terraconstructs 0.0.8

package/lib/aws/storage/bucket-notifications.d.ts

@@ -0,0 +1,58 @@
+import { s3BucketNotification } from "@cdktf/provider-aws";
+import { Construct } from "constructs";
+import { AwsConstructBase, AwsConstructProps } from "../aws-construct";
+import { IBucket, EventType, NotificationKeyFilter } from "./bucket";
+import { IBucketNotificationDestination } from "./bucket-destination";
+export interface NotificationsProps extends AwsConstructProps {
+    /**
+     * The bucket to manage notifications for.
+     */
+    readonly bucket: IBucket;
+}
+/**
+ * A custom CloudFormation resource that updates bucket notifications for a
+ * bucket. The reason we need it is because the AWS::S3::Bucket notification
+ * configuration is defined on the bucket itself, which makes it impossible to
+ * provision notifications at the same time as the target (since
+ * PutBucketNotifications validates the targets).
+ *
+ * Since only a single BucketNotifications resource is allowed for each Bucket,
+ * this construct is not exported in the public API of this module. Instead, it
+ * is created just-in-time by `s3.Bucket.onEvent`, so a 1:1 relationship is
+ * ensured.
+ *
+ * @see
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-notificationconfig.html
+ */
+export declare class BucketNotifications extends AwsConstructBase {
+    resource?: s3BucketNotification.S3BucketNotification;
+    get outputs(): Record<string, any>;
+    private eventBridgeEnabled;
+    private readonly lambdaNotifications;
+    private readonly queueNotifications;
+    private readonly topicNotifications;
+    private readonly bucket;
+    constructor(scope: Construct, id: string, props: NotificationsProps);
+    /**
+     * Adds a notification subscription for this bucket.
+     * If this is the first notification, a BucketNotification resource is added to the stack.
+     *
+     * @param event The type of event
+     * @param target The target construct
+     * @param filters A set of S3 key filters
+     */
+    addNotification(event: EventType, target: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): void;
+    enableEventBridgeNotification(): void;
+    /**
+     * Defines the bucket notifications resources in the stack only once.
+     * This is called lazily as we add notifications, so that if notifications are not added,
+     * there is no notifications resource.
+     */
+    private createResourceOnce;
+    /**
+     * Adds resource to the Terraform JSON output at Synth time.
+     *
+     * called by TerraformStack.prepareStack()
+     */
+    toTerraform(): any;
+}

package/lib/aws/storage/bucket-notifications.js

@@ -0,0 +1,169 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BucketNotifications = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const provider_aws_1 = require("@cdktf/provider-aws");
+const cdktf_1 = require("cdktf");
+const aws_construct_1 = require("../aws-construct");
+const bucket_destination_1 = require("./bucket-destination");
+/**
+ * A custom CloudFormation resource that updates bucket notifications for a
+ * bucket. The reason we need it is because the AWS::S3::Bucket notification
+ * configuration is defined on the bucket itself, which makes it impossible to
+ * provision notifications at the same time as the target (since
+ * PutBucketNotifications validates the targets).
+ *
+ * Since only a single BucketNotifications resource is allowed for each Bucket,
+ * this construct is not exported in the public API of this module. Instead, it
+ * is created just-in-time by `s3.Bucket.onEvent`, so a 1:1 relationship is
+ * ensured.
+ *
+ * @see
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-notificationconfig.html
+ */
+class BucketNotifications extends aws_construct_1.AwsConstructBase {
+    get outputs() {
+        return {};
+    }
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.eventBridgeEnabled = false;
+        this.lambdaNotifications = new Array();
+        this.queueNotifications = new Array();
+        this.topicNotifications = new Array();
+        this.bucket = props.bucket;
+    }
+    /**
+     * Adds a notification subscription for this bucket.
+     * If this is the first notification, a BucketNotification resource is added to the stack.
+     *
+     * @param event The type of event
+     * @param target The target construct
+     * @param filters A set of S3 key filters
+     */
+    addNotification(event, target, ...filters) {
+        const resource = this.createResourceOnce();
+        // TODO: Seems Terraform provider does not have limitations on prefix and suffix?
+        // let hasPrefix = false;
+        // let hasSuffix = false;
+        for (const filter of filters) {
+            // if (!filter.suffix && !filter.prefix) {
+            //   throw new Error(
+            //     "NotificationKeyFilter must specify `prefix` and/or `suffix`",
+            //   );
+            // }
+            // if (filter.suffix) {
+            //   if (hasSuffix) {
+            //     throw new Error(
+            //       "Cannot specify more than one suffix rule in a filter.",
+            //     );
+            //   }
+            //   hasSuffix = true;
+            // }
+            // if (filter.prefix) {
+            //   if (hasPrefix) {
+            //     throw new Error(
+            //       "Cannot specify more than one prefix rule in a filter.",
+            //     );
+            //   }
+            //   hasPrefix = true;
+            // }
+            // resolve target. this also provides an opportunity for the target to e.g. update
+            // policies to allow this notification to happen.
+            const targetProps = target.bind(this, this.bucket);
+            const commonConfig = {
+                events: [event],
+                id: filter.id,
+                filterPrefix: filter.prefix,
+                filterSuffix: filter.suffix,
+            };
+            // if the target specifies any dependencies, add them here.
+            // for example, the SNS topic policy must be created /before/ the notification resource.
+            // otherwise, S3 won't be able to confirm the subscription.
+            if (targetProps.dependencies) {
+                resource.node.addDependency(...targetProps.dependencies);
+            }
+            // based on the target type, add the the correct configurations array
+            switch (targetProps.type) {
+                case bucket_destination_1.BucketNotificationDestinationType.LAMBDA:
+                    this.lambdaNotifications.push({
+                        ...commonConfig,
+                        lambdaFunctionArn: targetProps.arn,
+                    });
+                    break;
+                case bucket_destination_1.BucketNotificationDestinationType.QUEUE:
+                    this.queueNotifications.push({
+                        ...commonConfig,
+                        queueArn: targetProps.arn,
+                    });
+                    break;
+                // TODO: re-add SNS support
+                case bucket_destination_1.BucketNotificationDestinationType.TOPIC:
+                    this.topicNotifications.push({
+                        ...commonConfig,
+                        topicArn: targetProps.arn,
+                    });
+                    break;
+                default:
+                    throw new Error("Unsupported notification target type:" +
+                        bucket_destination_1.BucketNotificationDestinationType[targetProps.type]);
+            }
+        }
+    }
+    enableEventBridgeNotification() {
+        this.createResourceOnce();
+        this.eventBridgeEnabled = true;
+    }
+    /**
+     * Defines the bucket notifications resources in the stack only once.
+     * This is called lazily as we add notifications, so that if notifications are not added,
+     * there is no notifications resource.
+     */
+    createResourceOnce() {
+        if (!this.resource) {
+            this.resource = new provider_aws_1.s3BucketNotification.S3BucketNotification(this, "Resource", {
+                bucket: this.bucket.bucketName,
+                eventbridge: cdktf_1.Lazy.anyValue({
+                    produce: () => this.eventBridgeEnabled,
+                }),
+                lambdaFunction: cdktf_1.Lazy.anyValue({
+                    produce: () => this.lambdaNotifications.length > 0
+                        ? this.lambdaNotifications.map((l) => provider_aws_1.s3BucketNotification.s3BucketNotificationLambdaFunctionToTerraform(l))
+                        : undefined,
+                }),
+                queue: cdktf_1.Lazy.anyValue({
+                    produce: () => this.queueNotifications.length > 0
+                        ? this.queueNotifications.map((q) => provider_aws_1.s3BucketNotification.s3BucketNotificationQueueToTerraform(q))
+                        : undefined,
+                }),
+                topic: cdktf_1.Lazy.anyValue({
+                    produce: () => this.topicNotifications.length > 0
+                        ? this.topicNotifications.map((t) => provider_aws_1.s3BucketNotification.s3BucketNotificationTopicToTerraform(t))
+                        : undefined,
+                }),
+            });
+        }
+        return this.resource;
+    }
+    /**
+     * Adds resource to the Terraform JSON output at Synth time.
+     *
+     * called by TerraformStack.prepareStack()
+     */
+    toTerraform() {
+        // Add dependency on bucket policy if it exists to avoid race conditions
+        // S3 does not allow calling PutBucketPolicy and PutBucketNotification APIs at the same time
+        // See https://github.com/aws/aws-cdk/issues/27600
+        // prepareStack are used here because bucket policy maybe added to construct after addition of notification resource.
+        // but we need this defined before stack Aspect maps construct dependencies to Terraform dependsOn
+        if (this.bucket.policy) {
+            this.node.addDependency(this.bucket.policy);
+        }
+        return {};
+    }
+}
+exports.BucketNotifications = BucketNotifications;
+_a = JSII_RTTI_SYMBOL_1;
+BucketNotifications[_a] = { fqn: "terraconstructs.aws.storage.BucketNotifications", version: "0.0.8" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVja2V0LW5vdGlmaWNhdGlvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXdzL3N0b3JhZ2UvYnVja2V0LW5vdGlmaWNhdGlvbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxzREFBMkQ7QUFDM0QsaUNBQTZCO0FBRTdCLG9EQUF1RTtBQUV2RSw2REFHOEI7QUFTOUI7Ozs7Ozs7Ozs7Ozs7O0dBY0c7QUFDSCxNQUFhLG1CQUFvQixTQUFRLGdDQUFnQjtJQUV2RCxJQUFXLE9BQU87UUFDaEIsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBV0QsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUF5QjtRQUNqRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBVlgsdUJBQWtCLEdBQUcsS0FBSyxDQUFDO1FBQ2xCLHdCQUFtQixHQUNsQyxJQUFJLEtBQUssRUFBMkQsQ0FBQztRQUN0RCx1QkFBa0IsR0FDakMsSUFBSSxLQUFLLEVBQWtELENBQUM7UUFDN0MsdUJBQWtCLEdBQ2pDLElBQUksS0FBSyxFQUFrRCxDQUFDO1FBSzVELElBQUksQ0FBQyxNQUFNLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQztJQUM3QixDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNJLGVBQWUsQ0FDcEIsS0FBZ0IsRUFDaEIsTUFBc0MsRUFDdEMsR0FBRyxPQUFnQztRQUVuQyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUMzQyxpRkFBaUY7UUFDakYseUJBQXlCO1FBQ3pCLHlCQUF5QjtRQUN6QixLQUFLLE1BQU0sTUFBTSxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQzdCLDBDQUEwQztZQUMxQyxxQkFBcUI7WUFDckIscUVBQXFFO1lBQ3JFLE9BQU87WUFDUCxJQUFJO1lBQ0osdUJBQXVCO1lBQ3ZCLHFCQUFxQjtZQUNyQix1QkFBdUI7WUFDdkIsaUVBQWlFO1lBQ2pFLFNBQVM7WUFDVCxNQUFNO1lBQ04sc0JBQXNCO1lBQ3RCLElBQUk7WUFDSix1QkFBdUI7WUFDdkIscUJBQXFCO1lBQ3JCLHVCQUF1QjtZQUN2QixpRUFBaUU7WUFDakUsU0FBUztZQUNULE1BQU07WUFDTixzQkFBc0I7WUFDdEIsSUFBSTtZQUNKLGtGQUFrRjtZQUNsRixpREFBaUQ7WUFDakQsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ25ELE1BQU0sWUFBWSxHQUF3QjtnQkFDeEMsTUFBTSxFQUFFLENBQUMsS0FBSyxDQUFDO2dCQUNmLEVBQUUsRUFBRSxNQUFNLENBQUMsRUFBRTtnQkFDYixZQUFZLEVBQUUsTUFBTSxDQUFDLE1BQU07Z0JBQzNCLFlBQVksRUFBRSxNQUFNLENBQUMsTUFBTTthQUM1QixDQUFDO1lBRUYsMkRBQTJEO1lBQzNELHdGQUF3RjtZQUN4RiwyREFBMkQ7WUFDM0QsSUFBSSxXQUFXLENBQUMsWUFBWSxFQUFFLENBQUM7Z0JBQzdCLFFBQVEsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEdBQUcsV0FBVyxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQzNELENBQUM7WUFFRCxxRUFBcUU7WUFDckUsUUFBUSxXQUFXLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ3pCLEtBQUssc0RBQWlDLENBQUMsTUFBTTtvQkFDM0MsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQzt3QkFDNUIsR0FBRyxZQUFZO3dCQUNmLGlCQUFpQixFQUFFLFdBQVcsQ0FBQyxHQUFHO3FCQUNuQyxDQUFDLENBQUM7b0JBQ0gsTUFBTTtnQkFFUixLQUFLLHNEQUFpQyxDQUFDLEtBQUs7b0JBQzFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUM7d0JBQzNCLEdBQUcsWUFBWTt3QkFDZixRQUFRLEVBQUUsV0FBVyxDQUFDLEdBQUc7cUJBQzFCLENBQUMsQ0FBQztvQkFDSCxNQUFNO2dCQUVSLDJCQUEyQjtnQkFDM0IsS0FBSyxzREFBaUMsQ0FBQyxLQUFLO29CQUMxQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDO3dCQUMzQixHQUFHLFlBQVk7d0JBQ2YsUUFBUSxFQUFFLFdBQVcsQ0FBQyxHQUFHO3FCQUMxQixDQUFDLENBQUM7b0JBQ0gsTUFBTTtnQkFFUjtvQkFDRSxNQUFNLElBQUksS0FBSyxDQUNiLHVDQUF1Qzt3QkFDckMsc0RBQWlDLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUN0RCxDQUFDO1lBQ04sQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRU0sNkJBQTZCO1FBQ2xDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1FBQzFCLElBQUksQ0FBQyxrQkFBa0IsR0FBRyxJQUFJLENBQUM7SUFDakMsQ0FBQztJQUVEOzs7O09BSUc7SUFDSyxrQkFBa0I7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNuQixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksbUNBQW9CLENBQUMsb0JBQW9CLENBQzNELElBQUksRUFDSixVQUFVLEVBQ1Y7Z0JBQ0UsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVTtnQkFDOUIsV0FBVyxFQUFFLFlBQUksQ0FBQyxRQUFRLENBQUM7b0JBQ3pCLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsa0JBQWtCO2lCQUN2QyxDQUFDO2dCQUNGLGNBQWMsRUFBRSxZQUFJLENBQUMsUUFBUSxDQUFDO29CQUM1QixPQUFPLEVBQUUsR0FBRyxFQUFFLENBQ1osSUFBSSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxDQUFDO3dCQUNqQyxDQUFDLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQ2pDLG1DQUFvQixDQUFDLDZDQUE2QyxDQUNoRSxDQUFDLENBQ0YsQ0FDRjt3QkFDSCxDQUFDLENBQUMsU0FBUztpQkFDaEIsQ0FBQztnQkFDRixLQUFLLEVBQUUsWUFBSSxDQUFDLFFBQVEsQ0FBQztvQkFDbkIsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUNaLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxNQUFNLEdBQUcsQ0FBQzt3QkFDaEMsQ0FBQyxDQUFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUNoQyxtQ0FBb0IsQ0FBQyxvQ0FBb0MsQ0FDdkQsQ0FBQyxDQUNGLENBQ0Y7d0JBQ0gsQ0FBQyxDQUFDLFNBQVM7aUJBQ2hCLENBQUM7Z0JBQ0YsS0FBSyxFQUFFLFlBQUksQ0FBQyxRQUFRLENBQUM7b0JBQ25CLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FDWixJQUFJLENBQUMsa0JBQWtCLENBQUMsTUFBTSxHQUFHLENBQUM7d0JBQ2hDLENBQUMsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FDaEMsbUNBQW9CLENBQUMsb0NBQW9DLENBQ3ZELENBQUMsQ0FDRixDQUNGO3dCQUNILENBQUMsQ0FBQyxTQUFTO2lCQUNoQixDQUFDO2FBQ0gsQ0FDRixDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQztJQUN2QixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLFdBQVc7UUFDaEIsd0VBQXdFO1FBQ3hFLDRGQUE0RjtRQUM1RixrREFBa0Q7UUFDbEQscUhBQXFIO1FBQ3JILGtHQUFrRztRQUNsRyxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5QyxDQUFDO1FBQ0QsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDOztBQXBMSCxrREFxTEMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBzM0J1Y2tldE5vdGlmaWNhdGlvbiB9IGZyb20gXCJAY2RrdGYvcHJvdmlkZXItYXdzXCI7XG5pbXBvcnQgeyBMYXp5IH0gZnJvbSBcImNka3RmXCI7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiO1xuaW1wb3J0IHsgQXdzQ29uc3RydWN0QmFzZSwgQXdzQ29uc3RydWN0UHJvcHMgfSBmcm9tIFwiLi4vYXdzLWNvbnN0cnVjdFwiO1xuaW1wb3J0IHsgSUJ1Y2tldCwgRXZlbnRUeXBlLCBOb3RpZmljYXRpb25LZXlGaWx0ZXIgfSBmcm9tIFwiLi9idWNrZXRcIjtcbmltcG9ydCB7XG4gIEJ1Y2tldE5vdGlmaWNhdGlvbkRlc3RpbmF0aW9uVHlwZSxcbiAgSUJ1Y2tldE5vdGlmaWNhdGlvbkRlc3RpbmF0aW9uLFxufSBmcm9tIFwiLi9idWNrZXQtZGVzdGluYXRpb25cIjtcblxuZXhwb3J0IGludGVyZmFjZSBOb3RpZmljYXRpb25zUHJvcHMgZXh0ZW5kcyBBd3NDb25zdHJ1Y3RQcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgYnVja2V0IHRvIG1hbmFnZSBub3RpZmljYXRpb25zIGZvci5cbiAgICovXG4gIHJlYWRvbmx5IGJ1Y2tldDogSUJ1Y2tldDtcbn1cblxuLyoqXG4gKiBBIGN1c3RvbSBDbG91ZEZvcm1hdGlvbiByZXNvdXJjZSB0aGF0IHVwZGF0ZXMgYnVja2V0IG5vdGlmaWNhdGlvbnMgZm9yIGFcbiAqIGJ1Y2tldC4gVGhlIHJlYXNvbiB3ZSBuZWVkIGl0IGlzIGJlY2F1c2UgdGhlIEFXUzo6UzM6OkJ1Y2tldCBub3RpZmljYXRpb25cbiAqIGNvbmZpZ3VyYXRpb24gaXMgZGVmaW5lZCBvbiB0aGUgYnVja2V0IGl0c2VsZiwgd2hpY2ggbWFrZXMgaXQgaW1wb3NzaWJsZSB0b1xuICogcHJvdmlzaW9uIG5vdGlmaWNhdGlvbnMgYXQgdGhlIHNhbWUgdGltZSBhcyB0aGUgdGFyZ2V0IChzaW5jZVxuICogUHV0QnVja2V0Tm90aWZpY2F0aW9ucyB2YWxpZGF0ZXMgdGhlIHRhcmdldHMpLlxuICpcbiAqIFNpbmNlIG9ubHkgYSBzaW5nbGUgQnVja2V0Tm90aWZpY2F0aW9ucyByZXNvdXJjZSBpcyBhbGxvd2VkIGZvciBlYWNoIEJ1Y2tldCxcbiAqIHRoaXMgY29uc3RydWN0IGlzIG5vdCBleHBvcnRlZCBpbiB0aGUgcHVibGljIEFQSSBvZiB0aGlzIG1vZHVsZS4gSW5zdGVhZCwgaXRcbiAqIGlzIGNyZWF0ZWQganVzdC1pbi10aW1lIGJ5IGBzMy5CdWNrZXQub25FdmVudGAsIHNvIGEgMToxIHJlbGF0aW9uc2hpcCBpc1xuICogZW5zdXJlZC5cbiAqXG4gKiBAc2VlXG4gKiBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vQVdTQ2xvdWRGb3JtYXRpb24vbGF0ZXN0L1VzZXJHdWlkZS9hd3MtcHJvcGVydGllcy1zMy1idWNrZXQtbm90aWZpY2F0aW9uY29uZmlnLmh0bWxcbiAqL1xuZXhwb3J0IGNsYXNzIEJ1Y2tldE5vdGlmaWNhdGlvbnMgZXh0ZW5kcyBBd3NDb25zdHJ1Y3RCYXNlIHtcbiAgcHVibGljIHJlc291cmNlPzogczNCdWNrZXROb3RpZmljYXRpb24uUzNCdWNrZXROb3RpZmljYXRpb247XG4gIHB1YmxpYyBnZXQgb3V0cHV0cygpOiBSZWNvcmQ8c3RyaW5nLCBhbnk+IHtcbiAgICByZXR1cm4ge307XG4gIH1cblxuICBwcml2YXRlIGV2ZW50QnJpZGdlRW5hYmxlZCA9IGZhbHNlO1xuICBwcml2YXRlIHJlYWRvbmx5IGxhbWJkYU5vdGlmaWNhdGlvbnMgPVxuICAgIG5ldyBBcnJheTxzM0J1Y2tldE5vdGlmaWNhdGlvbi5TM0J1Y2tldE5vdGlmaWNhdGlvbkxhbWJkYUZ1bmN0aW9uPigpO1xuICBwcml2YXRlIHJlYWRvbmx5IHF1ZXVlTm90aWZpY2F0aW9ucyA9XG4gICAgbmV3IEFycmF5PHMzQnVja2V0Tm90aWZpY2F0aW9uLlMzQnVja2V0Tm90aWZpY2F0aW9uUXVldWU+KCk7XG4gIHByaXZhdGUgcmVhZG9ubHkgdG9waWNOb3RpZmljYXRpb25zID1cbiAgICBuZXcgQXJyYXk8czNCdWNrZXROb3RpZmljYXRpb24uUzNCdWNrZXROb3RpZmljYXRpb25Ub3BpYz4oKTtcbiAgcHJpdmF0ZSByZWFkb25seSBidWNrZXQ6IElCdWNrZXQ7XG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IE5vdGlmaWNhdGlvbnNQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgdGhpcy5idWNrZXQgPSBwcm9wcy5idWNrZXQ7XG4gIH1cblxuICAvKipcbiAgICogQWRkcyBhIG5vdGlmaWNhdGlvbiBzdWJzY3JpcHRpb24gZm9yIHRoaXMgYnVja2V0LlxuICAgKiBJZiB0aGlzIGlzIHRoZSBmaXJzdCBub3RpZmljYXRpb24sIGEgQnVja2V0Tm90aWZpY2F0aW9uIHJlc291cmNlIGlzIGFkZGVkIHRvIHRoZSBzdGFjay5cbiAgICpcbiAgICogQHBhcmFtIGV2ZW50IFRoZSB0eXBlIG9mIGV2ZW50XG4gICAqIEBwYXJhbSB0YXJnZXQgVGhlIHRhcmdldCBjb25zdHJ1Y3RcbiAgICogQHBhcmFtIGZpbHRlcnMgQSBzZXQgb2YgUzMga2V5IGZpbHRlcnNcbiAgICovXG4gIHB1YmxpYyBhZGROb3RpZmljYXRpb24oXG4gICAgZXZlbnQ6IEV2ZW50VHlwZSxcbiAgICB0YXJnZXQ6IElCdWNrZXROb3RpZmljYXRpb25EZXN0aW5hdGlvbixcbiAgICAuLi5maWx0ZXJzOiBOb3RpZmljYXRpb25LZXlGaWx0ZXJbXVxuICApIHtcbiAgICBjb25zdCByZXNvdXJjZSA9IHRoaXMuY3JlYXRlUmVzb3VyY2VPbmNlKCk7XG4gICAgLy8gVE9ETzogU2VlbXMgVGVycmFmb3JtIHByb3ZpZGVyIGRvZXMgbm90IGhhdmUgbGltaXRhdGlvbnMgb24gcHJlZml4IGFuZCBzdWZmaXg/XG4gICAgLy8gbGV0IGhhc1ByZWZpeCA9IGZhbHNlO1xuICAgIC8vIGxldCBoYXNTdWZmaXggPSBmYWxzZTtcbiAgICBmb3IgKGNvbnN0IGZpbHRlciBvZiBmaWx0ZXJzKSB7XG4gICAgICAvLyBpZiAoIWZpbHRlci5zdWZmaXggJiYgIWZpbHRlci5wcmVmaXgpIHtcbiAgICAgIC8vICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgLy8gICAgIFwiTm90aWZpY2F0aW9uS2V5RmlsdGVyIG11c3Qgc3BlY2lmeSBgcHJlZml4YCBhbmQvb3IgYHN1ZmZpeGBcIixcbiAgICAgIC8vICAgKTtcbiAgICAgIC8vIH1cbiAgICAgIC8vIGlmIChmaWx0ZXIuc3VmZml4KSB7XG4gICAgICAvLyAgIGlmIChoYXNTdWZmaXgpIHtcbiAgICAgIC8vICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAvLyAgICAgICBcIkNhbm5vdCBzcGVjaWZ5IG1vcmUgdGhhbiBvbmUgc3VmZml4IHJ1bGUgaW4gYSBmaWx0ZXIuXCIsXG4gICAgICAvLyAgICAgKTtcbiAgICAgIC8vICAgfVxuICAgICAgLy8gICBoYXNTdWZmaXggPSB0cnVlO1xuICAgICAgLy8gfVxuICAgICAgLy8gaWYgKGZpbHRlci5wcmVmaXgpIHtcbiAgICAgIC8vICAgaWYgKGhhc1ByZWZpeCkge1xuICAgICAgLy8gICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgIC8vICAgICAgIFwiQ2Fubm90IHNwZWNpZnkgbW9yZSB0aGFuIG9uZSBwcmVmaXggcnVsZSBpbiBhIGZpbHRlci5cIixcbiAgICAgIC8vICAgICApO1xuICAgICAgLy8gICB9XG4gICAgICAvLyAgIGhhc1ByZWZpeCA9IHRydWU7XG4gICAgICAvLyB9XG4gICAgICAvLyByZXNvbHZlIHRhcmdldC4gdGhpcyBhbHNvIHByb3ZpZGVzIGFuIG9wcG9ydHVuaXR5IGZvciB0aGUgdGFyZ2V0IHRvIGUuZy4gdXBkYXRlXG4gICAgICAvLyBwb2xpY2llcyB0byBhbGxvdyB0aGlzIG5vdGlmaWNhdGlvbiB0byBoYXBwZW4uXG4gICAgICBjb25zdCB0YXJnZXRQcm9wcyA9IHRhcmdldC5iaW5kKHRoaXMsIHRoaXMuYnVja2V0KTtcbiAgICAgIGNvbnN0IGNvbW1vbkNvbmZpZzogQ29tbW9uQ29uZmlndXJhdGlvbiA9IHtcbiAgICAgICAgZXZlbnRzOiBbZXZlbnRdLFxuICAgICAgICBpZDogZmlsdGVyLmlkLFxuICAgICAgICBmaWx0ZXJQcmVmaXg6IGZpbHRlci5wcmVmaXgsXG4gICAgICAgIGZpbHRlclN1ZmZpeDogZmlsdGVyLnN1ZmZpeCxcbiAgICAgIH07XG5cbiAgICAgIC8vIGlmIHRoZSB0YXJnZXQgc3BlY2lmaWVzIGFueSBkZXBlbmRlbmNpZXMsIGFkZCB0aGVtIGhlcmUuXG4gICAgICAvLyBmb3IgZXhhbXBsZSwgdGhlIFNOUyB0b3BpYyBwb2xpY3kgbXVzdCBiZSBjcmVhdGVkIC9iZWZvcmUvIHRoZSBub3RpZmljYXRpb24gcmVzb3VyY2UuXG4gICAgICAvLyBvdGhlcndpc2UsIFMzIHdvbid0IGJlIGFibGUgdG8gY29uZmlybSB0aGUgc3Vic2NyaXB0aW9uLlxuICAgICAgaWYgKHRhcmdldFByb3BzLmRlcGVuZGVuY2llcykge1xuICAgICAgICByZXNvdXJjZS5ub2RlLmFkZERlcGVuZGVuY3koLi4udGFyZ2V0UHJvcHMuZGVwZW5kZW5jaWVzKTtcbiAgICAgIH1cblxuICAgICAgLy8gYmFzZWQgb24gdGhlIHRhcmdldCB0eXBlLCBhZGQgdGhlIHRoZSBjb3JyZWN0IGNvbmZpZ3VyYXRpb25zIGFycmF5XG4gICAgICBzd2l0Y2ggKHRhcmdldFByb3BzLnR5cGUpIHtcbiAgICAgICAgY2FzZSBCdWNrZXROb3RpZmljYXRpb25EZXN0aW5hdGlvblR5cGUuTEFNQkRBOlxuICAgICAgICAgIHRoaXMubGFtYmRhTm90aWZpY2F0aW9ucy5wdXNoKHtcbiAgICAgICAgICAgIC4uLmNvbW1vbkNvbmZpZyxcbiAgICAgICAgICAgIGxhbWJkYUZ1bmN0aW9uQXJuOiB0YXJnZXRQcm9wcy5hcm4sXG4gICAgICAgICAgfSk7XG4gICAgICAgICAgYnJlYWs7XG5cbiAgICAgICAgY2FzZSBCdWNrZXROb3RpZmljYXRpb25EZXN0aW5hdGlvblR5cGUuUVVFVUU6XG4gICAgICAgICAgdGhpcy5xdWV1ZU5vdGlmaWNhdGlvbnMucHVzaCh7XG4gICAgICAgICAgICAuLi5jb21tb25Db25maWcsXG4gICAgICAgICAgICBxdWV1ZUFybjogdGFyZ2V0UHJvcHMuYXJuLFxuICAgICAgICAgIH0pO1xuICAgICAgICAgIGJyZWFrO1xuXG4gICAgICAgIC8vIFRPRE86IHJlLWFkZCBTTlMgc3VwcG9ydFxuICAgICAgICBjYXNlIEJ1Y2tldE5vdGlmaWNhdGlvbkRlc3RpbmF0aW9uVHlwZS5UT1BJQzpcbiAgICAgICAgICB0aGlzLnRvcGljTm90aWZpY2F0aW9ucy5wdXNoKHtcbiAgICAgICAgICAgIC4uLmNvbW1vbkNvbmZpZyxcbiAgICAgICAgICAgIHRvcGljQXJuOiB0YXJnZXRQcm9wcy5hcm4sXG4gICAgICAgICAgfSk7XG4gICAgICAgICAgYnJlYWs7XG5cbiAgICAgICAgZGVmYXVsdDpcbiAgICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBcIlVuc3VwcG9ydGVkIG5vdGlmaWNhdGlvbiB0YXJnZXQgdHlwZTpcIiArXG4gICAgICAgICAgICAgIEJ1Y2tldE5vdGlmaWNhdGlvbkRlc3RpbmF0aW9uVHlwZVt0YXJnZXRQcm9wcy50eXBlXSxcbiAgICAgICAgICApO1xuICAgICAgfVxuICAgIH1cbiAgfVxuXG4gIHB1YmxpYyBlbmFibGVFdmVudEJyaWRnZU5vdGlmaWNhdGlvbigpIHtcbiAgICB0aGlzLmNyZWF0ZVJlc291cmNlT25jZSgpO1xuICAgIHRoaXMuZXZlbnRCcmlkZ2VFbmFibGVkID0gdHJ1ZTtcbiAgfVxuXG4gIC8qKlxuICAgKiBEZWZpbmVzIHRoZSBidWNrZXQgbm90aWZpY2F0aW9ucyByZXNvdXJjZXMgaW4gdGhlIHN0YWNrIG9ubHkgb25jZS5cbiAgICogVGhpcyBpcyBjYWxsZWQgbGF6aWx5IGFzIHdlIGFkZCBub3RpZmljYXRpb25zLCBzbyB0aGF0IGlmIG5vdGlmaWNhdGlvbnMgYXJlIG5vdCBhZGRlZCxcbiAgICogdGhlcmUgaXMgbm8gbm90aWZpY2F0aW9ucyByZXNvdXJjZS5cbiAgICovXG4gIHByaXZhdGUgY3JlYXRlUmVzb3VyY2VPbmNlKCkge1xuICAgIGlmICghdGhpcy5yZXNvdXJjZSkge1xuICAgICAgdGhpcy5yZXNvdXJjZSA9IG5ldyBzM0J1Y2tldE5vdGlmaWNhdGlvbi5TM0J1Y2tldE5vdGlmaWNhdGlvbihcbiAgICAgICAgdGhpcyxcbiAgICAgICAgXCJSZXNvdXJjZVwiLFxuICAgICAgICB7XG4gICAgICAgICAgYnVja2V0OiB0aGlzLmJ1Y2tldC5idWNrZXROYW1lLFxuICAgICAgICAgIGV2ZW50YnJpZGdlOiBMYXp5LmFueVZhbHVlKHtcbiAgICAgICAgICAgIHByb2R1Y2U6ICgpID0+IHRoaXMuZXZlbnRCcmlkZ2VFbmFibGVkLFxuICAgICAgICAgIH0pLFxuICAgICAgICAgIGxhbWJkYUZ1bmN0aW9uOiBMYXp5LmFueVZhbHVlKHtcbiAgICAgICAgICAgIHByb2R1Y2U6ICgpID0+XG4gICAgICAgICAgICAgIHRoaXMubGFtYmRhTm90aWZpY2F0aW9ucy5sZW5ndGggPiAwXG4gICAgICAgICAgICAgICAgPyB0aGlzLmxhbWJkYU5vdGlmaWNhdGlvbnMubWFwKChsKSA9PlxuICAgICAgICAgICAgICAgICAgICBzM0J1Y2tldE5vdGlmaWNhdGlvbi5zM0J1Y2tldE5vdGlmaWNhdGlvbkxhbWJkYUZ1bmN0aW9uVG9UZXJyYWZvcm0oXG4gICAgICAgICAgICAgICAgICAgICAgbCxcbiAgICAgICAgICAgICAgICAgICAgKSxcbiAgICAgICAgICAgICAgICAgIClcbiAgICAgICAgICAgICAgICA6IHVuZGVmaW5lZCxcbiAgICAgICAgICB9KSxcbiAgICAgICAgICBxdWV1ZTogTGF6eS5hbnlWYWx1ZSh7XG4gICAgICAgICAgICBwcm9kdWNlOiAoKSA9PlxuICAgICAgICAgICAgICB0aGlzLnF1ZXVlTm90aWZpY2F0aW9ucy5sZW5ndGggPiAwXG4gICAgICAgICAgICAgICAgPyB0aGlzLnF1ZXVlTm90aWZpY2F0aW9ucy5tYXAoKHEpID0+XG4gICAgICAgICAgICAgICAgICAgIHMzQnVja2V0Tm90aWZpY2F0aW9uLnMzQnVja2V0Tm90aWZpY2F0aW9uUXVldWVUb1RlcnJhZm9ybShcbiAgICAgICAgICAgICAgICAgICAgICBxLFxuICAgICAgICAgICAgICAgICAgICApLFxuICAgICAgICAgICAgICAgICAgKVxuICAgICAgICAgICAgICAgIDogdW5kZWZpbmVkLFxuICAgICAgICAgIH0pLFxuICAgICAgICAgIHRvcGljOiBMYXp5LmFueVZhbHVlKHtcbiAgICAgICAgICAgIHByb2R1Y2U6ICgpID0+XG4gICAgICAgICAgICAgIHRoaXMudG9waWNOb3RpZmljYXRpb25zLmxlbmd0aCA+IDBcbiAgICAgICAgICAgICAgICA/IHRoaXMudG9waWNOb3RpZmljYXRpb25zLm1hcCgodCkgPT5cbiAgICAgICAgICAgICAgICAgICAgczNCdWNrZXROb3RpZmljYXRpb24uczNCdWNrZXROb3RpZmljYXRpb25Ub3BpY1RvVGVycmFmb3JtKFxuICAgICAgICAgICAgICAgICAgICAgIHQsXG4gICAgICAgICAgICAgICAgICAgICksXG4gICAgICAgICAgICAgICAgICApXG4gICAgICAgICAgICAgICAgOiB1bmRlZmluZWQsXG4gICAgICAgICAgfSksXG4gICAgICAgIH0sXG4gICAgICApO1xuICAgIH1cbiAgICByZXR1cm4gdGhpcy5yZXNvdXJjZTtcbiAgfVxuXG4gIC8qKlxuICAgKiBBZGRzIHJlc291cmNlIHRvIHRoZSBUZXJyYWZvcm0gSlNPTiBvdXRwdXQgYXQgU3ludGggdGltZS5cbiAgICpcbiAgICogY2FsbGVkIGJ5IFRlcnJhZm9ybVN0YWNrLnByZXBhcmVTdGFjaygpXG4gICAqL1xuICBwdWJsaWMgdG9UZXJyYWZvcm0oKTogYW55IHtcbiAgICAvLyBBZGQgZGVwZW5kZW5jeSBvbiBidWNrZXQgcG9saWN5IGlmIGl0IGV4aXN0cyB0byBhdm9pZCByYWNlIGNvbmRpdGlvbnNcbiAgICAvLyBTMyBkb2VzIG5vdCBhbGxvdyBjYWxsaW5nIFB1dEJ1Y2tldFBvbGljeSBhbmQgUHV0QnVja2V0Tm90aWZpY2F0aW9uIEFQSXMgYXQgdGhlIHNhbWUgdGltZVxuICAgIC8vIFNlZSBodHRwczovL2dpdGh1Yi5jb20vYXdzL2F3cy1jZGsvaXNzdWVzLzI3NjAwXG4gICAgLy8gcHJlcGFyZVN0YWNrIGFyZSB1c2VkIGhlcmUgYmVjYXVzZSBidWNrZXQgcG9saWN5IG1heWJlIGFkZGVkIHRvIGNvbnN0cnVjdCBhZnRlciBhZGRpdGlvbiBvZiBub3RpZmljYXRpb24gcmVzb3VyY2UuXG4gICAgLy8gYnV0IHdlIG5lZWQgdGhpcyBkZWZpbmVkIGJlZm9yZSBzdGFjayBBc3BlY3QgbWFwcyBjb25zdHJ1Y3QgZGVwZW5kZW5jaWVzIHRvIFRlcnJhZm9ybSBkZXBlbmRzT25cbiAgICBpZiAodGhpcy5idWNrZXQucG9saWN5KSB7XG4gICAgICB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeSh0aGlzLmJ1Y2tldC5wb2xpY3kpO1xuICAgIH1cbiAgICByZXR1cm4ge307XG4gIH1cbn1cblxuaW50ZXJmYWNlIENvbW1vbkNvbmZpZ3VyYXRpb24ge1xuICAvKipcbiAgICogRG9jcyBhdCBUZXJyYWZvcm0gUmVnaXN0cnk6IHtAbGluayBodHRwczovL3JlZ2lzdHJ5LnRlcnJhZm9ybS5pby9wcm92aWRlcnMvaGFzaGljb3JwL2F3cy81LjY4LjAvZG9jcy9yZXNvdXJjZXMvczNfYnVja2V0X25vdGlmaWNhdGlvbiNpZCBTM0J1Y2tldE5vdGlmaWNhdGlvbiNpZH1cbiAgICpcbiAgICogUGxlYXNlIGJlIGF3YXJlIHRoYXQgdGhlIGlkIGZpZWxkIGlzIGF1dG9tYXRpY2FsbHkgYWRkZWQgdG8gYWxsIHJlc291cmNlcyBpbiBUZXJyYWZvcm0gcHJvdmlkZXJzIHVzaW5nIGEgVGVycmFmb3JtIHByb3ZpZGVyIFNESyB2ZXJzaW9uIGJlbG93IDIuXG4gICAqIElmIHlvdSBleHBlcmllbmNlIHByb2JsZW1zIHNldHRpbmcgdGhpcyB2YWx1ZSBpdCBtaWdodCBub3QgYmUgc2V0dGFibGUuIFBsZWFzZSB0YWtlIGEgbG9vayBhdCB0aGUgcHJvdmlkZXIgZG9jdW1lbnRhdGlvbiB0byBlbnN1cmUgaXQgc2hvdWxkIGJlIHNldHRhYmxlLlxuICAgKi9cbiAgcmVhZG9ubHkgaWQ/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IGV2ZW50czogc3RyaW5nW107XG4gIC8qKlxuICAgKiBEb2NzIGF0IFRlcnJhZm9ybSBSZWdpc3RyeToge0BsaW5rIGh0dHBzOi8vcmVnaXN0cnkudGVycmFmb3JtLmlvL3Byb3ZpZGVycy9oYXNoaWNvcnAvYXdzLzUuNjguMC9kb2NzL3Jlc291cmNlcy9zM19idWNrZXRfbm90aWZpY2F0aW9uI2ZpbHRlcl9wcmVmaXggUzNCdWNrZXROb3RpZmljYXRpb24jZmlsdGVyX3ByZWZpeH1cbiAgICovXG4gIHJlYWRvbmx5IGZpbHRlclByZWZpeD86IHN0cmluZztcbiAgLyoqXG4gICAqIERvY3MgYXQgVGVycmFmb3JtIFJlZ2lzdHJ5OiB7QGxpbmsgaHR0cHM6Ly9yZWdpc3RyeS50ZXJyYWZvcm0uaW8vcHJvdmlkZXJzL2hhc2hpY29ycC9hd3MvNS42OC4wL2RvY3MvcmVzb3VyY2VzL3MzX2J1Y2tldF9ub3RpZmljYXRpb24jZmlsdGVyX3N1ZmZpeCBTM0J1Y2tldE5vdGlmaWNhdGlvbiNmaWx0ZXJfc3VmZml4fVxuICAgKi9cbiAgcmVhZG9ubHkgZmlsdGVyU3VmZml4Pzogc3RyaW5nO1xufVxuIl19

package/lib/aws/storage/bucket-perms.d.ts

@@ -0,0 +1,9 @@
+export declare const BUCKET_READ_ACTIONS: string[];
+export declare const BUCKET_READ_METADATA_ACTIONS: string[];
+export declare const LEGACY_BUCKET_PUT_ACTIONS: string[];
+export declare const BUCKET_PUT_ACTIONS: string[];
+export declare const BUCKET_PUT_ACL_ACTIONS: string[];
+export declare const BUCKET_PUT_POLICY_ACTIONS: string[];
+export declare const BUCKET_DELETE_ACTIONS: string[];
+export declare const KEY_READ_ACTIONS: string[];
+export declare const KEY_WRITE_ACTIONS: string[];

package/lib/aws/storage/bucket-perms.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_WRITE_ACTIONS = exports.KEY_READ_ACTIONS = exports.BUCKET_DELETE_ACTIONS = exports.BUCKET_PUT_POLICY_ACTIONS = exports.BUCKET_PUT_ACL_ACTIONS = exports.BUCKET_PUT_ACTIONS = exports.LEGACY_BUCKET_PUT_ACTIONS = exports.BUCKET_READ_METADATA_ACTIONS = exports.BUCKET_READ_ACTIONS = void 0;
+// ref: https://github.com/aws/aws-cdk/blob/v2.160.0/packages/aws-cdk-lib/aws-s3/lib/perms.ts
+exports.BUCKET_READ_ACTIONS = [
+    "s3:GetObject*",
+    "s3:GetBucket*",
+    "s3:List*",
+];
+exports.BUCKET_READ_METADATA_ACTIONS = ["s3:GetBucket*", "s3:List*"];
+exports.LEGACY_BUCKET_PUT_ACTIONS = ["s3:PutObject*", "s3:Abort*"];
+exports.BUCKET_PUT_ACTIONS = [
+    "s3:PutObject",
+    "s3:PutObjectLegalHold",
+    "s3:PutObjectRetention",
+    "s3:PutObjectTagging",
+    "s3:PutObjectVersionTagging",
+    "s3:Abort*",
+];
+exports.BUCKET_PUT_ACL_ACTIONS = [
+    "s3:PutObjectAcl",
+    "s3:PutObjectVersionAcl",
+];
+exports.BUCKET_PUT_POLICY_ACTIONS = ["s3:PutBucketPolicy"];
+exports.BUCKET_DELETE_ACTIONS = ["s3:DeleteObject*"];
+exports.KEY_READ_ACTIONS = ["kms:Decrypt", "kms:DescribeKey"];
+exports.KEY_WRITE_ACTIONS = [
+    "kms:Encrypt",
+    "kms:ReEncrypt*",
+    "kms:GenerateDataKey*",
+    "kms:Decrypt", // required for multipart uploads. Refer https://aws.amazon.com/premiumsupport/knowledge-center/s3-multipart-kms-decrypt/
+];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVja2V0LXBlcm1zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2F3cy9zdG9yYWdlL2J1Y2tldC1wZXJtcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSw2RkFBNkY7QUFDaEYsUUFBQSxtQkFBbUIsR0FBRztJQUNqQyxlQUFlO0lBQ2YsZUFBZTtJQUNmLFVBQVU7Q0FDWCxDQUFDO0FBRVcsUUFBQSw0QkFBNEIsR0FBRyxDQUFDLGVBQWUsRUFBRSxVQUFVLENBQUMsQ0FBQztBQUU3RCxRQUFBLHlCQUF5QixHQUFHLENBQUMsZUFBZSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0FBRTNELFFBQUEsa0JBQWtCLEdBQUc7SUFDaEMsY0FBYztJQUNkLHVCQUF1QjtJQUN2Qix1QkFBdUI7SUFDdkIscUJBQXFCO0lBQ3JCLDRCQUE0QjtJQUM1QixXQUFXO0NBQ1osQ0FBQztBQUVXLFFBQUEsc0JBQXNCLEdBQUc7SUFDcEMsaUJBQWlCO0lBQ2pCLHdCQUF3QjtDQUN6QixDQUFDO0FBRVcsUUFBQSx5QkFBeUIsR0FBRyxDQUFDLG9CQUFvQixDQUFDLENBQUM7QUFFbkQsUUFBQSxxQkFBcUIsR0FBRyxDQUFDLGtCQUFrQixDQUFDLENBQUM7QUFFN0MsUUFBQSxnQkFBZ0IsR0FBRyxDQUFDLGFBQWEsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0FBRXRELFFBQUEsaUJBQWlCLEdBQUc7SUFDL0IsYUFBYTtJQUNiLGdCQUFnQjtJQUNoQixzQkFBc0I7SUFDdEIsYUFBYSxFQUFFLHlIQUF5SDtDQUN6SSxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gcmVmOiBodHRwczovL2dpdGh1Yi5jb20vYXdzL2F3cy1jZGsvYmxvYi92Mi4xNjAuMC9wYWNrYWdlcy9hd3MtY2RrLWxpYi9hd3MtczMvbGliL3Blcm1zLnRzXG5leHBvcnQgY29uc3QgQlVDS0VUX1JFQURfQUNUSU9OUyA9IFtcbiAgXCJzMzpHZXRPYmplY3QqXCIsXG4gIFwiczM6R2V0QnVja2V0KlwiLFxuICBcInMzOkxpc3QqXCIsXG5dO1xuXG5leHBvcnQgY29uc3QgQlVDS0VUX1JFQURfTUVUQURBVEFfQUNUSU9OUyA9IFtcInMzOkdldEJ1Y2tldCpcIiwgXCJzMzpMaXN0KlwiXTtcblxuZXhwb3J0IGNvbnN0IExFR0FDWV9CVUNLRVRfUFVUX0FDVElPTlMgPSBbXCJzMzpQdXRPYmplY3QqXCIsIFwiczM6QWJvcnQqXCJdO1xuXG5leHBvcnQgY29uc3QgQlVDS0VUX1BVVF9BQ1RJT05TID0gW1xuICBcInMzOlB1dE9iamVjdFwiLFxuICBcInMzOlB1dE9iamVjdExlZ2FsSG9sZFwiLFxuICBcInMzOlB1dE9iamVjdFJldGVudGlvblwiLFxuICBcInMzOlB1dE9iamVjdFRhZ2dpbmdcIixcbiAgXCJzMzpQdXRPYmplY3RWZXJzaW9uVGFnZ2luZ1wiLFxuICBcInMzOkFib3J0KlwiLFxuXTtcblxuZXhwb3J0IGNvbnN0IEJVQ0tFVF9QVVRfQUNMX0FDVElPTlMgPSBbXG4gIFwiczM6UHV0T2JqZWN0QWNsXCIsXG4gIFwiczM6UHV0T2JqZWN0VmVyc2lvbkFjbFwiLFxuXTtcblxuZXhwb3J0IGNvbnN0IEJVQ0tFVF9QVVRfUE9MSUNZX0FDVElPTlMgPSBbXCJzMzpQdXRCdWNrZXRQb2xpY3lcIl07XG5cbmV4cG9ydCBjb25zdCBCVUNLRVRfREVMRVRFX0FDVElPTlMgPSBbXCJzMzpEZWxldGVPYmplY3QqXCJdO1xuXG5leHBvcnQgY29uc3QgS0VZX1JFQURfQUNUSU9OUyA9IFtcImttczpEZWNyeXB0XCIsIFwia21zOkRlc2NyaWJlS2V5XCJdO1xuXG5leHBvcnQgY29uc3QgS0VZX1dSSVRFX0FDVElPTlMgPSBbXG4gIFwia21zOkVuY3J5cHRcIixcbiAgXCJrbXM6UmVFbmNyeXB0KlwiLFxuICBcImttczpHZW5lcmF0ZURhdGFLZXkqXCIsXG4gIFwia21zOkRlY3J5cHRcIiwgLy8gcmVxdWlyZWQgZm9yIG11bHRpcGFydCB1cGxvYWRzLiBSZWZlciBodHRwczovL2F3cy5hbWF6b24uY29tL3ByZW1pdW1zdXBwb3J0L2tub3dsZWRnZS1jZW50ZXIvczMtbXVsdGlwYXJ0LWttcy1kZWNyeXB0L1xuXTtcbiJdfQ==

package/lib/aws/storage/bucket-policy.d.ts

@@ -0,0 +1,51 @@
+import { s3BucketPolicy } from "@cdktf/provider-aws";
+import { Construct } from "constructs";
+import { AwsConstructProps, AwsConstructBase } from "../aws-construct";
+import { IBucket } from "./bucket";
+import { PolicyDocument } from "../iam";
+export interface BucketPolicyProps extends AwsConstructProps {
+    /**
+     * The Amazon S3 bucket that the policy applies to.
+     */
+    readonly bucket: IBucket;
+}
+/**
+ * The bucket policy for an Amazon S3 bucket
+ *
+ * Policies define the operations that are allowed on this resource.
+ *
+ * You almost never need to define this construct directly.
+ *
+ * All AWS resources that support resource policies have a method called
+ * `addToResourcePolicy()`, which will automatically create a new resource
+ * policy if one doesn't exist yet, otherwise it will add to the existing
+ * policy.
+ *
+ * The bucket policy method is implemented differently than `addToResourcePolicy()`
+ * as `BucketPolicy()` creates a new policy without knowing one earlier existed.
+ * e.g. if during Bucket creation, if `autoDeleteObject:true`, these policies are
+ * added to the bucket policy:
+ *    ["s3:DeleteObject*", "s3:GetBucket*", "s3:List*", "s3:PutBucketPolicy"],
+ * and when you add a new BucketPolicy with ["s3:GetObject", "s3:ListBucket"] on
+ * this existing bucket, invoking `BucketPolicy()` will create a new Policy
+ * without knowing one earlier exists already, so it creates a new one.
+ * In this case, the custom resource handler will not have access to
+ * `s3:GetBucketTagging` action which will cause failure during deletion of stack.
+ *
+ * Hence its strongly recommended to use `addToResourcePolicy()` method to add
+ * new permissions to existing policy.
+ *
+ */
+export declare class BucketPolicy extends AwsConstructBase {
+    readonly resource: s3BucketPolicy.S3BucketPolicy;
+    get outputs(): Record<string, any>;
+    /**
+     * A policy document containing permissions to add to the specified bucket.
+     * For more information, see Access Policy Language Overview in the Amazon
+     * Simple Storage Service Developer Guide.
+     */
+    readonly document: PolicyDocument;
+    /** The Bucket this Policy applies to. */
+    readonly bucket: IBucket;
+    constructor(scope: Construct, id: string, props: BucketPolicyProps);
+}

package/lib/aws/storage/bucket-policy.js

@@ -0,0 +1,53 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BucketPolicy = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const provider_aws_1 = require("@cdktf/provider-aws");
+const aws_construct_1 = require("../aws-construct");
+const iam_1 = require("../iam");
+/**
+ * The bucket policy for an Amazon S3 bucket
+ *
+ * Policies define the operations that are allowed on this resource.
+ *
+ * You almost never need to define this construct directly.
+ *
+ * All AWS resources that support resource policies have a method called
+ * `addToResourcePolicy()`, which will automatically create a new resource
+ * policy if one doesn't exist yet, otherwise it will add to the existing
+ * policy.
+ *
+ * The bucket policy method is implemented differently than `addToResourcePolicy()`
+ * as `BucketPolicy()` creates a new policy without knowing one earlier existed.
+ * e.g. if during Bucket creation, if `autoDeleteObject:true`, these policies are
+ * added to the bucket policy:
+ *    ["s3:DeleteObject*", "s3:GetBucket*", "s3:List*", "s3:PutBucketPolicy"],
+ * and when you add a new BucketPolicy with ["s3:GetObject", "s3:ListBucket"] on
+ * this existing bucket, invoking `BucketPolicy()` will create a new Policy
+ * without knowing one earlier exists already, so it creates a new one.
+ * In this case, the custom resource handler will not have access to
+ * `s3:GetBucketTagging` action which will cause failure during deletion of stack.
+ *
+ * Hence its strongly recommended to use `addToResourcePolicy()` method to add
+ * new permissions to existing policy.
+ *
+ */
+class BucketPolicy extends aws_construct_1.AwsConstructBase {
+    get outputs() {
+        return {};
+    }
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.bucket = props.bucket;
+        this.document = new iam_1.PolicyDocument(this, "Policy");
+        this.resource = new provider_aws_1.s3BucketPolicy.S3BucketPolicy(this, "Resource", {
+            bucket: this.bucket.bucketName,
+            policy: this.document.json,
+        });
+    }
+}
+exports.BucketPolicy = BucketPolicy;
+_a = JSII_RTTI_SYMBOL_1;
+BucketPolicy[_a] = { fqn: "terraconstructs.aws.storage.BucketPolicy", version: "0.0.8" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVja2V0LXBvbGljeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9hd3Mvc3RvcmFnZS9idWNrZXQtcG9saWN5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsc0RBQXFEO0FBRXJELG9EQUF1RTtBQUV2RSxnQ0FBd0M7QUFTeEM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBMEJHO0FBQ0gsTUFBYSxZQUFhLFNBQVEsZ0NBQWdCO0lBR2hELElBQVcsT0FBTztRQUNoQixPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFZRCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXdCO1FBQ2hFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsSUFBSSxDQUFDLE1BQU0sR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQzNCLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxvQkFBYyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQztRQUVuRCxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksNkJBQWMsQ0FBQyxjQUFjLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRTtZQUNsRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVO1lBQzlCLE1BQU0sRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUk7U0FDM0IsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUEzQkgsb0NBNEJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgczNCdWNrZXRQb2xpY3kgfSBmcm9tIFwiQGNka3RmL3Byb3ZpZGVyLWF3c1wiO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcbmltcG9ydCB7IEF3c0NvbnN0cnVjdFByb3BzLCBBd3NDb25zdHJ1Y3RCYXNlIH0gZnJvbSBcIi4uL2F3cy1jb25zdHJ1Y3RcIjtcbmltcG9ydCB7IElCdWNrZXQgfSBmcm9tIFwiLi9idWNrZXRcIjtcbmltcG9ydCB7IFBvbGljeURvY3VtZW50IH0gZnJvbSBcIi4uL2lhbVwiO1xuXG5leHBvcnQgaW50ZXJmYWNlIEJ1Y2tldFBvbGljeVByb3BzIGV4dGVuZHMgQXdzQ29uc3RydWN0UHJvcHMge1xuICAvKipcbiAgICogVGhlIEFtYXpvbiBTMyBidWNrZXQgdGhhdCB0aGUgcG9saWN5IGFwcGxpZXMgdG8uXG4gICAqL1xuICByZWFkb25seSBidWNrZXQ6IElCdWNrZXQ7XG59XG5cbi8qKlxuICogVGhlIGJ1Y2tldCBwb2xpY3kgZm9yIGFuIEFtYXpvbiBTMyBidWNrZXRcbiAqXG4gKiBQb2xpY2llcyBkZWZpbmUgdGhlIG9wZXJhdGlvbnMgdGhhdCBhcmUgYWxsb3dlZCBvbiB0aGlzIHJlc291cmNlLlxuICpcbiAqIFlvdSBhbG1vc3QgbmV2ZXIgbmVlZCB0byBkZWZpbmUgdGhpcyBjb25zdHJ1Y3QgZGlyZWN0bHkuXG4gKlxuICogQWxsIEFXUyByZXNvdXJjZXMgdGhhdCBzdXBwb3J0IHJlc291cmNlIHBvbGljaWVzIGhhdmUgYSBtZXRob2QgY2FsbGVkXG4gKiBgYWRkVG9SZXNvdXJjZVBvbGljeSgpYCwgd2hpY2ggd2lsbCBhdXRvbWF0aWNhbGx5IGNyZWF0ZSBhIG5ldyByZXNvdXJjZVxuICogcG9saWN5IGlmIG9uZSBkb2Vzbid0IGV4aXN0IHlldCwgb3RoZXJ3aXNlIGl0IHdpbGwgYWRkIHRvIHRoZSBleGlzdGluZ1xuICogcG9saWN5LlxuICpcbiAqIFRoZSBidWNrZXQgcG9saWN5IG1ldGhvZCBpcyBpbXBsZW1lbnRlZCBkaWZmZXJlbnRseSB0aGFuIGBhZGRUb1Jlc291cmNlUG9saWN5KClgXG4gKiBhcyBgQnVja2V0UG9saWN5KClgIGNyZWF0ZXMgYSBuZXcgcG9saWN5IHdpdGhvdXQga25vd2luZyBvbmUgZWFybGllciBleGlzdGVkLlxuICogZS5nLiBpZiBkdXJpbmcgQnVja2V0IGNyZWF0aW9uLCBpZiBgYXV0b0RlbGV0ZU9iamVjdDp0cnVlYCwgdGhlc2UgcG9saWNpZXMgYXJlXG4gKiBhZGRlZCB0byB0aGUgYnVja2V0IHBvbGljeTpcbiAqICAgIFtcInMzOkRlbGV0ZU9iamVjdCpcIiwgXCJzMzpHZXRCdWNrZXQqXCIsIFwiczM6TGlzdCpcIiwgXCJzMzpQdXRCdWNrZXRQb2xpY3lcIl0sXG4gKiBhbmQgd2hlbiB5b3UgYWRkIGEgbmV3IEJ1Y2tldFBvbGljeSB3aXRoIFtcInMzOkdldE9iamVjdFwiLCBcInMzOkxpc3RCdWNrZXRcIl0gb25cbiAqIHRoaXMgZXhpc3RpbmcgYnVja2V0LCBpbnZva2luZyBgQnVja2V0UG9saWN5KClgIHdpbGwgY3JlYXRlIGEgbmV3IFBvbGljeVxuICogd2l0aG91dCBrbm93aW5nIG9uZSBlYXJsaWVyIGV4aXN0cyBhbHJlYWR5LCBzbyBpdCBjcmVhdGVzIGEgbmV3IG9uZS5cbiAqIEluIHRoaXMgY2FzZSwgdGhlIGN1c3RvbSByZXNvdXJjZSBoYW5kbGVyIHdpbGwgbm90IGhhdmUgYWNjZXNzIHRvXG4gKiBgczM6R2V0QnVja2V0VGFnZ2luZ2AgYWN0aW9uIHdoaWNoIHdpbGwgY2F1c2UgZmFpbHVyZSBkdXJpbmcgZGVsZXRpb24gb2Ygc3RhY2suXG4gKlxuICogSGVuY2UgaXRzIHN0cm9uZ2x5IHJlY29tbWVuZGVkIHRvIHVzZSBgYWRkVG9SZXNvdXJjZVBvbGljeSgpYCBtZXRob2QgdG8gYWRkXG4gKiBuZXcgcGVybWlzc2lvbnMgdG8gZXhpc3RpbmcgcG9saWN5LlxuICpcbiAqL1xuZXhwb3J0IGNsYXNzIEJ1Y2tldFBvbGljeSBleHRlbmRzIEF3c0NvbnN0cnVjdEJhc2Uge1xuICAvLyBUT0RPOiByZS1hZGQgc3RhdGljIGZyb20gTWV0aG9kXG4gIHB1YmxpYyByZWFkb25seSByZXNvdXJjZTogczNCdWNrZXRQb2xpY3kuUzNCdWNrZXRQb2xpY3k7XG4gIHB1YmxpYyBnZXQgb3V0cHV0cygpOiBSZWNvcmQ8c3RyaW5nLCBhbnk+IHtcbiAgICByZXR1cm4ge307XG4gIH1cblxuICAvKipcbiAgICogQSBwb2xpY3kgZG9jdW1lbnQgY29udGFpbmluZyBwZXJtaXNzaW9ucyB0byBhZGQgdG8gdGhlIHNwZWNpZmllZCBidWNrZXQuXG4gICAqIEZvciBtb3JlIGluZm9ybWF0aW9uLCBzZWUgQWNjZXNzIFBvbGljeSBMYW5ndWFnZSBPdmVydmlldyBpbiB0aGUgQW1hem9uXG4gICAqIFNpbXBsZSBTdG9yYWdlIFNlcnZpY2UgRGV2ZWxvcGVyIEd1aWRlLlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGRvY3VtZW50OiBQb2xpY3lEb2N1bWVudDtcblxuICAvKiogVGhlIEJ1Y2tldCB0aGlzIFBvbGljeSBhcHBsaWVzIHRvLiAqL1xuICBwdWJsaWMgcmVhZG9ubHkgYnVja2V0OiBJQnVja2V0O1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBCdWNrZXRQb2xpY3lQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICB0aGlzLmJ1Y2tldCA9IHByb3BzLmJ1Y2tldDtcbiAgICB0aGlzLmRvY3VtZW50ID0gbmV3IFBvbGljeURvY3VtZW50KHRoaXMsIFwiUG9saWN5XCIpO1xuXG4gICAgdGhpcy5yZXNvdXJjZSA9IG5ldyBzM0J1Y2tldFBvbGljeS5TM0J1Y2tldFBvbGljeSh0aGlzLCBcIlJlc291cmNlXCIsIHtcbiAgICAgIGJ1Y2tldDogdGhpcy5idWNrZXQuYnVja2V0TmFtZSxcbiAgICAgIHBvbGljeTogdGhpcy5kb2N1bWVudC5qc29uLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/aws/storage/bucket-source.d.ts

@@ -0,0 +1,41 @@
+import { s3Object } from "@cdktf/provider-aws";
+import { Construct } from "constructs";
+import { IBucket, AddSourceOptions } from ".";
+import { AwsConstructBase, IAwsConstruct, AwsConstructProps } from "../aws-construct";
+export interface BucketSourceProps extends AddSourceOptions, AwsConstructProps {
+    /**
+     * Target bucket to upload to
+     */
+    readonly bucket: IBucket;
+}
+export interface BucketObjectOutput {
+    /**
+     * The object source Hash
+     */
+    readonly sourceHash: string;
+}
+export interface BucketSourceOutputs {
+    /**
+     * The objects uploaded to the bucket indexed by key
+     */
+    readonly objects: Record<string, BucketObjectOutput>;
+}
+export interface IBucketSource extends IAwsConstruct {
+    readonly bucketSourceOutputs: BucketSourceOutputs;
+}
+/**
+ * A Bucket Source which reads files from disk and creates uploads to s3.
+ */
+export declare class BucketSource extends AwsConstructBase implements IBucketSource {
+    readonly objects: s3Object.S3Object[];
+    private readonly _bucketSourceOutputs;
+    get bucketSourceOutputs(): BucketSourceOutputs;
+    get outputs(): Record<string, any>;
+    private readonly dependsOn;
+    private readonly resolvedPath;
+    private readonly prefix;
+    private _bucket;
+    constructor(scope: Construct, id: string, props: BucketSourceProps);
+    private uploadAssetDir;
+    private uploadAssetFile;
+}

package/lib/aws/storage/bucket-source.js

@@ -0,0 +1,79 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BucketSource = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const fs = require("fs");
+const path = require("path");
+const provider_aws_1 = require("@cdktf/provider-aws");
+const cdktf_1 = require("cdktf");
+const mime = require("mime-types");
+const _1 = require(".");
+const aws_construct_1 = require("../aws-construct");
+/**
+ * A Bucket Source which reads files from disk and creates uploads to s3.
+ */
+class BucketSource extends aws_construct_1.AwsConstructBase {
+    get bucketSourceOutputs() {
+        return this._bucketSourceOutputs;
+    }
+    get outputs() {
+        return this.bucketSourceOutputs;
+    }
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        this.objects = [];
+        this.dependsOn = [];
+        const { bucket, path: sourcePath, prefix } = props;
+        this._bucket = bucket;
+        this.dependsOn = props.dependsOn ?? [];
+        // should we support absolute paths? path.isAbsolute(props.path)?
+        this.resolvedPath = path.resolve(sourcePath);
+        this.prefix = prefix ?? "";
+        const asset = new cdktf_1.TerraformAsset(this, "PathAsset", {
+            path: this.resolvedPath,
+            type: cdktf_1.AssetType.DIRECTORY,
+        });
+        this.uploadAssetDir(sourcePath, asset.path);
+        this._bucketSourceOutputs = {
+            objects: this.objects.reduce((acc, obj) => {
+                acc[obj.key] = {
+                    sourceHash: obj.sourceHash,
+                };
+                return acc;
+            }, {}),
+        };
+    }
+    // TODO: Handle deployments with custom lambdas instead?
+    // https://github.com/aws/aws-cdk/blob/9946ab03672bf6664e8ec95a81ddb67c3bb2f63b/packages/%40aws-cdk/custom-resource-handlers/lib/aws-s3-deployment/bucket-deployment-handler/index.py
+    uploadAssetDir(basePath, assetPath) {
+        const files = fs.readdirSync(basePath, { withFileTypes: true });
+        for (const file of files) {
+            const baseFilename = path.join(basePath, file.name);
+            const assetFilename = path.join(assetPath, file.name);
+            if (file.isDirectory()) {
+                this.uploadAssetDir(baseFilename, assetFilename);
+            }
+            else {
+                this.uploadAssetFile(baseFilename, assetFilename);
+            }
+        }
+    }
+    uploadAssetFile(basePath, assetPath) {
+        let relativePath = path.join(this.prefix, basePath.replace(this.resolvedPath, ""));
+        const fileKey = (0, _1.normalPath)(relativePath);
+        // copy from asset directory
+        this.objects.push(new provider_aws_1.s3Object.S3Object(this, `File${fileKey.replace(/\//g, "--")}`, {
+            key: fileKey,
+            bucket: this._bucket.bucketOutputs.name,
+            source: assetPath,
+            sourceHash: cdktf_1.Fn.filemd5(assetPath),
+            contentType: mime.contentType(path.extname(assetPath)) || undefined,
+            dependsOn: this.dependsOn.length > 0 ? this.dependsOn : undefined,
+        }));
+    }
+}
+exports.BucketSource = BucketSource;
+_a = JSII_RTTI_SYMBOL_1;
+BucketSource[_a] = { fqn: "terraconstructs.aws.storage.BucketSource", version: "0.0.8" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVja2V0LXNvdXJjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9hd3Mvc3RvcmFnZS9idWNrZXQtc291cmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEseUJBQXlCO0FBQ3pCLDZCQUE2QjtBQUM3QixzREFBK0M7QUFDL0MsaUNBQTRFO0FBRTVFLG1DQUFtQztBQUNuQyx3QkFBMEQ7QUFDMUQsb0RBSTBCO0FBMkIxQjs7R0FFRztBQUNILE1BQWEsWUFBYSxTQUFRLGdDQUFnQjtJQUloRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxvQkFBb0IsQ0FBQztJQUNuQyxDQUFDO0lBRUQsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLG1CQUFtQixDQUFDO0lBQ2xDLENBQUM7SUFPRCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXdCO1FBQ2hFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBakJWLFlBQU8sR0FBd0IsRUFBRSxDQUFDO1FBV2pDLGNBQVMsR0FBMkIsRUFBRSxDQUFDO1FBUXRELE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFbkQsSUFBSSxDQUFDLE9BQU8sR0FBRyxNQUFNLENBQUM7UUFDdEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQztRQUN2QyxpRUFBaUU7UUFFakUsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzdDLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQztRQUUzQixNQUFNLEtBQUssR0FBRyxJQUFJLHNCQUFjLENBQUMsSUFBSSxFQUFFLFdBQVcsRUFBRTtZQUNsRCxJQUFJLEVBQUUsSUFBSSxDQUFDLFlBQVk7WUFDdkIsSUFBSSxFQUFFLGlCQUFTLENBQUMsU0FBUztTQUMxQixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7UUFFNUMsSUFBSSxDQUFDLG9CQUFvQixHQUFHO1lBQzFCLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FDMUIsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEVBQUU7Z0JBQ1gsR0FBRyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsR0FBRztvQkFDYixVQUFVLEVBQUUsR0FBRyxDQUFDLFVBQVU7aUJBQzNCLENBQUM7Z0JBQ0YsT0FBTyxHQUFHLENBQUM7WUFDYixDQUFDLEVBQ0QsRUFBd0MsQ0FDekM7U0FDRixDQUFDO0lBQ0osQ0FBQztJQUVELHdEQUF3RDtJQUN4RCxxTEFBcUw7SUFDN0ssY0FBYyxDQUFDLFFBQWdCLEVBQUUsU0FBaUI7UUFDeEQsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDLFdBQVcsQ0FBQyxRQUFRLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNoRSxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ3pCLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUNwRCxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDdEQsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztnQkFDdkIsSUFBSSxDQUFDLGNBQWMsQ0FBQyxZQUFZLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDbkQsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLElBQUksQ0FBQyxlQUFlLENBQUMsWUFBWSxFQUFFLGFBQWEsQ0FBQyxDQUFDO1lBQ3BELENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLGVBQWUsQ0FBQyxRQUFnQixFQUFFLFNBQWlCO1FBQ3pELElBQUksWUFBWSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQzFCLElBQUksQ0FBQyxNQUFNLEVBQ1gsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyxDQUN4QyxDQUFDO1FBQ0YsTUFBTSxPQUFPLEdBQUcsSUFBQSxhQUFVLEVBQUMsWUFBWSxDQUFDLENBQUM7UUFFekMsNEJBQTRCO1FBQzVCLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUNmLElBQUksdUJBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLE9BQU8sT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEVBQUUsRUFBRTtZQUNqRSxHQUFHLEVBQUUsT0FBTztZQUNaLE1BQU0sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxJQUFJO1lBQ3ZDLE1BQU0sRUFBRSxTQUFTO1lBQ2pCLFVBQVUsRUFBRSxVQUFFLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQztZQUNqQyxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksU0FBUztZQUNuRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTO1NBQ2xFLENBQUMsQ0FDSCxDQUFDO0lBQ0osQ0FBQzs7QUFqRkgsb0NBa0ZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgZnMgZnJvbSBcImZzXCI7XG5pbXBvcnQgKiBhcyBwYXRoIGZyb20gXCJwYXRoXCI7XG5pbXBvcnQgeyBzM09iamVjdCB9IGZyb20gXCJAY2RrdGYvcHJvdmlkZXItYXdzXCI7XG5pbXBvcnQgeyBUZXJyYWZvcm1Bc3NldCwgQXNzZXRUeXBlLCBGbiwgSVRlcnJhZm9ybURlcGVuZGFibGUgfSBmcm9tIFwiY2RrdGZcIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5pbXBvcnQgKiBhcyBtaW1lIGZyb20gXCJtaW1lLXR5cGVzXCI7XG5pbXBvcnQgeyBub3JtYWxQYXRoLCBJQnVja2V0LCBBZGRTb3VyY2VPcHRpb25zIH0gZnJvbSBcIi5cIjtcbmltcG9ydCB7XG4gIEF3c0NvbnN0cnVjdEJhc2UsXG4gIElBd3NDb25zdHJ1Y3QsXG4gIEF3c0NvbnN0cnVjdFByb3BzLFxufSBmcm9tIFwiLi4vYXdzLWNvbnN0cnVjdFwiO1xuXG5leHBvcnQgaW50ZXJmYWNlIEJ1Y2tldFNvdXJjZVByb3BzIGV4dGVuZHMgQWRkU291cmNlT3B0aW9ucywgQXdzQ29uc3RydWN0UHJvcHMge1xuICAvKipcbiAgICogVGFyZ2V0IGJ1Y2tldCB0byB1cGxvYWQgdG9cbiAgICovXG4gIHJlYWRvbmx5IGJ1Y2tldDogSUJ1Y2tldDtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBCdWNrZXRPYmplY3RPdXRwdXQge1xuICAvKipcbiAgICogVGhlIG9iamVjdCBzb3VyY2UgSGFzaFxuICAgKi9cbiAgcmVhZG9ubHkgc291cmNlSGFzaDogc3RyaW5nO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIEJ1Y2tldFNvdXJjZU91dHB1dHMge1xuICAvKipcbiAgICogVGhlIG9iamVjdHMgdXBsb2FkZWQgdG8gdGhlIGJ1Y2tldCBpbmRleGVkIGJ5IGtleVxuICAgKi9cbiAgcmVhZG9ubHkgb2JqZWN0czogUmVjb3JkPHN0cmluZywgQnVja2V0T2JqZWN0T3V0cHV0Pjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBJQnVja2V0U291cmNlIGV4dGVuZHMgSUF3c0NvbnN0cnVjdCB7XG4gIHJlYWRvbmx5IGJ1Y2tldFNvdXJjZU91dHB1dHM6IEJ1Y2tldFNvdXJjZU91dHB1dHM7XG59XG5cbi8qKlxuICogQSBCdWNrZXQgU291cmNlIHdoaWNoIHJlYWRzIGZpbGVzIGZyb20gZGlzayBhbmQgY3JlYXRlcyB1cGxvYWRzIHRvIHMzLlxuICovXG5leHBvcnQgY2xhc3MgQnVja2V0U291cmNlIGV4dGVuZHMgQXdzQ29uc3RydWN0QmFzZSBpbXBsZW1lbnRzIElCdWNrZXRTb3VyY2Uge1xuICBwdWJsaWMgcmVhZG9ubHkgb2JqZWN0czogczNPYmplY3QuUzNPYmplY3RbXSA9IFtdO1xuXG4gIHByaXZhdGUgcmVhZG9ubHkgX2J1Y2tldFNvdXJjZU91dHB1dHM6IEJ1Y2tldFNvdXJjZU91dHB1dHM7XG4gIHB1YmxpYyBnZXQgYnVja2V0U291cmNlT3V0cHV0cygpOiBCdWNrZXRTb3VyY2VPdXRwdXRzIHtcbiAgICByZXR1cm4gdGhpcy5fYnVja2V0U291cmNlT3V0cHV0cztcbiAgfVxuXG4gIHB1YmxpYyBnZXQgb3V0cHV0cygpOiBSZWNvcmQ8c3RyaW5nLCBhbnk+IHtcbiAgICByZXR1cm4gdGhpcy5idWNrZXRTb3VyY2VPdXRwdXRzO1xuICB9XG5cbiAgcHJpdmF0ZSByZWFkb25seSBkZXBlbmRzT246IElUZXJyYWZvcm1EZXBlbmRhYmxlW10gPSBbXTtcbiAgcHJpdmF0ZSByZWFkb25seSByZXNvbHZlZFBhdGg6IHN0cmluZztcbiAgcHJpdmF0ZSByZWFkb25seSBwcmVmaXg6IHN0cmluZztcbiAgcHJpdmF0ZSBfYnVja2V0OiBJQnVja2V0O1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBCdWNrZXRTb3VyY2VQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwgcHJvcHMpO1xuXG4gICAgY29uc3QgeyBidWNrZXQsIHBhdGg6IHNvdXJjZVBhdGgsIHByZWZpeCB9ID0gcHJvcHM7XG5cbiAgICB0aGlzLl9idWNrZXQgPSBidWNrZXQ7XG4gICAgdGhpcy5kZXBlbmRzT24gPSBwcm9wcy5kZXBlbmRzT24gPz8gW107XG4gICAgLy8gc2hvdWxkIHdlIHN1cHBvcnQgYWJzb2x1dGUgcGF0aHM/IHBhdGguaXNBYnNvbHV0ZShwcm9wcy5wYXRoKT9cblxuICAgIHRoaXMucmVzb2x2ZWRQYXRoID0gcGF0aC5yZXNvbHZlKHNvdXJjZVBhdGgpO1xuICAgIHRoaXMucHJlZml4ID0gcHJlZml4ID8/IFwiXCI7XG5cbiAgICBjb25zdCBhc3NldCA9IG5ldyBUZXJyYWZvcm1Bc3NldCh0aGlzLCBcIlBhdGhBc3NldFwiLCB7XG4gICAgICBwYXRoOiB0aGlzLnJlc29sdmVkUGF0aCxcbiAgICAgIHR5cGU6IEFzc2V0VHlwZS5ESVJFQ1RPUlksXG4gICAgfSk7XG4gICAgdGhpcy51cGxvYWRBc3NldERpcihzb3VyY2VQYXRoLCBhc3NldC5wYXRoKTtcblxuICAgIHRoaXMuX2J1Y2tldFNvdXJjZU91dHB1dHMgPSB7XG4gICAgICBvYmplY3RzOiB0aGlzLm9iamVjdHMucmVkdWNlKFxuICAgICAgICAoYWNjLCBvYmopID0+IHtcbiAgICAgICAgICBhY2Nbb2JqLmtleV0gPSB7XG4gICAgICAgICAgICBzb3VyY2VIYXNoOiBvYmouc291cmNlSGFzaCxcbiAgICAgICAgICB9O1xuICAgICAgICAgIHJldHVybiBhY2M7XG4gICAgICAgIH0sXG4gICAgICAgIHt9IGFzIFJlY29yZDxzdHJpbmcsIEJ1Y2tldE9iamVjdE91dHB1dD4sXG4gICAgICApLFxuICAgIH07XG4gIH1cblxuICAvLyBUT0RPOiBIYW5kbGUgZGVwbG95bWVudHMgd2l0aCBjdXN0b20gbGFtYmRhcyBpbnN0ZWFkP1xuICAvLyBodHRwczovL2dpdGh1Yi5jb20vYXdzL2F3cy1jZGsvYmxvYi85OTQ2YWIwMzY3MmJmNjY2NGU4ZWM5NWE4MWRkYjY3YzNiYjJmNjNiL3BhY2thZ2VzLyU0MGF3cy1jZGsvY3VzdG9tLXJlc291cmNlLWhhbmRsZXJzL2xpYi9hd3MtczMtZGVwbG95bWVudC9idWNrZXQtZGVwbG95bWVudC1oYW5kbGVyL2luZGV4LnB5XG4gIHByaXZhdGUgdXBsb2FkQXNzZXREaXIoYmFzZVBhdGg6IHN0cmluZywgYXNzZXRQYXRoOiBzdHJpbmcpOiB2b2lkIHtcbiAgICBjb25zdCBmaWxlcyA9IGZzLnJlYWRkaXJTeW5jKGJhc2VQYXRoLCB7IHdpdGhGaWxlVHlwZXM6IHRydWUgfSk7XG4gICAgZm9yIChjb25zdCBmaWxlIG9mIGZpbGVzKSB7XG4gICAgICBjb25zdCBiYXNlRmlsZW5hbWUgPSBwYXRoLmpvaW4oYmFzZVBhdGgsIGZpbGUubmFtZSk7XG4gICAgICBjb25zdCBhc3NldEZpbGVuYW1lID0gcGF0aC5qb2luKGFzc2V0UGF0aCwgZmlsZS5uYW1lKTtcbiAgICAgIGlmIChmaWxlLmlzRGlyZWN0b3J5KCkpIHtcbiAgICAgICAgdGhpcy51cGxvYWRBc3NldERpcihiYXNlRmlsZW5hbWUsIGFzc2V0RmlsZW5hbWUpO1xuICAgICAgfSBlbHNlIHtcbiAgICAgICAgdGhpcy51cGxvYWRBc3NldEZpbGUoYmFzZUZpbGVuYW1lLCBhc3NldEZpbGVuYW1lKTtcbiAgICAgIH1cbiAgICB9XG4gIH1cblxuICBwcml2YXRlIHVwbG9hZEFzc2V0RmlsZShiYXNlUGF0aDogc3RyaW5nLCBhc3NldFBhdGg6IHN0cmluZykge1xuICAgIGxldCByZWxhdGl2ZVBhdGggPSBwYXRoLmpvaW4oXG4gICAgICB0aGlzLnByZWZpeCxcbiAgICAgIGJhc2VQYXRoLnJlcGxhY2UodGhpcy5yZXNvbHZlZFBhdGgsIFwiXCIpLFxuICAgICk7XG4gICAgY29uc3QgZmlsZUtleSA9IG5vcm1hbFBhdGgocmVsYXRpdmVQYXRoKTtcblxuICAgIC8vIGNvcHkgZnJvbSBhc3NldCBkaXJlY3RvcnlcbiAgICB0aGlzLm9iamVjdHMucHVzaChcbiAgICAgIG5ldyBzM09iamVjdC5TM09iamVjdCh0aGlzLCBgRmlsZSR7ZmlsZUtleS5yZXBsYWNlKC9cXC8vZywgXCItLVwiKX1gLCB7XG4gICAgICAgIGtleTogZmlsZUtleSxcbiAgICAgICAgYnVja2V0OiB0aGlzLl9idWNrZXQuYnVja2V0T3V0cHV0cy5uYW1lLFxuICAgICAgICBzb3VyY2U6IGFzc2V0UGF0aCxcbiAgICAgICAgc291cmNlSGFzaDogRm4uZmlsZW1kNShhc3NldFBhdGgpLFxuICAgICAgICBjb250ZW50VHlwZTogbWltZS5jb250ZW50VHlwZShwYXRoLmV4dG5hbWUoYXNzZXRQYXRoKSkgfHwgdW5kZWZpbmVkLFxuICAgICAgICBkZXBlbmRzT246IHRoaXMuZGVwZW5kc09uLmxlbmd0aCA+IDAgPyB0aGlzLmRlcGVuZHNPbiA6IHVuZGVmaW5lZCxcbiAgICAgIH0pLFxuICAgICk7XG4gIH1cbn1cbiJdfQ==