BucketBase L2 construct
Represents an S3 Bucket.
Buckets can be either defined within this stack:
new Bucket(this, 'MyBucket', { props });
Or imported from an existing bucket:
Bucket.import(this, 'MyImportedBucket', { bucketArn: ... });
You can also export a bucket and import it into another stack:
const ref = myBucket.export(); Bucket.import(this, 'MyImportedBucket', ref);
Initializer
new BucketBase(scope: Construct, id: string, props?: ResourceProps)
BucketBase(scope: Construct, id: str, props: typing.Optional[ResourceProps] = None)
new BucketBase(Construct scope, String id, ResourceProps props)
new BucketBase(Construct scope, string id, ResourceProps? props = null)
NewBucketBase(Scope Construct, Id *string, Props ResourceProps)
Construct Props
Default: the resource is in the same account as the stack it belongs to
environmentFromArnstringenvironment_from_arnstrenvironmentFromArnStringEnvironmentFromArnstringEnvironmentFromArn*string#Default: take environment from account, region parameters, or use Stack environment.
The ARN is parsed and the account and region are taken from the ARN. This should be used for imported resources.
Cannot be supplied together with either account or region.
Default: The physical name will be allocated by CloudFormation at deployment time
notes
undefinedimplies that a physical name will be allocated by CloudFormation during deployment.- a concrete value implies a specific physical name
PhysicalName.GENERATE_IF_NEEDEDis a marker that indicates that a physical will only be generated by the CDK if it is needed for cross-environment references. Otherwise, it will be allocated by CloudFormation.
Default: the resource is in the same region as the stack it belongs to
Properties
bucketDomainNamestringbucket_domain_namestrbucketDomainNameStringBucketDomainNamestringBucketDomainName*stringrequired#bucketDualStackDomainNamestringbucket_dual_stack_domain_namestrbucketDualStackDomainNameStringBucketDualStackDomainNamestringBucketDualStackDomainName*stringrequired#bucketRefBucketReferencebucket_refBucketReferencebucketRefBucketReferenceBucketRefBucketReferenceBucketRefBucketReferencerequired#bucketRegionalDomainNamestringbucket_regional_domain_namestrbucketRegionalDomainNameStringBucketRegionalDomainNamestringBucketRegionalDomainName*stringrequired#bucketWebsiteDomainNamestringbucket_website_domain_namestrbucketWebsiteDomainNameStringBucketWebsiteDomainNamestringBucketWebsiteDomainName*stringrequired#bucketWebsiteUrlstringbucket_website_urlstrbucketWebsiteUrlStringBucketWebsiteUrlstringBucketWebsiteUrl*stringrequired#disallowPublicAccessbooleandisallow_public_accessbooldisallowPublicAccessBooleanDisallowPublicAccessboolDisallowPublicAccess*bool#envResourceEnvironmentenvResourceEnvironmentenvResourceEnvironmentEnvResourceEnvironmentEnvResourceEnvironmentrequired#notes
For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.
For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.
If autoCreatePolicy is true, a BucketPolicy will be created upon the first call to addToResourcePolicy(s).
replicationRoleArnstringreplication_role_arnstrreplicationRoleArnStringReplicationRoleArnstringReplicationRoleArn*string#Methods
addEventNotification(event: EventType, dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_event_notification(self, event: EventType, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addEventNotification(EventType event, IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddEventNotification(EventType event, IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddEventNotification(Event EventType, Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#3 parameters · example
Parameters
eventeventeventeventEvent— The event to trigger the notification.destdestdestdestDest— The notification destination (Lambda, SNS Topic or SQS Queue).filtersfiltersfiltersfiltersFilters— S3 object key filter rules to determine which objects trigger this event.
declare const myLambda: lambda.Function;
const bucket = new s3.Bucket(this, 'MyBucket');
const filter: s3.NotificationKeyFilter = { prefix: 'home/myusername/*' };
bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.LambdaDestination(myLambda), filter);
addObjectCreatedNotification(dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_object_created_notification(self, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addObjectCreatedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddObjectCreatedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddObjectCreatedNotification(Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#This is identical to calling onEvent(EventType.OBJECT_CREATED).
2 parameters
Parameters
destdestdestdestDest— The notification destination (see onEvent).filtersfiltersfiltersfiltersFilters— Filters (see onEvent).
addObjectRemovedNotification(dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_object_removed_notification(self, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addObjectRemovedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddObjectRemovedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddObjectRemovedNotification(Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#This is identical to calling onEvent(EventType.OBJECT_REMOVED).
2 parameters
Parameters
destdestdestdestDest— The notification destination (see onEvent).filtersfiltersfiltersfiltersFilters— Filters (see onEvent).
addReplicationPolicy(roleArn: string, accessControlTransition?: boolean, account?: string): voiddef add_replication_policy(self, role_arn: str, access_control_transition: typing.Optional[bool] = None, account: typing.Optional[str] = None) -> Nonepublic void addReplicationPolicy(String roleArn, Boolean accessControlTransition, String account)public void AddReplicationPolicy(string roleArn, bool? accessControlTransition = null, string? account = null)func AddReplicationPolicy(RoleArn *string, AccessControlTransition *bool, Account *string)#notes · 3 parameters
Call this method on the destination bucket. If the destination bucket is a referenced bucket, its policy cannot be modified by CDK and the permissions must be added in the destination account.
To change replica ownership to the destination bucket owner, set accessControlTransition to true and provide the source bucket owner's account ID.
Parameters
roleArnrole_arnroleArnroleArnRoleArn— The ARN of the source bucket's replication role.accessControlTransitionaccess_control_transitionaccessControlTransitionaccessControlTransitionAccessControlTransition— Whether to change replica ownership to the destination bucket owner.accountaccountaccountaccountAccount— The source bucket owner's AWS account ID.
addToResourcePolicy(permission: PolicyStatement): AddToResourcePolicyResultdef add_to_resource_policy(self, permission: PolicyStatement) -> AddToResourcePolicyResultpublic AddToResourcePolicyResult addToResourcePolicy(PolicyStatement permission)public AddToResourcePolicyResult AddToResourcePolicy(PolicyStatement permission)func AddToResourcePolicy(Permission PolicyStatement) AddToResourcePolicyResult#notes · 1 parameter · returns
Note that the policy statement may or may not be added to the policy. For example, when an IBucket is created from an existing bucket, it's not possible to tell whether the bucket already has a policy attached, let alone to re-use that policy to add more statements to it. So it's safest to do nothing in these cases.
Parameters
permissionpermissionpermissionpermissionPermission— the policy statement to be added to the bucket's policy.
Returns: metadata about the execution of this method. If the policy was not added, the value of statementAdded will be false. You should always check this value to make sure that the operation was actually carried out. Otherwise, synthesis and deploy will terminate silently, which may be confusing.
applyCrossStackReferenceStrength(strength: ReferenceStrength): voiddef apply_cross_stack_reference_strength(self, strength: ReferenceStrength) -> Nonepublic void applyCrossStackReferenceStrength(ReferenceStrength strength)public void ApplyCrossStackReferenceStrength(ReferenceStrength strength)func ApplyCrossStackReferenceStrength(Strength ReferenceStrength)#notes · 1 parameter
When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the @aws-cdk/core:defaultCrossStackReferences context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default.
Parameters
strengthstrengthstrengthstrengthStrength— - The reference strength to use for this resource.
applyRemovalPolicy(policy: RemovalPolicy): voiddef apply_removal_policy(self, policy: RemovalPolicy) -> Nonepublic void applyRemovalPolicy(RemovalPolicy policy)public void ApplyRemovalPolicy(RemovalPolicy policy)func ApplyRemovalPolicy(Policy RemovalPolicy)#notes
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.
The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).
arnForObjects(keyPattern: string): stringdef arn_for_objects(self, key_pattern: str) -> strpublic String arnForObjects(String keyPattern)public string ArnForObjects(string keyPattern)func ArnForObjects(KeyPattern *string) *string#To represent all keys, specify "*".
If you need to specify a keyPattern with multiple components, concatenate them into a single string, e.g.:
arnForObjects(home/${team}/${user}/*)
enableEventBridgeNotification(): voiddef enable_event_bridge_notification(self, ) -> Nonepublic void enableEventBridgeNotification()public void EnableEventBridgeNotification()func EnableEventBridgeNotification()#notes
- Object Deleted (DeleteObject)
- Object Deleted (Lifecycle expiration)
- Object Restore Initiated
- Object Restore Completed
- Object Restore Expired
- Object Storage Class Changed
- Object Access Tier Changed
- Object ACL Updated
- Object Tags Added
- Object Tags Deleted
grantDelete(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_delete(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantDelete(IGrantable identity, Object objectsKeyPattern)public Grant GrantDelete(IGrantable identity, object? objectsKeyPattern = null)func GrantDelete(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#The use of this method is discouraged. Please use grants.delete() instead.
[disable-awslint:no-grants]
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantOnKey(grantee: IGrantable, ...actions: string[]): GrantOnKeyResultdef grant_on_key(self, grantee: IGrantable, actions: str) -> GrantOnKeyResultpublic GrantOnKeyResult grantOnKey(IGrantable grantee, String actions)public GrantOnKeyResult GrantOnKey(IGrantable grantee, string actions)func GrantOnKey(Grantee IGrantable, Actions *string) GrantOnKeyResult#grantPublicAccess(keyPrefix?: string, ...allowedActions: string[]): Grantdef grant_public_access(self, key_prefix: typing.Optional[str] = None, allowed_actions: str) -> Grantpublic Grant grantPublicAccess(String keyPrefix, String allowedActions)public Grant GrantPublicAccess(string? keyPrefix = null, string allowedActions)func GrantPublicAccess(KeyPrefix *string, AllowedActions *string) Grant#notes · 2 parameters
IMPORTANT: This permission allows anyone to perform actions on S3 objects in this bucket, which is useful for when you configure your bucket as a website and want everyone to be able to read objects in the bucket without needing to authenticate.
Without arguments, this method will grant read ("s3:GetObject") access to all objects ("*") in the bucket.
The method returns the iam.Grant object, which can then be modified as needed. For example, you can add a condition that will restrict access only to an IPv4 range like this:
const grant = bucket.grantPublicAccess();
grant.resourceStatement!.addCondition(‘IpAddress’, { “aws:SourceIp”: “54.240.143.0/24” });
Note that if this IBucket refers to an existing bucket, possibly not managed by CloudFormation, this method will have no effect, since it's impossible to modify the policy of an existing bucket.
The use of this method is discouraged. Please use grants.publicAccess() instead.
[disable-awslint:no-grants]
Parameters
keyPrefixkey_prefixkeyPrefixkeyPrefixKeyPrefix— the prefix of S3 object keys (e.g.home/*). Default is "*".allowedActionsallowed_actionsallowedActionsallowedActionsAllowedActions— the set of S3 actions to allow.
grantPut(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_put(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantPut(IGrantable identity, Object objectsKeyPattern)public Grant GrantPut(IGrantable identity, object? objectsKeyPattern = null)func GrantPut(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.
The use of this method is discouraged. Please use grants.put() instead.
[disable-awslint:no-grants]
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantPutAcl(identity: IGrantable, objectsKeyPattern?: string): Grantdef grant_put_acl(self, identity: IGrantable, objects_key_pattern: typing.Optional[str] = None) -> Grantpublic Grant grantPutAcl(IGrantable identity, String objectsKeyPattern)public Grant GrantPutAcl(IGrantable identity, string? objectsKeyPattern = null)func GrantPutAcl(Identity IGrantable, ObjectsKeyPattern *string) Grant#[disable-awslint:no-grants]
grantRead(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_read(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantRead(IGrantable identity, Object objectsKeyPattern)public Grant GrantRead(IGrantable identity, object? objectsKeyPattern = null)func GrantRead(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.
The use of this method is discouraged. Please use grants.read() instead.
[disable-awslint:no-grants]
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantReadWrite(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_read_write(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantReadWrite(IGrantable identity, Object objectsKeyPattern)public Grant GrantReadWrite(IGrantable identity, object? objectsKeyPattern = null)func GrantReadWrite(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#[disable-awslint:no-grants]
grantReplicationPermission(identity: IGrantable, props: GrantReplicationPermissionProps): Grantdef grant_replication_permission(self, identity: IGrantable, props: GrantReplicationPermissionProps) -> Grantpublic Grant grantReplicationPermission(IGrantable identity, GrantReplicationPermissionProps props)public Grant GrantReplicationPermission(IGrantable identity, GrantReplicationPermissionProps props)func GrantReplicationPermission(Identity IGrantable, Props GrantReplicationPermissionProps) Grant#notes · 2 parameters
Note that when calling this function for source or destination buckets that support KMS encryption, you need to specify the KMS key for encryption and the KMS key for decryption, respectively.
The use of this method is discouraged. Please use grants.replicationPermission() instead.
[disable-awslint:no-grants]
Parameters
identityidentityidentityidentityIdentity— The principal to grant replication permission to.propspropspropspropsProps— The properties of the replication source and destination buckets.
grantWrite(identity: IGrantable, objectsKeyPattern?: any, allowedActionPatterns?: string[]): Grantdef grant_write(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None, allowed_action_patterns: typing.Optional[typing.List[str]] = None) -> Grantpublic Grant grantWrite(IGrantable identity, Object objectsKeyPattern, List<String> allowedActionPatterns)public Grant GrantWrite(IGrantable identity, object? objectsKeyPattern = null, string[]? allowedActionPatterns = null)func GrantWrite(Identity IGrantable, ObjectsKeyPattern interface{}, AllowedActionPatterns *[]*string) Grant#[disable-awslint:no-grants]
isConstruct(x: any): boolean@staticmethod def is_construct(x: Any) -> boolpublic static Boolean isConstruct(Object x)public static bool IsConstruct(object x)func IsConstruct(X interface{}) *boolstatic#notes · 1 parameter · returns
Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.
Parameters
xxxxX— Any object.
Returns: true if x is an object created from a class which extends Construct.
isOwnedResource(construct: IConstruct): boolean@staticmethod def is_owned_resource(construct: IConstruct) -> boolpublic static Boolean isOwnedResource(IConstruct construct)public static bool IsOwnedResource(IConstruct construct)func IsOwnedResource(Construct IConstruct) *boolstatic#isResource(construct: IConstruct): boolean@staticmethod def is_resource(construct: IConstruct) -> boolpublic static Boolean isResource(IConstruct construct)public static bool IsResource(IConstruct construct)func IsResource(Construct IConstruct) *boolstatic#onCloudTrailEvent(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_event(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailEvent(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailEvent(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailEvent(Id *string, Options OnCloudTrailBucketEventOptions) Rule#Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
2 parameters
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
onCloudTrailPutObject(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_put_object(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailPutObject(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailPutObject(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailPutObject(Id *string, Options OnCloudTrailBucketEventOptions) Rule#notes · 2 parameters
Note that some tools like aws s3 cp will automatically use either PutObject or the multipart upload API depending on the file size, so using onCloudTrailWriteObject may be preferable.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
onCloudTrailWriteObject(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_write_object(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailWriteObject(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailWriteObject(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailWriteObject(Id *string, Options OnCloudTrailBucketEventOptions) Rule#notes · 2 parameters
This includes the events PutObject, CopyObject, and CompleteMultipartUpload.
Note that some tools like aws s3 cp will automatically use either PutObject or the multipart upload API depending on the file size, so using this method may be preferable to onCloudTrailPutObject.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
s3UrlForObject(key?: string): stringdef s3_url_for_object(self, key: typing.Optional[str] = None) -> strpublic String s3UrlForObject(String key)public string S3UrlForObject(string? key = null)func S3UrlForObject(Key *string) *string#s3://onlybuckets3://bucket/key
1 parameter · returns
Parameters
keykeykeykeyKey— The S3 key of the object.
Returns: an ObjectS3Url token
toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#transferAccelerationUrlForObject(key?: string, options?: TransferAccelerationUrlOptions): stringdef transfer_acceleration_url_for_object(self, key: typing.Optional[str] = None, options: typing.Optional[TransferAccelerationUrlOptions] = None) -> strpublic String transferAccelerationUrlForObject(String key, TransferAccelerationUrlOptions options)public string TransferAccelerationUrlForObject(string? key = null, TransferAccelerationUrlOptions? options = null)func TransferAccelerationUrlForObject(Key *string, Options TransferAccelerationUrlOptions) *string#Specify dualStack: true at the options for dual-stack endpoint (connect to the bucket over IPv6). For example:
https://bucket---s3-accelerate.amazonaws.com.rproxy.govskope.cahttps://bucket.s3-accelerate.amazonaws.com/key
2 parameters · returns
Parameters
keykeykeykeyKey— The S3 key of the object.optionsoptionsoptionsoptionsOptions— Options for generating URL.
Returns: an TransferAccelerationUrl token
urlForObject(key?: string): stringdef url_for_object(self, key: typing.Optional[str] = None) -> strpublic String urlForObject(String key)public string UrlForObject(string? key = null)func UrlForObject(Key *string) *string#https://s3.us-west-1.amazonaws.com/onlybuckethttps://s3.us-west-1.amazonaws.com/bucket/keyhttps://s3---cn-north-1.amazonaws.com.rproxy.govskope.ca.cn/china-bucket/mykey
1 parameter · returns
Parameters
keykeykeykeyKey— The S3 key of the object.
Returns: an ObjectS3Url token
virtualHostedUrlForObject(key?: string, options?: VirtualHostedStyleUrlOptions): stringdef virtual_hosted_url_for_object(self, key: typing.Optional[str] = None, options: typing.Optional[VirtualHostedStyleUrlOptions] = None) -> strpublic String virtualHostedUrlForObject(String key, VirtualHostedStyleUrlOptions options)public string VirtualHostedUrlForObject(string? key = null, VirtualHostedStyleUrlOptions? options = null)func VirtualHostedUrlForObject(Key *string, Options VirtualHostedStyleUrlOptions) *string#https://only-bucket---s3---us-west-1.amazonaws.com.rproxy.govskope.cahttps://bucket.s3.us-west-1.amazonaws.com/keyhttps://bucket.s3.amazonaws.com/keyhttps://china-bucket---s3---cn-north-1.amazonaws.com.rproxy.govskope.ca.cn/mykey
2 parameters · returns
Parameters
keykeykeykeyKey— The S3 key of the object.optionsoptionsoptionsoptionsOptions— Options for generating URL.
Returns: an ObjectS3Url token
with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.