S3FilesOptions Struct
Options for mounting an S3 Files filesystem.
Example
ts
import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as s3files from 'aws-cdk-lib/aws-s3files';
const vpc = new ec2.Vpc(this, 'Vpc');
// Versioning is required — S3 Files relies on object versions for consistency.
const bucket = new s3.Bucket(this, 'Bucket', { versioned: true });
// S3 Files assumes this role to sync data between S3 and the file system.
const role = new iam.Role(this, 'S3FilesRole', {
assumedBy: new iam.ServicePrincipal('elasticfilesystem.amazonaws.com'),
});
// S3 permissions: read/write access to the bucket and objects
role.addToPolicy(new iam.PolicyStatement({
actions: ['s3:ListBucket*'],
resources: [bucket.bucketArn],
}));
role.addToPolicy(new iam.PolicyStatement({
actions: ['s3:AbortMultipartUpload', 's3:DeleteObject', 's3:GetObject*', 's3:List*', 's3:PutObject*'],
resources: [bucket.arnForObjects('*')],
}));
// EventBridge permissions: S3 Files creates rules prefixed "DO-NOT-DELETE-S3-Files"
// to detect S3 object changes and trigger data synchronization.
role.addToPolicy(new iam.PolicyStatement({
actions: [
'events:DeleteRule', 'events:DisableRule', 'events:EnableRule',
'events:PutRule', 'events:PutTargets', 'events:RemoveTargets',
],
resources: [`arn:${cdk.Aws.PARTITION}:events:*:*:rule/DO-NOT-DELETE-S3-Files*`],
conditions: { StringEquals: { 'events:ManagedBy': 'elasticfilesystem.amazonaws.com' } },
}));
role.addToPolicy(new iam.PolicyStatement({
actions: ['events:DescribeRule', 'events:ListRuleNamesByTarget', 'events:ListRules', 'events:ListTargetsByRule'],
resources: [`arn:${cdk.Aws.PARTITION}:events:*:*:rule/*`],
}));
const fileSystem = new s3files.CfnFileSystem(this, 'S3FilesFs', {
bucket: bucket.bucketArn,
roleArn: role.roleArn,
});
const sg = new ec2.SecurityGroup(this, 'MountTargetSG', { vpc });
// Create a mount target in each private subnet so Lambda can reach the file system via NFS.
vpc.privateSubnets.forEach((subnet, i) =>
new s3files.CfnMountTarget(this, `MountTarget${i}`, {
fileSystemId: fileSystem.attrFileSystemId,
subnetId: subnet.subnetId,
securityGroups: [sg.securityGroupId],
}),
);
// The access point defines the POSIX identity and root path Lambda uses on the file system.
const accessPoint = new s3files.CfnAccessPoint(this, 'AccessPoint', {
fileSystemId: fileSystem.attrFileSystemId,
rootDirectory: {
path: '/export/lambda',
creationPermissions: { ownerGid: '1001', ownerUid: '1001', permissions: '750' },
},
posixUser: { gid: '1001', uid: '1001' },
});
const fn = new lambda.Function(this, 'MyFunction', {
runtime: lambda.Runtime.NODEJS_LATEST,
handler: 'index.handler',
code: lambda.Code.fromAsset(path.join(__dirname, 'lambda-handler')),
vpc,
filesystem: lambda.FileSystem.fromS3FilesAccessPoint(accessPoint, '/mnt/s3files', {
// Enables direct reads and grants s3:GetObject/s3:GetObjectVersion on the bucket to the execution role.
directS3Read: lambda.DirectS3Read.enabled(bucket),
}),
});
python
import aws_cdk as cdk
import aws_cdk.aws_ec2 as ec2
import aws_cdk.aws_s3 as s3
import aws_cdk.aws_s3files as s3files
vpc = ec2.Vpc(self, "Vpc")
# Versioning is required — S3 Files relies on object versions for consistency.
bucket = s3.Bucket(self, "Bucket", versioned=True)
# S3 Files assumes this role to sync data between S3 and the file system.
role = iam.Role(self, "S3FilesRole",
assumed_by=iam.ServicePrincipal("elasticfilesystem.amazonaws.com")
)
# S3 permissions: read/write access to the bucket and objects
role.add_to_policy(iam.PolicyStatement(
actions=["s3:ListBucket*"],
resources=[bucket.bucket_arn]
))
role.add_to_policy(iam.PolicyStatement(
actions=["s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject*", "s3:List*", "s3:PutObject*"],
resources=[bucket.arn_for_objects("*")]
))
# EventBridge permissions: S3 Files creates rules prefixed "DO-NOT-DELETE-S3-Files"
# to detect S3 object changes and trigger data synchronization.
role.add_to_policy(iam.PolicyStatement(
actions=["events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets"
],
resources=[f"arn:{cdk.Aws.PARTITION}:events:*:*:rule/DO-NOT-DELETE-S3-Files*"],
conditions={"StringEquals": {"events:ManagedBy": "elasticfilesystem.amazonaws.com"}}
))
role.add_to_policy(iam.PolicyStatement(
actions=["events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule"],
resources=[f"arn:{cdk.Aws.PARTITION}:events:*:*:rule/*"]
))
file_system = s3files.CfnFileSystem(self, "S3FilesFs",
bucket=bucket.bucket_arn,
role_arn=role.role_arn
)
sg = ec2.SecurityGroup(self, "MountTargetSG", vpc=vpc)
# Create a mount target in each private subnet so Lambda can reach the file system via NFS.
vpc.private_subnets.for_each((subnet, i) =>
new s3files.CfnMountTarget(this, `MountTarget${i}`, {
fileSystemId: fileSystem.attrFileSystemId,
subnetId: subnet.subnetId,
securityGroups: [sg.securityGroupId],
}))
# The access point defines the POSIX identity and root path Lambda uses on the file system.
access_point = s3files.CfnAccessPoint(self, "AccessPoint",
file_system_id=file_system.attr_file_system_id,
root_directory=s3files.CfnAccessPoint.RootDirectoryProperty(
path="/export/lambda",
creation_permissions=s3files.CfnAccessPoint.CreationPermissionsProperty(owner_gid="1001", owner_uid="1001", permissions="750")
),
posix_user=s3files.CfnAccessPoint.PosixUserProperty(gid="1001", uid="1001")
)
fn = lambda_.Function(self, "MyFunction",
runtime=lambda_.Runtime.NODEJS_LATEST,
handler="index.handler",
code=lambda_.Code.from_asset(path.join(__dirname, "lambda-handler")),
vpc=vpc,
filesystem=lambda_.FileSystem.from_s3_files_access_point(access_point, "/mnt/s3files",
# Enables direct reads and grants s3:GetObject/s3:GetObjectVersion on the bucket to the execution role.
direct_s3_read=lambda_.DirectS3Read.enabled(bucket)
)
)
java
import software.amazon.awscdk.*;
import software.amazon.awscdk.services.ec2.*;
import software.amazon.awscdk.services.s3.*;
import software.amazon.awscdk.services.s3files.*;
Vpc vpc = new Vpc(this, "Vpc");
// Versioning is required — S3 Files relies on object versions for consistency.
Bucket bucket = Bucket.Builder.create(this, "Bucket").versioned(true).build();
// S3 Files assumes this role to sync data between S3 and the file system.
Role role = Role.Builder.create(this, "S3FilesRole")
.assumedBy(new ServicePrincipal("elasticfilesystem.amazonaws.com"))
.build();
// S3 permissions: read/write access to the bucket and objects
role.addToPolicy(PolicyStatement.Builder.create()
.actions(List.of("s3:ListBucket*"))
.resources(List.of(bucket.getBucketArn()))
.build());
role.addToPolicy(PolicyStatement.Builder.create()
.actions(List.of("s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject*", "s3:List*", "s3:PutObject*"))
.resources(List.of(bucket.arnForObjects("*")))
.build());
// EventBridge permissions: S3 Files creates rules prefixed "DO-NOT-DELETE-S3-Files"
// to detect S3 object changes and trigger data synchronization.
role.addToPolicy(PolicyStatement.Builder.create()
.actions(List.of("events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets"))
.resources(List.of(String.format("arn:%s:events:*:*:rule/DO-NOT-DELETE-S3-Files*", Aws.PARTITION)))
.conditions(Map.of("StringEquals", Map.of("events:ManagedBy", "elasticfilesystem.amazonaws.com")))
.build());
role.addToPolicy(PolicyStatement.Builder.create()
.actions(List.of("events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule"))
.resources(List.of(String.format("arn:%s:events:*:*:rule/*", Aws.PARTITION)))
.build());
CfnFileSystem fileSystem = CfnFileSystem.Builder.create(this, "S3FilesFs")
.bucket(bucket.getBucketArn())
.roleArn(role.getRoleArn())
.build();
SecurityGroup sg = SecurityGroup.Builder.create(this, "MountTargetSG").vpc(vpc).build();
// Create a mount target in each private subnet so Lambda can reach the file system via NFS.
vpc.privateSubnets.forEach((subnet, i) =>
new s3files.CfnMountTarget(this, `MountTarget${i}`, {
fileSystemId: fileSystem.attrFileSystemId,
subnetId: subnet.subnetId,
securityGroups: [sg.securityGroupId],
}));
// The access point defines the POSIX identity and root path Lambda uses on the file system.
CfnAccessPoint accessPoint = CfnAccessPoint.Builder.create(this, "AccessPoint")
.fileSystemId(fileSystem.getAttrFileSystemId())
.rootDirectory(RootDirectoryProperty.builder()
.path("/export/lambda")
.creationPermissions(CreationPermissionsProperty.builder().ownerGid("1001").ownerUid("1001").permissions("750").build())
.build())
.posixUser(PosixUserProperty.builder().gid("1001").uid("1001").build())
.build();
Function fn = Function.Builder.create(this, "MyFunction")
.runtime(Runtime.NODEJS_LATEST)
.handler("index.handler")
.code(Code.fromAsset(join(__dirname, "lambda-handler")))
.vpc(vpc)
.filesystem(FileSystem.fromS3FilesAccessPoint(accessPoint, "/mnt/s3files", S3FilesOptions.builder()
// Enables direct reads and grants s3:GetObject/s3:GetObjectVersion on the bucket to the execution role.
.directS3Read(DirectS3Read.enabled(bucket))
.build()))
.build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
using Amazon.CDK;
using Amazon.CDK.AWS.EC2;
using Amazon.CDK.AWS.S3;
using Amazon.CDK.AWS.S3Files;
var vpc = new Vpc(this, "Vpc");
// Versioning is required — S3 Files relies on object versions for consistency.
var bucket = new Bucket(this, "Bucket", new BucketProps { Versioned = true });
// S3 Files assumes this role to sync data between S3 and the file system.
var role = new Role(this, "S3FilesRole", new RoleProps {
AssumedBy = new ServicePrincipal("elasticfilesystem.amazonaws.com")
});
// S3 permissions: read/write access to the bucket and objects
role.AddToPolicy(new PolicyStatement(new PolicyStatementProps {
Actions = new [] { "s3:ListBucket*" },
Resources = new [] { bucket.BucketArn }
}));
role.AddToPolicy(new PolicyStatement(new PolicyStatementProps {
Actions = new [] { "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject*", "s3:List*", "s3:PutObject*" },
Resources = new [] { bucket.ArnForObjects("*") }
}));
// EventBridge permissions: S3 Files creates rules prefixed "DO-NOT-DELETE-S3-Files"
// to detect S3 object changes and trigger data synchronization.
role.AddToPolicy(new PolicyStatement(new PolicyStatementProps {
Actions = new [] { "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" },
Resources = new [] { $"arn:{cdk.Aws.PARTITION}:events:*:*:rule/DO-NOT-DELETE-S3-Files*" },
Conditions = new Dictionary<string, object> { { "StringEquals", new Dictionary<string, string> { { "events:ManagedBy", "elasticfilesystem.amazonaws.com" } } } }
}));
role.AddToPolicy(new PolicyStatement(new PolicyStatementProps {
Actions = new [] { "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule" },
Resources = new [] { $"arn:{cdk.Aws.PARTITION}:events:*:*:rule/*" }
}));
var fileSystem = new CfnFileSystem(this, "S3FilesFs", new CfnFileSystemProps {
Bucket = bucket.BucketArn,
RoleArn = role.RoleArn
});
var sg = new SecurityGroup(this, "MountTargetSG", new SecurityGroupProps { Vpc = vpc });
// Create a mount target in each private subnet so Lambda can reach the file system via NFS.
vpc.PrivateSubnets.ForEach((subnet, i) =>
new s3files.CfnMountTarget(this, `MountTarget${i}`, {
fileSystemId: fileSystem.attrFileSystemId,
subnetId: subnet.subnetId,
securityGroups: [sg.securityGroupId],
}));
// The access point defines the POSIX identity and root path Lambda uses on the file system.
var accessPoint = new CfnAccessPoint(this, "AccessPoint", new CfnAccessPointProps {
FileSystemId = fileSystem.AttrFileSystemId,
RootDirectory = new RootDirectoryProperty {
Path = "/export/lambda",
CreationPermissions = new CreationPermissionsProperty { OwnerGid = "1001", OwnerUid = "1001", Permissions = "750" }
},
PosixUser = new PosixUserProperty { Gid = "1001", Uid = "1001" }
});
var fn = new Function(this, "MyFunction", new FunctionProps {
Runtime = Runtime.NODEJS_LATEST,
Handler = "index.handler",
Code = Code.FromAsset(Join(__dirname, "lambda-handler")),
Vpc = vpc,
Filesystem = FileSystem.FromS3FilesAccessPoint(accessPoint, "/mnt/s3files", new S3FilesOptions {
// Enables direct reads and grants s3:GetObject/s3:GetObjectVersion on the bucket to the execution role.
DirectS3Read = DirectS3Read.Enabled(bucket)
})
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"
import s3 "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"
vpc := ec2.NewVpc(this, jsii.String("Vpc"))
// Versioning is required — S3 Files relies on object versions for consistency.
bucket := s3.NewBucket(this, jsii.String("Bucket"), &BucketProps{
Versioned: jsii.Boolean(true),
})
// S3 Files assumes this role to sync data between S3 and the file system.
role := iam.NewRole(this, jsii.String("S3FilesRole"), &RoleProps{
AssumedBy: iam.NewServicePrincipal(jsii.String("elasticfilesystem.amazonaws.com")),
})
// S3 permissions: read/write access to the bucket and objects
role.AddToPolicy(iam.NewPolicyStatement(&PolicyStatementProps{
Actions: []*string{
jsii.String("s3:ListBucket*"),
},
Resources: []*string{
bucket.bucketArn,
},
}))
role.AddToPolicy(iam.NewPolicyStatement(&PolicyStatementProps{
Actions: []*string{
jsii.String("s3:AbortMultipartUpload"),
jsii.String("s3:DeleteObject"),
jsii.String("s3:GetObject*"),
jsii.String("s3:List*"),
jsii.String("s3:PutObject*"),
},
Resources: []*string{
bucket.ArnForObjects(jsii.String("*")),
},
}))
// EventBridge permissions: S3 Files creates rules prefixed "DO-NOT-DELETE-S3-Files"
// to detect S3 object changes and trigger data synchronization.
role.AddToPolicy(iam.NewPolicyStatement(&PolicyStatementProps{
Actions: []*string{
jsii.String("events:DeleteRule"),
jsii.String("events:DisableRule"),
jsii.String("events:EnableRule"),
jsii.String("events:PutRule"),
jsii.String("events:PutTargets"),
jsii.String("events:RemoveTargets"),
},
Resources: []*string{
fmt.Sprintf("arn:%v:events:*:*:rule/DO-NOT-DELETE-S3-Files*", cdk.Aws_PARTITION()),
},
Conditions: map[string]interface{}{
"StringEquals": map[string]*string{
"events:ManagedBy": jsii.String("elasticfilesystem.amazonaws.com"),
},
},
}))
role.AddToPolicy(iam.NewPolicyStatement(&PolicyStatementProps{
Actions: []*string{
jsii.String("events:DescribeRule"),
jsii.String("events:ListRuleNamesByTarget"),
jsii.String("events:ListRules"),
jsii.String("events:ListTargetsByRule"),
},
Resources: []*string{
fmt.Sprintf("arn:%v:events:*:*:rule/*", cdk.Aws_PARTITION()),
},
}))
fileSystem := s3files.NewCfnFileSystem(this, jsii.String("S3FilesFs"), &CfnFileSystemProps{
Bucket: bucket.bucketArn,
RoleArn: role.roleArn,
})
sg := ec2.NewSecurityGroup(this, jsii.String("MountTargetSG"), &SecurityGroupProps{
Vpc: Vpc,
})
// Create a mount target in each private subnet so Lambda can reach the file system via NFS.
vpc.PrivateSubnets.forEach((subnet, i) =>
new s3files.CfnMountTarget(this, `MountTarget${i}`, {
fileSystemId: fileSystem.attrFileSystemId,
subnetId: subnet.subnetId,
securityGroups: [sg.securityGroupId],
}))
// The access point defines the POSIX identity and root path Lambda uses on the file system.
accessPoint := s3files.NewCfnAccessPoint(this, jsii.String("AccessPoint"), &CfnAccessPointProps{
FileSystemId: fileSystem.attrFileSystemId,
RootDirectory: &RootDirectoryProperty{
Path: jsii.String("/export/lambda"),
CreationPermissions: &CreationPermissionsProperty{
OwnerGid: jsii.String("1001"),
OwnerUid: jsii.String("1001"),
Permissions: jsii.String("750"),
},
},
PosixUser: &PosixUserProperty{
Gid: jsii.String("1001"),
Uid: jsii.String("1001"),
},
})
fn := lambda.NewFunction(this, jsii.String("MyFunction"), &FunctionProps{
Runtime: lambda.Runtime_NODEJS_LATEST(),
Handler: jsii.String("index.handler"),
Code: lambda.Code_FromAsset(path.join(__dirname, jsii.String("lambda-handler"))),
Vpc: Vpc,
Filesystem: lambda.FileSystem_FromS3FilesAccessPoint(accessPoint, jsii.String("/mnt/s3files"), &S3FilesOptions{
// Enables direct reads and grants s3:GetObject/s3:GetObjectVersion on the bucket to the execution role.
DirectS3Read: lambda.DirectS3Read_Enabled(bucket),
}),
})
Properties
directS3ReadoptionalDirectS3Readdirect_s3_readoptionalDirectS3ReaddirectS3ReadoptionalDirectS3ReadDirectS3ReadoptionalDirectS3ReadDirectS3ReadoptionalDirectS3Read#The DirectS3Read configuration for the S3 Files filesystem.
Default: DirectS3Read is not set. The service default is AUTO.
Use DirectS3Read.enabled(bucket), DirectS3Read.enabledWithoutGrant(), DirectS3Read.auto(), or DirectS3Read.disabled() to control whether Lambda reads objects directly from S3 instead of through the mount.