s3-secure-bucket 0.3.6 → 0.4.0

package/.jsii

@@ -8440,7 +8440,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket.git",
-  "jsiiVersion": "5.9.44 (build 150b837)",
+  "jsiiVersion": "6.0.4 (build 308d98d)",
   "keywords": [
     "cdk"
   ],
@@ -8473,7 +8473,7 @@
       "base": "aws-cdk-lib.aws_s3.Bucket",
       "docs": {
         "custom": {
-          "remarks": "- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET } and {@link S3SecureBucket#accessLogBucketPolicyDependable }.\n- {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET }: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`)."
+          "remarks": "Secure defaults applied regardless of `props`:\n- `removalPolicy`: {@link RemovalPolicy.RETAIN }\n- `publicReadAccess`: `false`\n- `blockPublicAccess`: {@link s3.BlockPublicAccess.BLOCK_ALL }\n- `enforceSSL`: `true`\n- `versioned`: `true` unless explicitly set in `props`\n- `objectOwnership`: {@link s3.ObjectOwnership.BUCKET_OWNER_ENFORCED } unless overridden\n- `accessControl`: {@link s3.BucketAccessControl.PRIVATE } unless overridden\n\nBucket-type-specific behavior:\n- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable }.\n- {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET }: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`)."
         },
         "remarks": "KMS-managed by default otherwise).",
         "stability": "stable",
@@ -8486,8 +8486,8 @@
           "summary": "Creates a secure S3 bucket according to `bucketType` and merged `props`."
         },
         "locationInModule": {
-          "filename": "src/index.ts",
-          "line": 91
+          "filename": "src/s3-secure-bucket.ts",
+          "line": 50
         },
         "parameters": [
           {
@@ -8510,7 +8510,8 @@
           },
           {
             "docs": {
-              "summary": "- Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true)."
+              "remarks": "secure defaults override several {@link s3.BucketProps} fields.\nWhen `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 property override.",
+              "summary": "- Optional {@link S3SecureBucketProps};"
             },
             "name": "props",
             "optional": true,
@@ -8522,8 +8523,8 @@
       },
       "kind": "class",
       "locationInModule": {
-        "filename": "src/index.ts",
-        "line": 72
+        "filename": "src/s3-secure-bucket.ts",
+        "line": 30
       },
       "name": "S3SecureBucket",
       "properties": [
@@ -8536,8 +8537,8 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/index.ts",
-            "line": 82
+            "filename": "src/s3-secure-bucket.ts",
+            "line": 40
           },
           "name": "accessLogBucketPolicyDependable",
           "optional": true,
@@ -8546,15 +8547,15 @@
           }
         }
       ],
-      "symbolId": "src/index:S3SecureBucket"
+      "symbolId": "src/s3-secure-bucket:S3SecureBucket"
     },
     "s3-secure-bucket.S3SecureBucketProps": {
       "assembly": "s3-secure-bucket",
       "datatype": true,
       "docs": {
-        "remarks": "Extends {@link s3.BucketProps}; several fields receive secure defaults inside the construct.",
+        "remarks": "Extends {@link s3.BucketProps}. Several fields receive secure defaults inside the construct\nand may be overridden unless documented otherwise on {@link S3SecureBucket }.",
         "stability": "stable",
-        "summary": "Construction properties for {@link S3SecureBucket}."
+        "summary": "Construction properties for {@link S3SecureBucket }."
       },
       "fqn": "s3-secure-bucket.S3SecureBucketProps",
       "interfaces": [
@@ -8562,8 +8563,8 @@
       ],
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/index.ts",
-        "line": 53
+        "filename": "src/bucket-types/props.ts",
+        "line": 10
       },
       "name": "S3SecureBucketProps",
       "properties": [
@@ -8576,8 +8577,8 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/index.ts",
-            "line": 60
+            "filename": "src/bucket-types/props.ts",
+            "line": 17
           },
           "name": "bucketType",
           "optional": true,
@@ -8586,9 +8587,9 @@
           }
         }
       ],
-      "symbolId": "src/index:S3SecureBucketProps"
+      "symbolId": "src/bucket-types/props:S3SecureBucketProps"
     }
   },
-  "version": "0.3.6",
-  "fingerprint": "7wGyPA87cRSyViRCigMiyiZwlGpmzKoUNoR9UwimFPo="
+  "version": "0.4.0",
+  "fingerprint": "IAroCrVpkxm3+mfHUQefTkwPtX/MziEuzZgBKD0YjpA="
 }

package/API.md

@@ -20,7 +20,7 @@ new S3SecureBucket(scope: Construct, id: string, props?: S3SecureBucketProps)
 | --- | --- | --- |
 | <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.scope">scope</a></code> | <code>constructs.Construct</code> | - Parent construct, typically a {@link Stack}. |
 | <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.id">id</a></code> | <code>string</code> | - Construct ID (stable logical ID segment). |
-| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.props">props</a></code> | <code><a href="#s3-secure-bucket.S3SecureBucketProps">S3SecureBucketProps</a></code> | - Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true). |
+| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.props">props</a></code> | <code><a href="#s3-secure-bucket.S3SecureBucketProps">S3SecureBucketProps</a></code> | - Optional {@link S3SecureBucketProps}; |
 
 ---
 
@@ -44,7 +44,10 @@ Construct ID (stable logical ID segment).
 
 - *Type:* <a href="#s3-secure-bucket.S3SecureBucketProps">S3SecureBucketProps</a>
 
-Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true).
+Optional {@link S3SecureBucketProps};
+
+secure defaults override several {@link s3.BucketProps} fields.
+When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 property override.
 
 ---
 
@@ -1351,9 +1354,10 @@ Uniquely identifies this class.
 
 ### S3SecureBucketProps <a name="S3SecureBucketProps" id="s3-secure-bucket.S3SecureBucketProps"></a>
 
-Construction properties for {@link S3SecureBucket}.
+Construction properties for {@link S3SecureBucket }.
 
-Extends {@link s3.BucketProps}; several fields receive secure defaults inside the construct.
+Extends {@link s3.BucketProps}. Several fields receive secure defaults inside the construct
+and may be overridden unless documented otherwise on {@link S3SecureBucket }.
 
 #### Initializer <a name="Initializer" id="s3-secure-bucket.S3SecureBucketProps.Initializer"></a>
 

package/lib/bucket-policies/access-log-bucket-policy.d.ts

@@ -0,0 +1,15 @@
+import { BucketPolicyApplyResult, BucketPolicyContext } from './types';
+/**
+ * Adds resource policies for ALB/NLB, CloudFront standard logging (v2), and S3 server access logging.
+ *
+ * Grants `s3:PutObject` on `AWSLogs/<stack.account>/*` to:
+ * - `logdelivery.elasticloadbalancing.amazonaws.com`
+ * - The regional ELBv2 log-delivery account (when known)
+ * - `delivery.logs.amazonaws.com`
+ * - `logging.s3.amazonaws.com`
+ *
+ * @param context - Bucket and owning stack (account and region are read from `stack`).
+ * @returns A result containing {@link BucketPolicyApplyResult.accessLogBucketPolicyDependable} for the
+ * first (ELB) policy statement so load balancer log enablement can wait until the bucket policy exists.
+ */
+export declare const applyAccessLogBucketPolicy: ({ bucket, stack, }: BucketPolicyContext) => BucketPolicyApplyResult;

package/lib/bucket-policies/access-log-bucket-policy.js

@@ -0,0 +1,118 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyAccessLogBucketPolicy = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const region_info_1 = require("aws-cdk-lib/region-info");
+/**
+ * Adds resource policies for ALB/NLB, CloudFront standard logging (v2), and S3 server access logging.
+ *
+ * Grants `s3:PutObject` on `AWSLogs/<stack.account>/*` to:
+ * - `logdelivery.elasticloadbalancing.amazonaws.com`
+ * - The regional ELBv2 log-delivery account (when known)
+ * - `delivery.logs.amazonaws.com`
+ * - `logging.s3.amazonaws.com`
+ *
+ * @param context - Bucket and owning stack (account and region are read from `stack`).
+ * @returns A result containing {@link BucketPolicyApplyResult.accessLogBucketPolicyDependable} for the
+ * first (ELB) policy statement so load balancer log enablement can wait until the bucket policy exists.
+ */
+const applyAccessLogBucketPolicy = ({ bucket, stack, }) => {
+    const awsLogsPrefixResource = `${bucket.bucketArn}/AWSLogs/${stack.account}/*`;
+    // Allow ALB / NLB log delivery (modern service principal path; also required in opt-in regions).
+    const albLogDeliveryPolicyResult = bucket.addToResourcePolicy(new iam.PolicyStatement({
+        effect: iam.Effect.ALLOW,
+        principals: [
+            new iam.ServicePrincipal('logdelivery.elasticloadbalancing.amazonaws.com'),
+        ],
+        actions: [
+            's3:PutObject',
+        ],
+        resources: [
+            awsLogsPrefixResource,
+        ],
+    }));
+    // In non–opt-in regions (for example ap-northeast-1), access logs are often delivered using the
+    // regional ELBv2 account (root of that account) for s3:PutObject, not only the service principal above.
+    const elbAccountId = aws_cdk_lib_1.Token.isUnresolved(stack.region)
+        ? stack.regionalFact(region_info_1.FactName.ELBV2_ACCOUNT)
+        : region_info_1.RegionInfo.get(stack.region).elbv2Account;
+    if (elbAccountId) {
+        bucket.addToResourcePolicy(new iam.PolicyStatement({
+            effect: iam.Effect.ALLOW,
+            principals: [
+                new iam.AccountPrincipal(elbAccountId),
+            ],
+            actions: [
+                's3:PutObject',
+            ],
+            resources: [
+                awsLogsPrefixResource,
+            ],
+        }));
+    }
+    // Allow CloudFront standard logging (v2) to write logs
+    bucket.addToResourcePolicy(new iam.PolicyStatement({
+        effect: iam.Effect.ALLOW,
+        principals: [
+            new iam.ServicePrincipal('delivery.logs.amazonaws.com'),
+        ],
+        actions: [
+            's3:PutObject',
+        ],
+        resources: [
+            awsLogsPrefixResource,
+        ],
+    }));
+    // Allow S3 server access logging to write logs when required by configuration
+    bucket.addToResourcePolicy(new iam.PolicyStatement({
+        effect: iam.Effect.ALLOW,
+        principals: [
+            new iam.ServicePrincipal('logging.s3.amazonaws.com'),
+        ],
+        actions: [
+            's3:PutObject',
+        ],
+        resources: [
+            awsLogsPrefixResource,
+        ],
+    }));
+    return {
+        accessLogBucketPolicyDependable: albLogDeliveryPolicyResult.policyDependable ?? bucket,
+    };
+};
+exports.applyAccessLogBucketPolicy = applyAccessLogBucketPolicy;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLWxvZy1idWNrZXQtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2J1Y2tldC1wb2xpY2llcy9hY2Nlc3MtbG9nLWJ1Y2tldC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkNBQW9DO0FBQ3BDLHlEQUEyQztBQUMzQyx5REFBK0Q7QUFHL0Q7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0ksTUFBTSwwQkFBMEIsR0FBRyxDQUFDLEVBQ3pDLE1BQU0sRUFDTixLQUFLLEdBQ2UsRUFBMkIsRUFBRTtJQUNqRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsTUFBTSxDQUFDLFNBQVMsWUFBWSxLQUFLLENBQUMsT0FBTyxJQUFJLENBQUM7SUFFL0UsaUdBQWlHO0lBQ2pHLE1BQU0sMEJBQTBCLEdBQUcsTUFBTSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztRQUNwRixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO1FBQ3hCLFVBQVUsRUFBRTtZQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLGdEQUFnRCxDQUFDO1NBQzNFO1FBQ0QsT0FBTyxFQUFFO1lBQ1AsY0FBYztTQUNmO1FBQ0QsU0FBUyxFQUFFO1lBQ1QscUJBQXFCO1NBQ3RCO0tBQ0YsQ0FBQyxDQUFDLENBQUM7SUFFSixnR0FBZ0c7SUFDaEcsd0dBQXdHO0lBQ3hHLE1BQU0sWUFBWSxHQUFHLG1CQUFLLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDbkQsQ0FBQyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsc0JBQVEsQ0FBQyxhQUFhLENBQUM7UUFDNUMsQ0FBQyxDQUFDLHdCQUFVLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxZQUFZLENBQUM7SUFDOUMsSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUNqQixNQUFNLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1lBQ2pELE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7WUFDeEIsVUFBVSxFQUFFO2dCQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLFlBQVksQ0FBQzthQUN2QztZQUNELE9BQU8sRUFBRTtnQkFDUCxjQUFjO2FBQ2Y7WUFDRCxTQUFTLEVBQUU7Z0JBQ1QscUJBQXFCO2FBQ3RCO1NBQ0YsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBRUQsdURBQXVEO0lBQ3ZELE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7UUFDakQsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztRQUN4QixVQUFVLEVBQUU7WUFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyw2QkFBNkIsQ0FBQztTQUN4RDtRQUNELE9BQU8sRUFBRTtZQUNQLGNBQWM7U0FDZjtRQUNELFNBQVMsRUFBRTtZQUNULHFCQUFxQjtTQUN0QjtLQUNGLENBQUMsQ0FBQyxDQUFDO0lBRUosOEVBQThFO0lBQzlFLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7UUFDakQsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztRQUN4QixVQUFVLEVBQUU7WUFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQywwQkFBMEIsQ0FBQztTQUNyRDtRQUNELE9BQU8sRUFBRTtZQUNQLGNBQWM7U0FDZjtRQUNELFNBQVMsRUFBRTtZQUNULHFCQUFxQjtTQUN0QjtLQUNGLENBQUMsQ0FBQyxDQUFDO0lBRUosT0FBTztRQUNMLCtCQUErQixFQUFFLDBCQUEwQixDQUFDLGdCQUFnQixJQUFJLE1BQU07S0FDdkYsQ0FBQztBQUNKLENBQUMsQ0FBQztBQXZFVyxRQUFBLDBCQUEwQiw4QkF1RXJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgVG9rZW4gfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgeyBGYWN0TmFtZSwgUmVnaW9uSW5mbyB9IGZyb20gJ2F3cy1jZGstbGliL3JlZ2lvbi1pbmZvJztcbmltcG9ydCB7IEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0LCBCdWNrZXRQb2xpY3lDb250ZXh0IH0gZnJvbSAnLi90eXBlcyc7XG5cbi8qKlxuICogQWRkcyByZXNvdXJjZSBwb2xpY2llcyBmb3IgQUxCL05MQiwgQ2xvdWRGcm9udCBzdGFuZGFyZCBsb2dnaW5nICh2MiksIGFuZCBTMyBzZXJ2ZXIgYWNjZXNzIGxvZ2dpbmcuXG4gKlxuICogR3JhbnRzIGBzMzpQdXRPYmplY3RgIG9uIGBBV1NMb2dzLzxzdGFjay5hY2NvdW50Pi8qYCB0bzpcbiAqIC0gYGxvZ2RlbGl2ZXJ5LmVsYXN0aWNsb2FkYmFsYW5jaW5nLmFtYXpvbmF3cy5jb21gXG4gKiAtIFRoZSByZWdpb25hbCBFTEJ2MiBsb2ctZGVsaXZlcnkgYWNjb3VudCAod2hlbiBrbm93bilcbiAqIC0gYGRlbGl2ZXJ5LmxvZ3MuYW1hem9uYXdzLmNvbWBcbiAqIC0gYGxvZ2dpbmcuczMuYW1hem9uYXdzLmNvbWBcbiAqXG4gKiBAcGFyYW0gY29udGV4dCAtIEJ1Y2tldCBhbmQgb3duaW5nIHN0YWNrIChhY2NvdW50IGFuZCByZWdpb24gYXJlIHJlYWQgZnJvbSBgc3RhY2tgKS5cbiAqIEByZXR1cm5zIEEgcmVzdWx0IGNvbnRhaW5pbmcge0BsaW5rIEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0LmFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGV9IGZvciB0aGVcbiAqIGZpcnN0IChFTEIpIHBvbGljeSBzdGF0ZW1lbnQgc28gbG9hZCBiYWxhbmNlciBsb2cgZW5hYmxlbWVudCBjYW4gd2FpdCB1bnRpbCB0aGUgYnVja2V0IHBvbGljeSBleGlzdHMuXG4gKi9cbmV4cG9ydCBjb25zdCBhcHBseUFjY2Vzc0xvZ0J1Y2tldFBvbGljeSA9ICh7XG4gIGJ1Y2tldCxcbiAgc3RhY2ssXG59OiBCdWNrZXRQb2xpY3lDb250ZXh0KTogQnVja2V0UG9saWN5QXBwbHlSZXN1bHQgPT4ge1xuICBjb25zdCBhd3NMb2dzUHJlZml4UmVzb3VyY2UgPSBgJHtidWNrZXQuYnVja2V0QXJufS9BV1NMb2dzLyR7c3RhY2suYWNjb3VudH0vKmA7XG5cbiAgLy8gQWxsb3cgQUxCIC8gTkxCIGxvZyBkZWxpdmVyeSAobW9kZXJuIHNlcnZpY2UgcHJpbmNpcGFsIHBhdGg7IGFsc28gcmVxdWlyZWQgaW4gb3B0LWluIHJlZ2lvbnMpLlxuICBjb25zdCBhbGJMb2dEZWxpdmVyeVBvbGljeVJlc3VsdCA9IGJ1Y2tldC5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgcHJpbmNpcGFsczogW1xuICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsb2dkZWxpdmVyeS5lbGFzdGljbG9hZGJhbGFuY2luZy5hbWF6b25hd3MuY29tJyksXG4gICAgXSxcbiAgICBhY3Rpb25zOiBbXG4gICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICBdLFxuICAgIHJlc291cmNlczogW1xuICAgICAgYXdzTG9nc1ByZWZpeFJlc291cmNlLFxuICAgIF0sXG4gIH0pKTtcblxuICAvLyBJbiBub27igJNvcHQtaW4gcmVnaW9ucyAoZm9yIGV4YW1wbGUgYXAtbm9ydGhlYXN0LTEpLCBhY2Nlc3MgbG9ncyBhcmUgb2Z0ZW4gZGVsaXZlcmVkIHVzaW5nIHRoZVxuICAvLyByZWdpb25hbCBFTEJ2MiBhY2NvdW50IChyb290IG9mIHRoYXQgYWNjb3VudCkgZm9yIHMzOlB1dE9iamVjdCwgbm90IG9ubHkgdGhlIHNlcnZpY2UgcHJpbmNpcGFsIGFib3ZlLlxuICBjb25zdCBlbGJBY2NvdW50SWQgPSBUb2tlbi5pc1VucmVzb2x2ZWQoc3RhY2sucmVnaW9uKVxuICAgID8gc3RhY2sucmVnaW9uYWxGYWN0KEZhY3ROYW1lLkVMQlYyX0FDQ09VTlQpXG4gICAgOiBSZWdpb25JbmZvLmdldChzdGFjay5yZWdpb24pLmVsYnYyQWNjb3VudDtcbiAgaWYgKGVsYkFjY291bnRJZCkge1xuICAgIGJ1Y2tldC5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgbmV3IGlhbS5BY2NvdW50UHJpbmNpcGFsKGVsYkFjY291bnRJZCksXG4gICAgICBdLFxuICAgICAgYWN0aW9uczogW1xuICAgICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICAgIF0sXG4gICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgYXdzTG9nc1ByZWZpeFJlc291cmNlLFxuICAgICAgXSxcbiAgICB9KSk7XG4gIH1cblxuICAvLyBBbGxvdyBDbG91ZEZyb250IHN0YW5kYXJkIGxvZ2dpbmcgKHYyKSB0byB3cml0ZSBsb2dzXG4gIGJ1Y2tldC5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgcHJpbmNpcGFsczogW1xuICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdkZWxpdmVyeS5sb2dzLmFtYXpvbmF3cy5jb20nKSxcbiAgICBdLFxuICAgIGFjdGlvbnM6IFtcbiAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgIF0sXG4gICAgcmVzb3VyY2VzOiBbXG4gICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgXSxcbiAgfSkpO1xuXG4gIC8vIEFsbG93IFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZyB0byB3cml0ZSBsb2dzIHdoZW4gcmVxdWlyZWQgYnkgY29uZmlndXJhdGlvblxuICBidWNrZXQuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgIHByaW5jaXBhbHM6IFtcbiAgICAgIG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnbG9nZ2luZy5zMy5hbWF6b25hd3MuY29tJyksXG4gICAgXSxcbiAgICBhY3Rpb25zOiBbXG4gICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICBdLFxuICAgIHJlc291cmNlczogW1xuICAgICAgYXdzTG9nc1ByZWZpeFJlc291cmNlLFxuICAgIF0sXG4gIH0pKTtcblxuICByZXR1cm4ge1xuICAgIGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU6IGFsYkxvZ0RlbGl2ZXJ5UG9saWN5UmVzdWx0LnBvbGljeURlcGVuZGFibGUgPz8gYnVja2V0LFxuICB9O1xufTtcbiJdfQ==

package/lib/bucket-policies/cloud-watch-log-archive-policy.d.ts

@@ -0,0 +1,15 @@
+import { BucketPolicyApplyResult, BucketPolicyContext } from './types';
+/**
+ * Adds resource policies for CloudWatch Logs export tasks in the stack account and region.
+ *
+ * Grants `logs.<region>.amazonaws.com`:
+ * - `s3:GetBucketAcl` on the bucket
+ * - `s3:PutObject` on bucket objects with `bucket-owner-full-control`
+ *
+ * Conditions restrict exports to log groups in the stack account and region.
+ * For cross-account export, extend the bucket policy with additional source accounts and ARNs.
+ *
+ * @param context - Bucket and owning stack (account and region are read from `stack`).
+ * @returns An empty result after export policies are attached.
+ */
+export declare const applyCloudWatchLogArchivePolicy: ({ bucket, stack, }: BucketPolicyContext) => BucketPolicyApplyResult;

package/lib/bucket-policies/cloud-watch-log-archive-policy.js

@@ -0,0 +1,89 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyCloudWatchLogArchivePolicy = void 0;
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+/**
+ * Adds resource policies for CloudWatch Logs export tasks in the stack account and region.
+ *
+ * Grants `logs.<region>.amazonaws.com`:
+ * - `s3:GetBucketAcl` on the bucket
+ * - `s3:PutObject` on bucket objects with `bucket-owner-full-control`
+ *
+ * Conditions restrict exports to log groups in the stack account and region.
+ * For cross-account export, extend the bucket policy with additional source accounts and ARNs.
+ *
+ * @param context - Bucket and owning stack (account and region are read from `stack`).
+ * @returns An empty result after export policies are attached.
+ */
+const applyCloudWatchLogArchivePolicy = ({ bucket, stack, }) => {
+    const { account, region } = stack;
+    const logsExportPrincipal = new iam.ServicePrincipal(`logs.${region}.amazonaws.com`);
+    const sourceLogGroupArn = `arn:aws:logs:${region}:${account}:log-group:*`;
+    bucket.addToResourcePolicy(new iam.PolicyStatement({
+        sid: 'AllowCloudWatchLogsExportGetBucketAcl',
+        effect: iam.Effect.ALLOW,
+        principals: [logsExportPrincipal],
+        actions: ['s3:GetBucketAcl'],
+        resources: [bucket.bucketArn],
+        conditions: {
+            StringEquals: {
+                'aws:SourceAccount': [account],
+            },
+            ArnLike: {
+                'aws:SourceArn': [sourceLogGroupArn],
+            },
+        },
+    }));
+    bucket.addToResourcePolicy(new iam.PolicyStatement({
+        sid: 'AllowCloudWatchLogsExportPutObject',
+        effect: iam.Effect.ALLOW,
+        principals: [logsExportPrincipal],
+        actions: ['s3:PutObject'],
+        resources: [`${bucket.bucketArn}/*`],
+        conditions: {
+            StringEquals: {
+                's3:x-amz-acl': 'bucket-owner-full-control',
+                'aws:SourceAccount': [account],
+            },
+            ArnLike: {
+                'aws:SourceArn': [sourceLogGroupArn],
+            },
+        },
+    }));
+    return {};
+};
+exports.applyCloudWatchLogArchivePolicy = applyCloudWatchLogArchivePolicy;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xvdWQtd2F0Y2gtbG9nLWFyY2hpdmUtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2J1Y2tldC1wb2xpY2llcy9jbG91ZC13YXRjaC1sb2ctYXJjaGl2ZS1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEseURBQTJDO0FBRzNDOzs7Ozs7Ozs7Ozs7R0FZRztBQUNJLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxFQUM5QyxNQUFNLEVBQ04sS0FBSyxHQUNlLEVBQTJCLEVBQUU7SUFDakQsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUM7SUFDbEMsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLE1BQU0sZ0JBQWdCLENBQUMsQ0FBQztJQUNyRixNQUFNLGlCQUFpQixHQUFHLGdCQUFnQixNQUFNLElBQUksT0FBTyxjQUFjLENBQUM7SUFFMUUsTUFBTSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztRQUNqRCxHQUFHLEVBQUUsdUNBQXVDO1FBQzVDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7UUFDeEIsVUFBVSxFQUFFLENBQUMsbUJBQW1CLENBQUM7UUFDakMsT0FBTyxFQUFFLENBQUMsaUJBQWlCLENBQUM7UUFDNUIsU0FBUyxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQztRQUM3QixVQUFVLEVBQUU7WUFDVixZQUFZLEVBQUU7Z0JBQ1osbUJBQW1CLEVBQUUsQ0FBQyxPQUFPLENBQUM7YUFDL0I7WUFDRCxPQUFPLEVBQUU7Z0JBQ1AsZUFBZSxFQUFFLENBQUMsaUJBQWlCLENBQUM7YUFDckM7U0FDRjtLQUNGLENBQUMsQ0FBQyxDQUFDO0lBRUosTUFBTSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztRQUNqRCxHQUFHLEVBQUUsb0NBQW9DO1FBQ3pDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7UUFDeEIsVUFBVSxFQUFFLENBQUMsbUJBQW1CLENBQUM7UUFDakMsT0FBTyxFQUFFLENBQUMsY0FBYyxDQUFDO1FBQ3pCLFNBQVMsRUFBRSxDQUFDLEdBQUcsTUFBTSxDQUFDLFNBQVMsSUFBSSxDQUFDO1FBQ3BDLFVBQVUsRUFBRTtZQUNWLFlBQVksRUFBRTtnQkFDWixjQUFjLEVBQUUsMkJBQTJCO2dCQUMzQyxtQkFBbUIsRUFBRSxDQUFDLE9BQU8sQ0FBQzthQUMvQjtZQUNELE9BQU8sRUFBRTtnQkFDUCxlQUFlLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQzthQUNyQztTQUNGO0tBQ0YsQ0FBQyxDQUFDLENBQUM7SUFFSixPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUMsQ0FBQztBQTFDVyxRQUFBLCtCQUErQixtQ0EwQzFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgaWFtIGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0IHsgQnVja2V0UG9saWN5QXBwbHlSZXN1bHQsIEJ1Y2tldFBvbGljeUNvbnRleHQgfSBmcm9tICcuL3R5cGVzJztcblxuLyoqXG4gKiBBZGRzIHJlc291cmNlIHBvbGljaWVzIGZvciBDbG91ZFdhdGNoIExvZ3MgZXhwb3J0IHRhc2tzIGluIHRoZSBzdGFjayBhY2NvdW50IGFuZCByZWdpb24uXG4gKlxuICogR3JhbnRzIGBsb2dzLjxyZWdpb24+LmFtYXpvbmF3cy5jb21gOlxuICogLSBgczM6R2V0QnVja2V0QWNsYCBvbiB0aGUgYnVja2V0XG4gKiAtIGBzMzpQdXRPYmplY3RgIG9uIGJ1Y2tldCBvYmplY3RzIHdpdGggYGJ1Y2tldC1vd25lci1mdWxsLWNvbnRyb2xgXG4gKlxuICogQ29uZGl0aW9ucyByZXN0cmljdCBleHBvcnRzIHRvIGxvZyBncm91cHMgaW4gdGhlIHN0YWNrIGFjY291bnQgYW5kIHJlZ2lvbi5cbiAqIEZvciBjcm9zcy1hY2NvdW50IGV4cG9ydCwgZXh0ZW5kIHRoZSBidWNrZXQgcG9saWN5IHdpdGggYWRkaXRpb25hbCBzb3VyY2UgYWNjb3VudHMgYW5kIEFSTnMuXG4gKlxuICogQHBhcmFtIGNvbnRleHQgLSBCdWNrZXQgYW5kIG93bmluZyBzdGFjayAoYWNjb3VudCBhbmQgcmVnaW9uIGFyZSByZWFkIGZyb20gYHN0YWNrYCkuXG4gKiBAcmV0dXJucyBBbiBlbXB0eSByZXN1bHQgYWZ0ZXIgZXhwb3J0IHBvbGljaWVzIGFyZSBhdHRhY2hlZC5cbiAqL1xuZXhwb3J0IGNvbnN0IGFwcGx5Q2xvdWRXYXRjaExvZ0FyY2hpdmVQb2xpY3kgPSAoe1xuICBidWNrZXQsXG4gIHN0YWNrLFxufTogQnVja2V0UG9saWN5Q29udGV4dCk6IEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0ID0+IHtcbiAgY29uc3QgeyBhY2NvdW50LCByZWdpb24gfSA9IHN0YWNrO1xuICBjb25zdCBsb2dzRXhwb3J0UHJpbmNpcGFsID0gbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKGBsb2dzLiR7cmVnaW9ufS5hbWF6b25hd3MuY29tYCk7XG4gIGNvbnN0IHNvdXJjZUxvZ0dyb3VwQXJuID0gYGFybjphd3M6bG9nczoke3JlZ2lvbn06JHthY2NvdW50fTpsb2ctZ3JvdXA6KmA7XG5cbiAgYnVja2V0LmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgIHNpZDogJ0FsbG93Q2xvdWRXYXRjaExvZ3NFeHBvcnRHZXRCdWNrZXRBY2wnLFxuICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICBwcmluY2lwYWxzOiBbbG9nc0V4cG9ydFByaW5jaXBhbF0sXG4gICAgYWN0aW9uczogWydzMzpHZXRCdWNrZXRBY2wnXSxcbiAgICByZXNvdXJjZXM6IFtidWNrZXQuYnVja2V0QXJuXSxcbiAgICBjb25kaXRpb25zOiB7XG4gICAgICBTdHJpbmdFcXVhbHM6IHtcbiAgICAgICAgJ2F3czpTb3VyY2VBY2NvdW50JzogW2FjY291bnRdLFxuICAgICAgfSxcbiAgICAgIEFybkxpa2U6IHtcbiAgICAgICAgJ2F3czpTb3VyY2VBcm4nOiBbc291cmNlTG9nR3JvdXBBcm5dLFxuICAgICAgfSxcbiAgICB9LFxuICB9KSk7XG5cbiAgYnVja2V0LmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgIHNpZDogJ0FsbG93Q2xvdWRXYXRjaExvZ3NFeHBvcnRQdXRPYmplY3QnLFxuICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICBwcmluY2lwYWxzOiBbbG9nc0V4cG9ydFByaW5jaXBhbF0sXG4gICAgYWN0aW9uczogWydzMzpQdXRPYmplY3QnXSxcbiAgICByZXNvdXJjZXM6IFtgJHtidWNrZXQuYnVja2V0QXJufS8qYF0sXG4gICAgY29uZGl0aW9uczoge1xuICAgICAgU3RyaW5nRXF1YWxzOiB7XG4gICAgICAgICdzMzp4LWFtei1hY2wnOiAnYnVja2V0LW93bmVyLWZ1bGwtY29udHJvbCcsXG4gICAgICAgICdhd3M6U291cmNlQWNjb3VudCc6IFthY2NvdW50XSxcbiAgICAgIH0sXG4gICAgICBBcm5MaWtlOiB7XG4gICAgICAgICdhd3M6U291cmNlQXJuJzogW3NvdXJjZUxvZ0dyb3VwQXJuXSxcbiAgICAgIH0sXG4gICAgfSxcbiAgfSkpO1xuXG4gIHJldHVybiB7fTtcbn07XG4iXX0=

package/lib/bucket-policies/deployment-pipeline-artifact-policy.d.ts

@@ -0,0 +1,11 @@
+import { BucketPolicyApplyResult, BucketPolicyContext } from './types';
+/**
+ * Grants the CDK deploy role full S3 access when a non-default bootstrap qualifier is in use.
+ *
+ * No policy is added when the stack uses the default bootstrap qualifier
+ * ({@link DefaultStackSynthesizer.DEFAULT_QUALIFIER}).
+ *
+ * @param context - Bucket and owning stack (account, region, and synthesizer qualifier).
+ * @returns An empty result when no policy is applied or after the deploy-role policy is attached.
+ */
+export declare const applyDeploymentPipelineArtifactPolicy: ({ bucket, stack, }: BucketPolicyContext) => BucketPolicyApplyResult;

package/lib/bucket-policies/deployment-pipeline-artifact-policy.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyDeploymentPipelineArtifactPolicy = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+/**
+ * Grants the CDK deploy role full S3 access when a non-default bootstrap qualifier is in use.
+ *
+ * No policy is added when the stack uses the default bootstrap qualifier
+ * ({@link DefaultStackSynthesizer.DEFAULT_QUALIFIER}).
+ *
+ * @param context - Bucket and owning stack (account, region, and synthesizer qualifier).
+ * @returns An empty result when no policy is applied or after the deploy-role policy is attached.
+ */
+const applyDeploymentPipelineArtifactPolicy = ({ bucket, stack, }) => {
+    const qualifier = stack.synthesizer.bootstrapQualifier;
+    if (!qualifier || qualifier === aws_cdk_lib_1.DefaultStackSynthesizer.DEFAULT_QUALIFIER) {
+        return {};
+    }
+    const { account, region } = stack;
+    bucket.addToResourcePolicy(new iam.PolicyStatement({
+        actions: [
+            's3:*',
+        ],
+        resources: [
+            `${bucket.bucketArn}`,
+            `${bucket.bucketArn}/*`,
+        ],
+        principals: [
+            new iam.ArnPrincipal(`arn:aws:iam::${account}:role/cdk-${qualifier}-deploy-role-${account}-${region}`),
+        ],
+    }));
+    return {};
+};
+exports.applyDeploymentPipelineArtifactPolicy = applyDeploymentPipelineArtifactPolicy;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudC1waXBlbGluZS1hcnRpZmFjdC1wb2xpY3kuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXBvbGljaWVzL2RlcGxveW1lbnQtcGlwZWxpbmUtYXJ0aWZhY3QtcG9saWN5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDZDQUFzRDtBQUN0RCx5REFBMkM7QUFHM0M7Ozs7Ozs7O0dBUUc7QUFDSSxNQUFNLHFDQUFxQyxHQUFHLENBQUMsRUFDcEQsTUFBTSxFQUNOLEtBQUssR0FDZSxFQUEyQixFQUFFO0lBQ2pELE1BQU0sU0FBUyxHQUFHLEtBQUssQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQUM7SUFFdkQsSUFBSSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUsscUNBQXVCLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUMxRSxPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQztJQUVsQyxNQUFNLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1FBQ2pELE9BQU8sRUFBRTtZQUNQLE1BQU07U0FDUDtRQUNELFNBQVMsRUFBRTtZQUNULEdBQUcsTUFBTSxDQUFDLFNBQVMsRUFBRTtZQUNyQixHQUFHLE1BQU0sQ0FBQyxTQUFTLElBQUk7U0FDeEI7UUFDRCxVQUFVLEVBQUU7WUFDVixJQUFJLEdBQUcsQ0FBQyxZQUFZLENBQUMsZ0JBQWdCLE9BQU8sYUFBYSxTQUFTLGdCQUFnQixPQUFPLElBQUksTUFBTSxFQUFFLENBQUM7U0FDdkc7S0FDRixDQUFDLENBQUMsQ0FBQztJQUVKLE9BQU8sRUFBRSxDQUFDO0FBQ1osQ0FBQyxDQUFDO0FBMUJXLFFBQUEscUNBQXFDLHlDQTBCaEQiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBEZWZhdWx0U3RhY2tTeW50aGVzaXplciB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0LCBCdWNrZXRQb2xpY3lDb250ZXh0IH0gZnJvbSAnLi90eXBlcyc7XG5cbi8qKlxuICogR3JhbnRzIHRoZSBDREsgZGVwbG95IHJvbGUgZnVsbCBTMyBhY2Nlc3Mgd2hlbiBhIG5vbi1kZWZhdWx0IGJvb3RzdHJhcCBxdWFsaWZpZXIgaXMgaW4gdXNlLlxuICpcbiAqIE5vIHBvbGljeSBpcyBhZGRlZCB3aGVuIHRoZSBzdGFjayB1c2VzIHRoZSBkZWZhdWx0IGJvb3RzdHJhcCBxdWFsaWZpZXJcbiAqICh7QGxpbmsgRGVmYXVsdFN0YWNrU3ludGhlc2l6ZXIuREVGQVVMVF9RVUFMSUZJRVJ9KS5cbiAqXG4gKiBAcGFyYW0gY29udGV4dCAtIEJ1Y2tldCBhbmQgb3duaW5nIHN0YWNrIChhY2NvdW50LCByZWdpb24sIGFuZCBzeW50aGVzaXplciBxdWFsaWZpZXIpLlxuICogQHJldHVybnMgQW4gZW1wdHkgcmVzdWx0IHdoZW4gbm8gcG9saWN5IGlzIGFwcGxpZWQgb3IgYWZ0ZXIgdGhlIGRlcGxveS1yb2xlIHBvbGljeSBpcyBhdHRhY2hlZC5cbiAqL1xuZXhwb3J0IGNvbnN0IGFwcGx5RGVwbG95bWVudFBpcGVsaW5lQXJ0aWZhY3RQb2xpY3kgPSAoe1xuICBidWNrZXQsXG4gIHN0YWNrLFxufTogQnVja2V0UG9saWN5Q29udGV4dCk6IEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0ID0+IHtcbiAgY29uc3QgcXVhbGlmaWVyID0gc3RhY2suc3ludGhlc2l6ZXIuYm9vdHN0cmFwUXVhbGlmaWVyO1xuXG4gIGlmICghcXVhbGlmaWVyIHx8IHF1YWxpZmllciA9PT0gRGVmYXVsdFN0YWNrU3ludGhlc2l6ZXIuREVGQVVMVF9RVUFMSUZJRVIpIHtcbiAgICByZXR1cm4ge307XG4gIH1cblxuICBjb25zdCB7IGFjY291bnQsIHJlZ2lvbiB9ID0gc3RhY2s7XG5cbiAgYnVja2V0LmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgIGFjdGlvbnM6IFtcbiAgICAgICdzMzoqJyxcbiAgICBdLFxuICAgIHJlc291cmNlczogW1xuICAgICAgYCR7YnVja2V0LmJ1Y2tldEFybn1gLFxuICAgICAgYCR7YnVja2V0LmJ1Y2tldEFybn0vKmAsXG4gICAgXSxcbiAgICBwcmluY2lwYWxzOiBbXG4gICAgICBuZXcgaWFtLkFyblByaW5jaXBhbChgYXJuOmF3czppYW06OiR7YWNjb3VudH06cm9sZS9jZGstJHtxdWFsaWZpZXJ9LWRlcGxveS1yb2xlLSR7YWNjb3VudH0tJHtyZWdpb259YCksXG4gICAgXSxcbiAgfSkpO1xuXG4gIHJldHVybiB7fTtcbn07XG4iXX0=

package/lib/bucket-policies/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Dispatches bucket-type-specific S3 resource policy statements.
+ *
+ * @packageDocumentation
+ */
+import { S3SecureBucketType } from '../bucket-types';
+import { BucketPolicyApplyResult, BucketPolicyContext } from './types';
+/**
+ * Applies resource policies for the given bucket type, if any.
+ *
+ * Types without dedicated policies ({@link S3SecureBucketType.DEFAULT_BUCKET},
+ * {@link S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET}) are no-ops and return an empty result.
+ *
+ * @param bucketType - Preset that selects which policy applier runs.
+ * @param context - Bucket and owning stack.
+ * @returns Side effects such as {@link BucketPolicyApplyResult.accessLogBucketPolicyDependable}.
+ */
+export declare const applyBucketPolicies: (bucketType: S3SecureBucketType, context: BucketPolicyContext) => BucketPolicyApplyResult;

package/lib/bucket-policies/index.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyBucketPolicies = void 0;
+/**
+ * Dispatches bucket-type-specific S3 resource policy statements.
+ *
+ * @packageDocumentation
+ */
+const bucket_types_1 = require("../bucket-types");
+const access_log_bucket_policy_1 = require("./access-log-bucket-policy");
+const cloud_watch_log_archive_policy_1 = require("./cloud-watch-log-archive-policy");
+const deployment_pipeline_artifact_policy_1 = require("./deployment-pipeline-artifact-policy");
+/**
+ * Applies resource policies for the given bucket type, if any.
+ *
+ * Types without dedicated policies ({@link S3SecureBucketType.DEFAULT_BUCKET},
+ * {@link S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET}) are no-ops and return an empty result.
+ *
+ * @param bucketType - Preset that selects which policy applier runs.
+ * @param context - Bucket and owning stack.
+ * @returns Side effects such as {@link BucketPolicyApplyResult.accessLogBucketPolicyDependable}.
+ */
+const applyBucketPolicies = (bucketType, context) => {
+    if (bucketType === bucket_types_1.S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET) {
+        return (0, deployment_pipeline_artifact_policy_1.applyDeploymentPipelineArtifactPolicy)(context);
+    }
+    if (bucketType === bucket_types_1.S3SecureBucketType.ACCESS_LOG_BUCKET) {
+        return (0, access_log_bucket_policy_1.applyAccessLogBucketPolicy)(context);
+    }
+    if (bucketType === bucket_types_1.S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET) {
+        return (0, cloud_watch_log_archive_policy_1.applyCloudWatchLogArchivePolicy)(context);
+    }
+    return {};
+};
+exports.applyBucketPolicies = applyBucketPolicies;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXBvbGljaWVzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7O0dBSUc7QUFDSCxrREFBcUQ7QUFDckQseUVBQXdFO0FBQ3hFLHFGQUFtRjtBQUNuRiwrRkFBOEY7QUFHOUY7Ozs7Ozs7OztHQVNHO0FBQ0ksTUFBTSxtQkFBbUIsR0FBRyxDQUNqQyxVQUE4QixFQUM5QixPQUE0QixFQUNILEVBQUU7SUFDM0IsSUFBSSxVQUFVLEtBQUssaUNBQWtCLENBQUMsbUNBQW1DLEVBQUUsQ0FBQztRQUMxRSxPQUFPLElBQUEsMkVBQXFDLEVBQUMsT0FBTyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUVELElBQUksVUFBVSxLQUFLLGlDQUFrQixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDeEQsT0FBTyxJQUFBLHFEQUEwQixFQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzdDLENBQUM7SUFFRCxJQUFJLFVBQVUsS0FBSyxpQ0FBa0IsQ0FBQyw4QkFBOEIsRUFBRSxDQUFDO1FBQ3JFLE9BQU8sSUFBQSxnRUFBK0IsRUFBQyxPQUFPLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBRUQsT0FBTyxFQUFFLENBQUM7QUFDWixDQUFDLENBQUM7QUFqQlcsUUFBQSxtQkFBbUIsdUJBaUI5QiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogRGlzcGF0Y2hlcyBidWNrZXQtdHlwZS1zcGVjaWZpYyBTMyByZXNvdXJjZSBwb2xpY3kgc3RhdGVtZW50cy5cbiAqXG4gKiBAcGFja2FnZURvY3VtZW50YXRpb25cbiAqL1xuaW1wb3J0IHsgUzNTZWN1cmVCdWNrZXRUeXBlIH0gZnJvbSAnLi4vYnVja2V0LXR5cGVzJztcbmltcG9ydCB7IGFwcGx5QWNjZXNzTG9nQnVja2V0UG9saWN5IH0gZnJvbSAnLi9hY2Nlc3MtbG9nLWJ1Y2tldC1wb2xpY3knO1xuaW1wb3J0IHsgYXBwbHlDbG91ZFdhdGNoTG9nQXJjaGl2ZVBvbGljeSB9IGZyb20gJy4vY2xvdWQtd2F0Y2gtbG9nLWFyY2hpdmUtcG9saWN5JztcbmltcG9ydCB7IGFwcGx5RGVwbG95bWVudFBpcGVsaW5lQXJ0aWZhY3RQb2xpY3kgfSBmcm9tICcuL2RlcGxveW1lbnQtcGlwZWxpbmUtYXJ0aWZhY3QtcG9saWN5JztcbmltcG9ydCB7IEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0LCBCdWNrZXRQb2xpY3lDb250ZXh0IH0gZnJvbSAnLi90eXBlcyc7XG5cbi8qKlxuICogQXBwbGllcyByZXNvdXJjZSBwb2xpY2llcyBmb3IgdGhlIGdpdmVuIGJ1Y2tldCB0eXBlLCBpZiBhbnkuXG4gKlxuICogVHlwZXMgd2l0aG91dCBkZWRpY2F0ZWQgcG9saWNpZXMgKHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuREVGQVVMVF9CVUNLRVR9LFxuICoge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VREZST05UX09SSUdJTl9CVUNLRVR9KSBhcmUgbm8tb3BzIGFuZCByZXR1cm4gYW4gZW1wdHkgcmVzdWx0LlxuICpcbiAqIEBwYXJhbSBidWNrZXRUeXBlIC0gUHJlc2V0IHRoYXQgc2VsZWN0cyB3aGljaCBwb2xpY3kgYXBwbGllciBydW5zLlxuICogQHBhcmFtIGNvbnRleHQgLSBCdWNrZXQgYW5kIG93bmluZyBzdGFjay5cbiAqIEByZXR1cm5zIFNpZGUgZWZmZWN0cyBzdWNoIGFzIHtAbGluayBCdWNrZXRQb2xpY3lBcHBseVJlc3VsdC5hY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlfS5cbiAqL1xuZXhwb3J0IGNvbnN0IGFwcGx5QnVja2V0UG9saWNpZXMgPSAoXG4gIGJ1Y2tldFR5cGU6IFMzU2VjdXJlQnVja2V0VHlwZSxcbiAgY29udGV4dDogQnVja2V0UG9saWN5Q29udGV4dCxcbik6IEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0ID0+IHtcbiAgaWYgKGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5ERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVCkge1xuICAgIHJldHVybiBhcHBseURlcGxveW1lbnRQaXBlbGluZUFydGlmYWN0UG9saWN5KGNvbnRleHQpO1xuICB9XG5cbiAgaWYgKGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVCkge1xuICAgIHJldHVybiBhcHBseUFjY2Vzc0xvZ0J1Y2tldFBvbGljeShjb250ZXh0KTtcbiAgfVxuXG4gIGlmIChidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUKSB7XG4gICAgcmV0dXJuIGFwcGx5Q2xvdWRXYXRjaExvZ0FyY2hpdmVQb2xpY3koY29udGV4dCk7XG4gIH1cblxuICByZXR1cm4ge307XG59O1xuIl19

package/lib/bucket-policies/types.d.ts

@@ -0,0 +1,22 @@
+import { Stack } from 'aws-cdk-lib';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import { IDependable } from 'constructs';
+/**
+ * Inputs shared by bucket-type resource policy appliers.
+ */
+export interface BucketPolicyContext {
+    /** The bucket to attach resource policies to. */
+    readonly bucket: s3.Bucket;
+    /** Stack that owns the bucket; used for account, region, and synthesizer metadata. */
+    readonly stack: Stack;
+}
+/**
+ * Optional side effects returned after applying type-specific bucket policies.
+ */
+export interface BucketPolicyApplyResult {
+    /**
+     * Set when {@link S3SecureBucketType.ACCESS_LOG_BUCKET} policies are applied.
+     * Depend on this before enabling ALB/NLB access logging.
+     */
+    readonly accessLogBucketPolicyDependable?: IDependable;
+}

package/lib/bucket-policies/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXBvbGljaWVzL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBTdGFjayB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIHMzIGZyb20gJ2F3cy1jZGstbGliL2F3cy1zMyc7XG5pbXBvcnQgeyBJRGVwZW5kYWJsZSB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuXG4vKipcbiAqIElucHV0cyBzaGFyZWQgYnkgYnVja2V0LXR5cGUgcmVzb3VyY2UgcG9saWN5IGFwcGxpZXJzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEJ1Y2tldFBvbGljeUNvbnRleHQge1xuICAvKiogVGhlIGJ1Y2tldCB0byBhdHRhY2ggcmVzb3VyY2UgcG9saWNpZXMgdG8uICovXG4gIHJlYWRvbmx5IGJ1Y2tldDogczMuQnVja2V0O1xuICAvKiogU3RhY2sgdGhhdCBvd25zIHRoZSBidWNrZXQ7IHVzZWQgZm9yIGFjY291bnQsIHJlZ2lvbiwgYW5kIHN5bnRoZXNpemVyIG1ldGFkYXRhLiAqL1xuICByZWFkb25seSBzdGFjazogU3RhY2s7XG59XG5cbi8qKlxuICogT3B0aW9uYWwgc2lkZSBlZmZlY3RzIHJldHVybmVkIGFmdGVyIGFwcGx5aW5nIHR5cGUtc3BlY2lmaWMgYnVja2V0IHBvbGljaWVzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0IHtcbiAgLyoqXG4gICAqIFNldCB3aGVuIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9IHBvbGljaWVzIGFyZSBhcHBsaWVkLlxuICAgKiBEZXBlbmQgb24gdGhpcyBiZWZvcmUgZW5hYmxpbmcgQUxCL05MQiBhY2Nlc3MgbG9nZ2luZy5cbiAgICovXG4gIHJlYWRvbmx5IGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU/OiBJRGVwZW5kYWJsZTtcbn1cbiJdfQ==

package/lib/bucket-types/bucket-type.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Bucket type discriminator values for {@link S3SecureBucketProps.bucketType}.
+ *
+ * Each value selects encryption defaults and, for some types, additional bucket resource policies.
+ *
+ * @see {@link S3SecureBucketProps.bucketType}
+ */
+export declare const S3SecureBucketType: {
+    /**
+     * Pipeline artifact bucket when using a custom CDK bootstrap qualifier
+     * (single- or multi-region deployments).
+     *
+     * Adds an `s3:*` grant for `cdk-<qualifier>-deploy-role` when the bootstrap qualifier is not default.
+     */
+    readonly DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET: "DeploymentPipelineArtifactBucket";
+    /**
+     * Origin bucket for CloudFront distributions.
+     *
+     * Uses S3-managed encryption ({@link s3.BucketEncryption.S3_MANAGED}) by default.
+     */
+    readonly CLOUDFRONT_ORIGIN_BUCKET: "CloudFrontOriginBucket";
+    /**
+     * General-purpose secure bucket (default qualifier / standard use).
+     *
+     * Uses KMS-managed encryption unless overridden in props. No type-specific resource policies.
+     */
+    readonly DEFAULT_BUCKET: "DefaultBucket";
+    /**
+     * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
+     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/<account>/*` only (no read/list).
+     *
+     * The regional ELBv2 log-delivery account ID (legacy path alongside the log delivery service principal)
+     * is resolved from `aws-cdk-lib/region-info` at synthesis time when {@link Stack#region} is known,
+     * or via a deploy-time mapping when it is a token.
+     */
+    readonly ACCESS_LOG_BUCKET: "AccessLogBucket";
+    /**
+     * Archive bucket for log data exported from CloudWatch Logs via export tasks.
+     *
+     * Grants `logs.<region>.amazonaws.com` `s3:GetBucketAcl` and `s3:PutObject` for log groups in the
+     * stack account and region (see AWS docs for cross-account export).
+     */
+    readonly CLOUD_WATCH_LOG_ARCHIVE_BUCKET: "CloudWatchLogArchiveBucket";
+};
+/**
+ * Discriminated union of {@link S3SecureBucketType} string literals.
+ */
+export type S3SecureBucketType = typeof S3SecureBucketType[keyof typeof S3SecureBucketType];