sst 2.8.8 → 2.8.10

package/constructs/Bucket.d.ts

@@ -149,9 +149,8 @@ export interface BucketProps {
     name?: string;
     /**
      * The CORS configuration of this bucket.
-     *
+     * @default true
      * @example
-     *
      * ```js
      * new Bucket(stack, "Bucket", {
      *   cors: true,
@@ -170,6 +169,18 @@ export interface BucketProps {
      * ```
      */
     cors?: boolean | BucketCorsRule[];
+    /**
+     * Block public access to this bucket. Setting this to `true` alllows uploading objects with public ACLs.
+     * Note that setting to `true` does not necessarily mean that the bucket is completely accessible to the public. Rather, it enables the granting of public permissions through public ACLs.
+     * @default false
+     * @example
+     * ```js
+     * new Bucket(stack, "Bucket", {
+     *   blockPublicACLs: true,
+     * });
+     * ```
+     */
+    blockPublicACLs?: boolean;
     /**
      * The default function props to be applied to all the Lambda functions in the API. The `environment`, `permissions` and `layers` properties will be merged with per route definitions if they are defined.
      *
@@ -347,5 +358,7 @@ export declare class Bucket extends Construct implements SSTConstruct {
     private addTopicNotification;
     private addFunctionNotification;
     private buildCorsConfig;
+    private buildBlockPublicAccessConfig;
+    private buildObjectOwnershipConfig;
 }
 export {};

package/constructs/Bucket.js

@@ -4,7 +4,7 @@ import { Topic } from "./Topic.js";
 import { getFunctionRef, isCDKConstruct } from "./Construct.js";
 import { Function as Fn, } from "./Function.js";
 import { toCdkDuration } from "./util/duration.js";
-import { Bucket as CDKBucket, EventType, HttpMethods, } from "aws-cdk-lib/aws-s3";
+import { Bucket as CDKBucket, BlockPublicAccess, EventType, HttpMethods, ObjectOwnership, } from "aws-cdk-lib/aws-s3";
 import { LambdaDestination, SnsDestination, SqsDestination, } from "aws-cdk-lib/aws-s3-notifications";
 /////////////////////
 // Construct
@@ -171,7 +171,7 @@ export class Bucket extends Construct {
         };
     }
     createBucket() {
-        const { name, cors, cdk } = this.props;
+        const { name, cors, blockPublicACLs, cdk } = this.props;
         if (isCDKConstruct(cdk?.bucket)) {
             if (cors !== undefined) {
                 throw new Error(`Cannot configure the "cors" when "cdk.bucket" is a construct`);
@@ -182,6 +182,8 @@ export class Bucket extends Construct {
             this.cdk.bucket = new CDKBucket(this, "Bucket", {
                 bucketName: name,
                 cors: this.buildCorsConfig(cors),
+                blockPublicAccess: this.buildBlockPublicAccessConfig(blockPublicACLs),
+                objectOwnership: this.buildObjectOwnershipConfig(blockPublicACLs),
                 ...cdk?.bucket,
             });
         }
@@ -281,10 +283,10 @@ export class Bucket extends Construct {
         fn.bind(this.bindingForAllNotifications);
     }
     buildCorsConfig(cors) {
-        if (cors === undefined || cors === false) {
+        if (cors === false) {
             return;
         }
-        if (cors === true) {
+        if (cors === undefined || cors === true) {
             return [
                 {
                     allowedHeaders: ["*"],
@@ -308,4 +310,17 @@ export class Bucket extends Construct {
             maxAge: e.maxAge && toCdkDuration(e.maxAge).toSeconds(),
         }));
     }
+    buildBlockPublicAccessConfig(config) {
+        return config === true
+            ? BlockPublicAccess.BLOCK_ALL
+            : new BlockPublicAccess({
+                blockPublicAcls: false,
+                ignorePublicAcls: false,
+            });
+    }
+    buildObjectOwnershipConfig(config) {
+        return config === true
+            ? ObjectOwnership.BUCKET_OWNER_ENFORCED
+            : ObjectOwnership.BUCKET_OWNER_PREFERRED;
+    }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.8.8",
+  "version": "2.8.10",
   "bin": {
     "sst": "cli/sst.js"
   },