3-secure-bucket.S3SecureBucketProps.property.autoDeleteObjects"></a>
|
|
1398
|
+
|
|
1399
|
+
```typescript
|
|
1400
|
+
public readonly autoDeleteObjects: boolean;
|
|
1401
|
+
```
|
|
1402
|
+
|
|
1403
|
+
- *Type:* boolean
|
|
1404
|
+
- *Default:* false
|
|
1405
|
+
|
|
1406
|
+
Whether all objects should be automatically deleted when the bucket is removed from the stack or when the stack is deleted.
|
|
1407
|
+
|
|
1408
|
+
Requires the `removalPolicy` to be set to `RemovalPolicy.DESTROY`.
|
|
1409
|
+
|
|
1410
|
+
**Warning** if you have deployed a bucket with `autoDeleteObjects: true`,
|
|
1411
|
+
switching this to `false` in a CDK version *before* `1.126.0` will lead to
|
|
1412
|
+
all objects in the bucket being deleted. Be sure to update your bucket resources
|
|
1413
|
+
by deploying with CDK version `1.126.0` or later **before** switching this value to `false`.
|
|
1414
|
+
|
|
1415
|
+
Setting `autoDeleteObjects` to true on a bucket will add `s3:PutBucketPolicy` to the
|
|
1416
|
+
bucket policy. This is because during bucket deletion, the custom resource provider
|
|
1417
|
+
needs to update the bucket policy by adding a deny policy for `s3:PutObject` to
|
|
1418
|
+
prevent race conditions with external bucket writers.
|
|
1419
|
+
|
|
1420
|
+
---
|
|
1421
|
+
|
|
1422
|
+
##### `blockPublicAccess`<sup>Optional</sup> <a name="blockPublicAccess" id="s3-secure-bucket.S3SecureBucketProps.property.blockPublicAccess"></a>
|
|
1423
|
+
|
|
1424
|
+
```typescript
|
|
1425
|
+
public readonly blockPublicAccess: BlockPublicAccess;
|
|
1426
|
+
```
|
|
1427
|
+
|
|
1428
|
+
- *Type:* aws-cdk-lib.aws_s3.BlockPublicAccess
|
|
1429
|
+
- *Default:* CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
|
|
1430
|
+
|
|
1431
|
+
The block public access configuration of this bucket.
|
|
1432
|
+
|
|
1433
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html)
|
|
1434
|
+
|
|
1435
|
+
---
|
|
1436
|
+
|
|
1437
|
+
##### `bucketKeyEnabled`<sup>Optional</sup> <a name="bucketKeyEnabled" id="s3-secure-bucket.S3SecureBucketProps.property.bucketKeyEnabled"></a>
|
|
1438
|
+
|
|
1439
|
+
```typescript
|
|
1440
|
+
public readonly bucketKeyEnabled: boolean;
|
|
1441
|
+
```
|
|
1442
|
+
|
|
1443
|
+
- *Type:* boolean
|
|
1444
|
+
- *Default:* false
|
|
1445
|
+
|
|
1446
|
+
Whether Amazon S3 should use its own intermediary key to generate data keys.
|
|
1447
|
+
|
|
1448
|
+
Only relevant when using KMS for encryption.
|
|
1449
|
+
|
|
1450
|
+
- If not enabled, every object GET and PUT will cause an API call to KMS (with the
|
|
1451
|
+
attendant cost implications of that).
|
|
1452
|
+
- If enabled, S3 will use its own time-limited key instead.
|
|
1453
|
+
|
|
1454
|
+
Only relevant, when Encryption is not set to `BucketEncryption.UNENCRYPTED`.
|
|
1455
|
+
|
|
1456
|
+
---
|
|
1457
|
+
|
|
1458
|
+
##### `bucketName`<sup>Optional</sup> <a name="bucketName" id="s3-secure-bucket.S3SecureBucketProps.property.bucketName"></a>
|
|
1459
|
+
|
|
1460
|
+
```typescript
|
|
1461
|
+
public readonly bucketName: string;
|
|
1462
|
+
```
|
|
1463
|
+
|
|
1464
|
+
- *Type:* string
|
|
1465
|
+
- *Default:* Assigned by CloudFormation (recommended).
|
|
1466
|
+
|
|
1467
|
+
Physical name of this bucket.
|
|
1468
|
+
|
|
1469
|
+
---
|
|
1470
|
+
|
|
1471
|
+
##### `cors`<sup>Optional</sup> <a name="cors" id="s3-secure-bucket.S3SecureBucketProps.property.cors"></a>
|
|
1472
|
+
|
|
1473
|
+
```typescript
|
|
1474
|
+
public readonly cors: CorsRule[];
|
|
1475
|
+
```
|
|
1476
|
+
|
|
1477
|
+
- *Type:* aws-cdk-lib.aws_s3.CorsRule[]
|
|
1478
|
+
- *Default:* No CORS configuration.
|
|
1479
|
+
|
|
1480
|
+
The CORS configuration of this bucket.
|
|
1481
|
+
|
|
1482
|
+
> [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-cors.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-cors.html)
|
|
1483
|
+
|
|
1484
|
+
---
|
|
1485
|
+
|
|
1486
|
+
##### `encryption`<sup>Optional</sup> <a name="encryption" id="s3-secure-bucket.S3SecureBucketProps.property.encryption"></a>
|
|
1487
|
+
|
|
1488
|
+
```typescript
|
|
1489
|
+
public readonly encryption: BucketEncryption;
|
|
1490
|
+
```
|
|
1491
|
+
|
|
1492
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketEncryption
|
|
1493
|
+
- *Default:* `KMS` if `encryptionKey` is specified, or `S3_MANAGED` otherwise.
|
|
1494
|
+
|
|
1495
|
+
The kind of server-side encryption to apply to this bucket.
|
|
1496
|
+
|
|
1497
|
+
If you choose KMS, you can specify a KMS key via `encryptionKey`. If
|
|
1498
|
+
encryption key is not specified, a key will automatically be created.
|
|
1499
|
+
|
|
1500
|
+
---
|
|
1501
|
+
|
|
1502
|
+
##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="s3-secure-bucket.S3SecureBucketProps.property.encryptionKey"></a>
|
|
1503
|
+
|
|
1504
|
+
```typescript
|
|
1505
|
+
public readonly encryptionKey: IKey;
|
|
1506
|
+
```
|
|
1507
|
+
|
|
1508
|
+
- *Type:* aws-cdk-lib.aws_kms.IKey
|
|
1509
|
+
- *Default:* If `encryption` is set to `KMS` and this property is undefined, a new KMS key will be created and associated with this bucket.
|
|
1510
|
+
|
|
1511
|
+
External KMS key to use for bucket encryption.
|
|
1512
|
+
|
|
1513
|
+
The `encryption` property must be either not specified or set to `KMS` or `DSSE`.
|
|
1514
|
+
An error will be emitted if `encryption` is set to `UNENCRYPTED` or `S3_MANAGED`.
|
|
1515
|
+
|
|
1516
|
+
---
|
|
1517
|
+
|
|
1518
|
+
##### `enforceSSL`<sup>Optional</sup> <a name="enforceSSL" id="s3-secure-bucket.S3SecureBucketProps.property.enforceSSL"></a>
|
|
1519
|
+
|
|
1520
|
+
```typescript
|
|
1521
|
+
public readonly enforceSSL: boolean;
|
|
1522
|
+
```
|
|
1523
|
+
|
|
1524
|
+
- *Type:* boolean
|
|
1525
|
+
- *Default:* false
|
|
1526
|
+
|
|
1527
|
+
Enforces SSL for requests.
|
|
1528
|
+
|
|
1529
|
+
S3.5 of the AWS Foundational Security Best Practices Regarding S3.
|
|
1530
|
+
|
|
1531
|
+
> [https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html](https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html)
|
|
1532
|
+
|
|
1533
|
+
---
|
|
1534
|
+
|
|
1535
|
+
##### `eventBridgeEnabled`<sup>Optional</sup> <a name="eventBridgeEnabled" id="s3-secure-bucket.S3SecureBucketProps.property.eventBridgeEnabled"></a>
|
|
1536
|
+
|
|
1537
|
+
```typescript
|
|
1538
|
+
public readonly eventBridgeEnabled: boolean;
|
|
1539
|
+
```
|
|
1540
|
+
|
|
1541
|
+
- *Type:* boolean
|
|
1542
|
+
- *Default:* false
|
|
1543
|
+
|
|
1544
|
+
Whether this bucket should send notifications to Amazon EventBridge or not.
|
|
1545
|
+
|
|
1546
|
+
---
|
|
1547
|
+
|
|
1548
|
+
##### `intelligentTieringConfigurations`<sup>Optional</sup> <a name="intelligentTieringConfigurations" id="s3-secure-bucket.S3SecureBucketProps.property.intelligentTieringConfigurations"></a>
|
|
1549
|
+
|
|
1550
|
+
```typescript
|
|
1551
|
+
public readonly intelligentTieringConfigurations: IntelligentTieringConfiguration[];
|
|
1552
|
+
```
|
|
1553
|
+
|
|
1554
|
+
- *Type:* aws-cdk-lib.aws_s3.IntelligentTieringConfiguration[]
|
|
1555
|
+
- *Default:* No Intelligent Tiiering Configurations.
|
|
1556
|
+
|
|
1557
|
+
Intelligent Tiering Configurations.
|
|
1558
|
+
|
|
1559
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering.html)
|
|
1560
|
+
|
|
1561
|
+
---
|
|
1562
|
+
|
|
1563
|
+
##### `inventories`<sup>Optional</sup> <a name="inventories" id="s3-secure-bucket.S3SecureBucketProps.property.inventories"></a>
|
|
1564
|
+
|
|
1565
|
+
```typescript
|
|
1566
|
+
public readonly inventories: Inventory[];
|
|
1567
|
+
```
|
|
1568
|
+
|
|
1569
|
+
- *Type:* aws-cdk-lib.aws_s3.Inventory[]
|
|
1570
|
+
- *Default:* No inventory configuration
|
|
1571
|
+
|
|
1572
|
+
The inventory configuration of the bucket.
|
|
1573
|
+
|
|
1574
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html)
|
|
1575
|
+
|
|
1576
|
+
---
|
|
1577
|
+
|
|
1578
|
+
##### `lifecycleRules`<sup>Optional</sup> <a name="lifecycleRules" id="s3-secure-bucket.S3SecureBucketProps.property.lifecycleRules"></a>
|
|
1579
|
+
|
|
1580
|
+
```typescript
|
|
1581
|
+
public readonly lifecycleRules: LifecycleRule[];
|
|
1582
|
+
```
|
|
1583
|
+
|
|
1584
|
+
- *Type:* aws-cdk-lib.aws_s3.LifecycleRule[]
|
|
1585
|
+
- *Default:* No lifecycle rules.
|
|
1586
|
+
|
|
1587
|
+
Rules that define how Amazon S3 manages objects during their lifetime.
|
|
1588
|
+
|
|
1589
|
+
---
|
|
1590
|
+
|
|
1591
|
+
##### `metrics`<sup>Optional</sup> <a name="metrics" id="s3-secure-bucket.S3SecureBucketProps.property.metrics"></a>
|
|
1592
|
+
|
|
1593
|
+
```typescript
|
|
1594
|
+
public readonly metrics: BucketMetrics[];
|
|
1595
|
+
```
|
|
1596
|
+
|
|
1597
|
+
- *Type:* aws-cdk-lib.aws_s3.BucketMetrics[]
|
|
1598
|
+
- *Default:* No metrics configuration.
|
|
1599
|
+
|
|
1600
|
+
The metrics configuration of this bucket.
|
|
1601
|
+
|
|
1602
|
+
> [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-metricsconfiguration.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-metricsconfiguration.html)
|
|
1603
|
+
|
|
1604
|
+
---
|
|
1605
|
+
|
|
1606
|
+
##### `minimumTLSVersion`<sup>Optional</sup> <a name="minimumTLSVersion" id="s3-secure-bucket.S3SecureBucketProps.property.minimumTLSVersion"></a>
|
|
1607
|
+
|
|
1608
|
+
```typescript
|
|
1609
|
+
public readonly minimumTLSVersion: number;
|
|
1610
|
+
```
|
|
1611
|
+
|
|
1612
|
+
- *Type:* number
|
|
1613
|
+
- *Default:* No minimum TLS version is enforced.
|
|
1614
|
+
|
|
1615
|
+
Enforces minimum TLS version for requests.
|
|
1616
|
+
|
|
1617
|
+
Requires `enforceSSL` to be enabled.
|
|
1618
|
+
|
|
1619
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-object-tls-version](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-object-tls-version)
|
|
1620
|
+
|
|
1621
|
+
---
|
|
1622
|
+
|
|
1623
|
+
##### `notificationsHandlerRole`<sup>Optional</sup> <a name="notificationsHandlerRole" id="s3-secure-bucket.S3SecureBucketProps.property.notificationsHandlerRole"></a>
|
|
1624
|
+
|
|
1625
|
+
```typescript
|
|
1626
|
+
public readonly notificationsHandlerRole: IRole;
|
|
1627
|
+
```
|
|
1628
|
+
|
|
1629
|
+
- *Type:* aws-cdk-lib.aws_iam.IRole
|
|
1630
|
+
- *Default:* a new role will be created.
|
|
1631
|
+
|
|
1632
|
+
The role to be used by the notifications handler.
|
|
1633
|
+
|
|
1634
|
+
---
|
|
1635
|
+
|
|
1636
|
+
##### `notificationsSkipDestinationValidation`<sup>Optional</sup> <a name="notificationsSkipDestinationValidation" id="s3-secure-bucket.S3SecureBucketProps.property.notificationsSkipDestinationValidation"></a>
|
|
1637
|
+
|
|
1638
|
+
```typescript
|
|
1639
|
+
public readonly notificationsSkipDestinationValidation: boolean;
|
|
1640
|
+
```
|
|
1641
|
+
|
|
1642
|
+
- *Type:* boolean
|
|
1643
|
+
- *Default:* false
|
|
1644
|
+
|
|
1645
|
+
Skips notification validation of Amazon SQS, Amazon SNS, and Lambda destinations.
|
|
1646
|
+
|
|
1647
|
+
---
|
|
1648
|
+
|
|
1649
|
+
##### `objectLockDefaultRetention`<sup>Optional</sup> <a name="objectLockDefaultRetention" id="s3-secure-bucket.S3SecureBucketProps.property.objectLockDefaultRetention"></a>
|
|
1650
|
+
|
|
1651
|
+
```typescript
|
|
1652
|
+
public readonly objectLockDefaultRetention: ObjectLockRetention;
|
|
1653
|
+
```
|
|
1654
|
+
|
|
1655
|
+
- *Type:* aws-cdk-lib.aws_s3.ObjectLockRetention
|
|
1656
|
+
- *Default:* no default retention period
|
|
1657
|
+
|
|
1658
|
+
The default retention mode and rules for S3 Object Lock.
|
|
1659
|
+
|
|
1660
|
+
Default retention can be configured after a bucket is created if the bucket already
|
|
1661
|
+
has object lock enabled. Enabling object lock for existing buckets is not supported.
|
|
1662
|
+
|
|
1663
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-config-enable](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-config-enable)
|
|
1664
|
+
|
|
1665
|
+
---
|
|
1666
|
+
|
|
1667
|
+
##### `objectLockEnabled`<sup>Optional</sup> <a name="objectLockEnabled" id="s3-secure-bucket.S3SecureBucketProps.property.objectLockEnabled"></a>
|
|
1668
|
+
|
|
1669
|
+
```typescript
|
|
1670
|
+
public readonly objectLockEnabled: boolean;
|
|
1671
|
+
```
|
|
1672
|
+
|
|
1673
|
+
- *Type:* boolean
|
|
1674
|
+
- *Default:* false, unless objectLockDefaultRetention is set (then, true)
|
|
1675
|
+
|
|
1676
|
+
Enable object lock on the bucket.
|
|
1677
|
+
|
|
1678
|
+
Enabling object lock for existing buckets is not supported. Object lock must be
|
|
1679
|
+
enabled when the bucket is created.
|
|
1680
|
+
|
|
1681
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-config-enable](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-bucket-config-enable)
|
|
1682
|
+
|
|
1683
|
+
---
|
|
1684
|
+
|
|
1685
|
+
##### `objectOwnership`<sup>Optional</sup> <a name="objectOwnership" id="s3-secure-bucket.S3SecureBucketProps.property.objectOwnership"></a>
|
|
1686
|
+
|
|
1687
|
+
```typescript
|
|
1688
|
+
public readonly objectOwnership: ObjectOwnership;
|
|
1689
|
+
```
|
|
1690
|
+
|
|
1691
|
+
- *Type:* aws-cdk-lib.aws_s3.ObjectOwnership
|
|
1692
|
+
- *Default:* No ObjectOwnership configuration. By default, Amazon S3 sets Object Ownership to `Bucket owner enforced`. This means ACLs are disabled and the bucket owner will own every object.
|
|
1693
|
+
|
|
1694
|
+
The objectOwnership of the bucket.
|
|
1695
|
+
|
|
1696
|
+
> [https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html)
|
|
1697
|
+
|
|
1698
|
+
---
|
|
1699
|
+
|
|
1700
|
+
##### `publicReadAccess`<sup>Optional</sup> <a name="publicReadAccess" id="s3-secure-bucket.S3SecureBucketProps.property.publicReadAccess"></a>
|
|
1701
|
+
|
|
1702
|
+
```typescript
|
|
1703
|
+
public readonly publicReadAccess: boolean;
|
|
1704
|
+
```
|
|
1705
|
+
|
|
1706
|
+
- *Type:* boolean
|
|
1707
|
+
- *Default:* false
|
|
1708
|
+
|
|
1709
|
+
Grants public read access to all objects in the bucket.
|
|
1710
|
+
|
|
1711
|
+
Similar to calling `bucket.grantPublicAccess()`
|
|
1712
|
+
|
|
1713
|
+
---
|
|
1714
|
+
|
|
1715
|
+
##### `removalPolicy`<sup>Optional</sup> <a name="removalPolicy" id="s3-secure-bucket.S3SecureBucketProps.property.removalPolicy"></a>
|
|
1716
|
+
|
|
1717
|
+
```typescript
|
|
1718
|
+
public readonly removalPolicy: RemovalPolicy;
|
|
1719
|
+
```
|
|
1720
|
+
|
|
1721
|
+
- *Type:* aws-cdk-lib.RemovalPolicy
|
|
1722
|
+
- *Default:* The bucket will be orphaned.
|
|
1723
|
+
|
|
1724
|
+
Policy to apply when the bucket is removed from this stack.
|
|
1725
|
+
|
|
1726
|
+
---
|
|
1727
|
+
|
|
1728
|
+
##### `replicationRole`<sup>Optional</sup> <a name="replicationRole" id="s3-secure-bucket.S3SecureBucketProps.property.replicationRole"></a>
|
|
1729
|
+
|
|
1730
|
+
```typescript
|
|
1731
|
+
public readonly replicationRole: IRole;
|
|
1732
|
+
```
|
|
1733
|
+
|
|
1734
|
+
- *Type:* aws-cdk-lib.aws_iam.IRole
|
|
1735
|
+
- *Default:* a new role will be created.
|
|
1736
|
+
|
|
1737
|
+
The role to be used by the replication.
|
|
1738
|
+
|
|
1739
|
+
When setting this property, you must also set `replicationRules`.
|
|
1740
|
+
|
|
1741
|
+
---
|
|
1742
|
+
|
|
1743
|
+
##### `replicationRules`<sup>Optional</sup> <a name="replicationRules" id="s3-secure-bucket.S3SecureBucketProps.property.replicationRules"></a>
|
|
1744
|
+
|
|
1745
|
+
```typescript
|
|
1746
|
+
public readonly replicationRules: ReplicationRule[];
|
|
1747
|
+
```
|
|
1748
|
+
|
|
1749
|
+
- *Type:* aws-cdk-lib.aws_s3.ReplicationRule[]
|
|
1750
|
+
- *Default:* No replication
|
|
1751
|
+
|
|
1752
|
+
A container for one or more replication rules.
|
|
1753
|
+
|
|
1754
|
+
---
|
|
1755
|
+
|
|
1756
|
+
##### `serverAccessLogsBucket`<sup>Optional</sup> <a name="serverAccessLogsBucket" id="s3-secure-bucket.S3SecureBucketProps.property.serverAccessLogsBucket"></a>
|
|
1757
|
+
|
|
1758
|
+
```typescript
|
|
1759
|
+
public readonly serverAccessLogsBucket: IBucket;
|
|
1760
|
+
```
|
|
1761
|
+
|
|
1762
|
+
- *Type:* aws-cdk-lib.aws_s3.IBucket
|
|
1763
|
+
- *Default:* If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
|
|
1764
|
+
|
|
1765
|
+
Destination bucket for the server access logs.
|
|
1766
|
+
|
|
1767
|
+
---
|
|
1768
|
+
|
|
1769
|
+
##### `serverAccessLogsPrefix`<sup>Optional</sup> <a name="serverAccessLogsPrefix" id="s3-secure-bucket.S3SecureBucketProps.property.serverAccessLogsPrefix"></a>
|
|
1770
|
+
|
|
1771
|
+
```typescript
|
|
1772
|
+
public readonly serverAccessLogsPrefix: string;
|
|
1773
|
+
```
|
|
1774
|
+
|
|
1775
|
+
- *Type:* string
|
|
1776
|
+
- *Default:* No log file prefix
|
|
1777
|
+
|
|
1778
|
+
Optional log file prefix to use for the bucket's access logs.
|
|
1779
|
+
|
|
1780
|
+
If defined without "serverAccessLogsBucket", enables access logs to current bucket with this prefix.
|
|
1781
|
+
|
|
1782
|
+
---
|
|
1783
|
+
|
|
1784
|
+
##### `targetObjectKeyFormat`<sup>Optional</sup> <a name="targetObjectKeyFormat" id="s3-secure-bucket.S3SecureBucketProps.property.targetObjectKeyFormat"></a>
|
|
1785
|
+
|
|
1786
|
+
```typescript
|
|
1787
|
+
public readonly targetObjectKeyFormat: TargetObjectKeyFormat;
|
|
1788
|
+
```
|
|
1789
|
+
|
|
1790
|
+
- *Type:* aws-cdk-lib.aws_s3.TargetObjectKeyFormat
|
|
1791
|
+
- *Default:* the default key format is: [DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
|
|
1792
|
+
|
|
1793
|
+
Optional key format for log objects.
|
|
1794
|
+
|
|
1795
|
+
---
|
|
1796
|
+
|
|
1797
|
+
##### `transferAcceleration`<sup>Optional</sup> <a name="transferAcceleration" id="s3-secure-bucket.S3SecureBucketProps.property.transferAcceleration"></a>
|
|
1798
|
+
|
|
1799
|
+
```typescript
|
|
1800
|
+
public readonly transferAcceleration: boolean;
|
|
1801
|
+
```
|
|
1802
|
+
|
|
1803
|
+
- *Type:* boolean
|
|
1804
|
+
- *Default:* false
|
|
1805
|
+
|
|
1806
|
+
Whether this bucket should have transfer acceleration turned on or not.
|
|
1807
|
+
|
|
1808
|
+
---
|
|
1809
|
+
|
|
1810
|
+
##### `transitionDefaultMinimumObjectSize`<sup>Optional</sup> <a name="transitionDefaultMinimumObjectSize" id="s3-secure-bucket.S3SecureBucketProps.property.transitionDefaultMinimumObjectSize"></a>
|
|
1811
|
+
|
|
1812
|
+
```typescript
|
|
1813
|
+
public readonly transitionDefaultMinimumObjectSize: TransitionDefaultMinimumObjectSize;
|
|
1814
|
+
```
|
|
1815
|
+
|
|
1816
|
+
- *Type:* aws-cdk-lib.aws_s3.TransitionDefaultMinimumObjectSize
|
|
1817
|
+
- *Default:* TransitionDefaultMinimumObjectSize.VARIES_BY_STORAGE_CLASS before September 2024, otherwise TransitionDefaultMinimumObjectSize.ALL_STORAGE_CLASSES_128_K.
|
|
1818
|
+
|
|
1819
|
+
Indicates which default minimum object size behavior is applied to the lifecycle configuration.
|
|
1820
|
+
|
|
1821
|
+
To customize the minimum object size for any transition you can add a filter that specifies a custom
|
|
1822
|
+
`objectSizeGreaterThan` or `objectSizeLessThan` for `lifecycleRules` property. Custom filters always
|
|
1823
|
+
take precedence over the default transition behavior.
|
|
1824
|
+
|
|
1825
|
+
---
|
|
1826
|
+
|
|
1827
|
+
##### `versioned`<sup>Optional</sup> <a name="versioned" id="s3-secure-bucket.S3SecureBucketProps.property.versioned"></a>
|
|
1828
|
+
|
|
1829
|
+
```typescript
|
|
1830
|
+
public readonly versioned: boolean;
|
|
1831
|
+
```
|
|
1832
|
+
|
|
1833
|
+
- *Type:* boolean
|
|
1834
|
+
- *Default:* false (unless object lock is enabled, then true)
|
|
1835
|
+
|
|
1836
|
+
Whether this bucket should have versioning turned on or not.
|
|
1837
|
+
|
|
1838
|
+
---
|
|
1839
|
+
|
|
1840
|
+
##### `websiteErrorDocument`<sup>Optional</sup> <a name="websiteErrorDocument" id="s3-secure-bucket.S3SecureBucketProps.property.websiteErrorDocument"></a>
|
|
1841
|
+
|
|
1842
|
+
```typescript
|
|
1843
|
+
public readonly websiteErrorDocument: string;
|
|
1844
|
+
```
|
|
1845
|
+
|
|
1846
|
+
- *Type:* string
|
|
1847
|
+
- *Default:* No error document.
|
|
1848
|
+
|
|
1849
|
+
The name of the error document (e.g. "404.html") for the website. `websiteIndexDocument` must also be set if this is set.
|
|
1850
|
+
|
|
1851
|
+
---
|
|
1852
|
+
|
|
1853
|
+
##### `websiteIndexDocument`<sup>Optional</sup> <a name="websiteIndexDocument" id="s3-secure-bucket.S3SecureBucketProps.property.websiteIndexDocument"></a>
|
|
1854
|
+
|
|
1855
|
+
```typescript
|
|
1856
|
+
public readonly websiteIndexDocument: string;
|
|
1857
|
+
```
|
|
1858
|
+
|
|
1859
|
+
- *Type:* string
|
|
1860
|
+
- *Default:* No index document.
|
|
1861
|
+
|
|
1862
|
+
The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket.
|
|
1863
|
+
|
|
1864
|
+
---
|
|
1865
|
+
|
|
1866
|
+
##### `websiteRedirect`<sup>Optional</sup> <a name="websiteRedirect" id="s3-secure-bucket.S3SecureBucketProps.property.websiteRedirect"></a>
|
|
1867
|
+
|
|
1868
|
+
```typescript
|
|
1869
|
+
public readonly websiteRedirect: RedirectTarget;
|
|
1870
|
+
```
|
|
1871
|
+
|
|
1872
|
+
- *Type:* aws-cdk-lib.aws_s3.RedirectTarget
|
|
1873
|
+
- *Default:* No redirection.
|
|
1874
|
+
|
|
1875
|
+
Specifies the redirect behavior of all requests to a website endpoint of a bucket.
|
|
1876
|
+
|
|
1877
|
+
If you specify this property, you can't specify "websiteIndexDocument", "websiteErrorDocument" nor , "websiteRoutingRules".
|
|
1878
|
+
|
|
1879
|
+
---
|
|
1880
|
+
|
|
1881
|
+
##### `websiteRoutingRules`<sup>Optional</sup> <a name="websiteRoutingRules" id="s3-secure-bucket.S3SecureBucketProps.property.websiteRoutingRules"></a>
|
|
1882
|
+
|
|
1883
|
+
```typescript
|
|
1884
|
+
public readonly websiteRoutingRules: RoutingRule[];
|
|
1885
|
+
```
|
|
1886
|
+
|
|
1887
|
+
- *Type:* aws-cdk-lib.aws_s3.RoutingRule[]
|
|
1888
|
+
- *Default:* No redirection rules.
|
|
1889
|
+
|
|
1890
|
+
Rules that define when a redirect is applied and the redirect behavior.
|
|
1891
|
+
|
|
1892
|
+
---
|
|
1893
|
+
|
|
1894
|
+
##### `bucketType`<sup>Optional</sup> <a name="bucketType" id="s3-secure-bucket.S3SecureBucketProps.property.bucketType"></a>
|
|
1895
|
+
|
|
1896
|
+
```typescript
|
|
1897
|
+
public readonly bucketType: string;
|
|
1898
|
+
```
|
|
1899
|
+
|
|
1900
|
+
- *Type:* string
|
|
1901
|
+
- *Default:* S3SecureBucketType.DEFAULT_BUCKET
|
|
1902
|
+
|
|
1903
|
+
The type of the bucket.
|
|
1904
|
+
|
|
1905
|
+
Determines encryption and resource policy behavior.
|
|
1906
|
+
|
|
1907
|
+
---
|
|
1908
|
+
|
|
1909
|
+
|
|
1910
|
+
|