BucketGrants Facade
Collection of grant methods for a Bucket.
Example
ts
declare const principal: iam.IPrincipal;
declare const bucket: s3.IBucketRef;
s3.BucketGrants.fromBucket(bucket).delete(principal);
Methods
actionsOnBucketAndObjectKeys(identity: IGrantable, objectsKeyPattern?: string, ...actions: string[]): Grantdef actions_on_bucket_and_object_keys(self, identity: IGrantable, objects_key_pattern: typing.Optional[str] = None, actions: str) -> Grantpublic Grant actionsOnBucketAndObjectKeys(IGrantable identity, String objectsKeyPattern, String actions)public Grant ActionsOnBucketAndObjectKeys(IGrantable identity, string? objectsKeyPattern = null, string actions)func ActionsOnBucketAndObjectKeys(Identity IGrantable, ObjectsKeyPattern *string, Actions *string) Grant#Grants the given actions on both the bucket and the bucket's objects to the given principal.
KMS actions (prefixed with kms:) are automatically separated and granted on the encryption key.
3 parameters
Parameters
identityidentityidentityidentityIdentity— The principal to grant permissions to.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').actionsactionsactionsactionsActions— The S3 and/or KMS actions to grant.
actionsOnObjectKeys(identity: IGrantable, objectsKeyPattern?: string, ...actions: string[]): Grantdef actions_on_object_keys(self, identity: IGrantable, objects_key_pattern: typing.Optional[str] = None, actions: str) -> Grantpublic Grant actionsOnObjectKeys(IGrantable identity, String objectsKeyPattern, String actions)public Grant ActionsOnObjectKeys(IGrantable identity, string? objectsKeyPattern = null, string actions)func ActionsOnObjectKeys(Identity IGrantable, ObjectsKeyPattern *string, Actions *string) Grant#Grants the given actions on the bucket's objects to the given principal.
KMS actions (prefixed with kms:) are automatically separated and granted on the encryption key.
3 parameters
Parameters
identityidentityidentityidentityIdentity— The principal to grant permissions to.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').actionsactionsactionsactionsActions— The S3 and/or KMS actions to grant.
delete(grantee: IGrantable, objectsKeyPattern?: any): Grantdef delete(self, grantee: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant delete(IGrantable grantee, Object objectsKeyPattern)public Grant Delete(IGrantable grantee, object? objectsKeyPattern = null)func Delete(Grantee IGrantable, ObjectsKeyPattern interface{}) Grant#Grants s3:DeleteObject* permission to an IAM principal for objects in this bucket.
2 parameters
Parameters
granteegranteegranteegranteeGrantee— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
fromBucket(bucket: IBucketRef): BucketGrants // chainable@staticmethod def from_bucket(bucket: IBucketRef) -> BucketGrantspublic static BucketGrants fromBucket(IBucketRef bucket)public static BucketGrants FromBucket(IBucketRef bucket)func FromBucket(Bucket IBucketRef) BucketGrantsstatic#Creates grants for an IBucketRef.
publicAccess(keyPrefix?: string, ...allowedActions: string[]): Grantdef public_access(self, key_prefix: typing.Optional[str] = None, allowed_actions: str) -> Grantpublic Grant publicAccess(String keyPrefix, String allowedActions)public Grant PublicAccess(string? keyPrefix = null, string allowedActions)func PublicAccess(KeyPrefix *string, AllowedActions *string) Grant#Allows unrestricted access to objects from this bucket.
notes · 2 parameters
IMPORTANT: This permission allows anyone to perform actions on S3 objects in this bucket, which is useful for when you configure your bucket as a website and want everyone to be able to read objects in the bucket without needing to authenticate.
Without arguments, this method will grant read ("s3:GetObject") access to all objects ("*") in the bucket.
The method returns the iam.Grant object, which can then be modified as needed. For example, you can add a condition that will restrict access only to an IPv4 range like this:
const grant = bucket.grantPublicAccess();
grant.resourceStatement!.addCondition(‘IpAddress’, { “aws:SourceIp”: “54.240.143.0/24” });
Note that if this IBucket refers to an existing bucket, possibly not managed by CloudFormation, this method will have no effect, since it's impossible to modify the policy of an existing bucket.
Parameters
keyPrefixkey_prefixkeyPrefixkeyPrefixKeyPrefix— the prefix of S3 object keys (e.g.home/*). Default is "*".allowedActionsallowed_actionsallowedActionsallowedActionsAllowedActions— the set of S3 actions to allow.
put(identity: IGrantable, objectsKeyPattern?: any): Grantdef put(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant put(IGrantable identity, Object objectsKeyPattern)public Grant Put(IGrantable identity, object? objectsKeyPattern = null)func Put(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#Grants s3:PutObject* and s3:Abort* permissions for this bucket to an IAM principal.
If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
putAcl(identity: IGrantable, objectsKeyPattern?: string): Grantdef put_acl(self, identity: IGrantable, objects_key_pattern: typing.Optional[str] = None) -> Grantpublic Grant putAcl(IGrantable identity, String objectsKeyPattern)public Grant PutAcl(IGrantable identity, string? objectsKeyPattern = null)func PutAcl(Identity IGrantable, ObjectsKeyPattern *string) Grant#Grants s3:PutObjectAcl and s3:PutObjectVersionAcl permissions for this bucket to an IAM principal.
If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
read(identity: IGrantable, objectsKeyPattern?: any): Grantdef read(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant read(IGrantable identity, Object objectsKeyPattern)public Grant Read(IGrantable identity, object? objectsKeyPattern = null)func Read(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#Grant read permissions for this bucket and its contents to an IAM principal (Role/Group/User).
If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
readWrite(identity: IGrantable, objectsKeyPattern?: any): Grantdef read_write(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant readWrite(IGrantable identity, Object objectsKeyPattern)public Grant ReadWrite(IGrantable identity, object? objectsKeyPattern = null)func ReadWrite(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#Grant read and write permissions for this bucket and its contents to an IAM principal (Role/Group/User).
If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
replicationPermission(identity: IGrantable, props: GrantReplicationPermissionProps): Grantdef replication_permission(self, identity: IGrantable, props: GrantReplicationPermissionProps) -> Grantpublic Grant replicationPermission(IGrantable identity, GrantReplicationPermissionProps props)public Grant ReplicationPermission(IGrantable identity, GrantReplicationPermissionProps props)func ReplicationPermission(Identity IGrantable, Props GrantReplicationPermissionProps) Grant#Grant replication permission to a principal. This method allows the principal to perform replication operations on this bucket.
Note that when calling this function for source or destination buckets that support KMS encryption, you need to specify the KMS key for encryption and the KMS key for decryption, respectively.
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal to grant replication permission to.propspropspropspropsProps— The properties of the replication source and destination buckets.
write(identity: IGrantable, objectsKeyPattern?: any, allowedActionPatterns?: string[]): Grantdef write(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None, allowed_action_patterns: typing.Optional[typing.List[str]] = None) -> Grantpublic Grant write(IGrantable identity, Object objectsKeyPattern, List<String> allowedActionPatterns)public Grant Write(IGrantable identity, object? objectsKeyPattern = null, string[]? allowedActionPatterns = null)func Write(Identity IGrantable, ObjectsKeyPattern interface{}, AllowedActionPatterns *[]*string) Grant#Grant write permissions for this bucket and its contents to an IAM principal (Role/Group/User).
If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').