BucketProps Struct
Example
const accessLogsBucket = new s3.Bucket(this, 'AccessLogsBucket', {
objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_ENFORCED,
});
accessLogsBucket.addToResourcePolicy(
new iam.PolicyStatement({
actions: ['s3:*'],
resources: [accessLogsBucket.bucketArn, accessLogsBucket.arnForObjects('*')],
principals: [new iam.AnyPrincipal()],
})
)
const bucket = new s3.Bucket(this, 'MyBucket', {
serverAccessLogsBucket: accessLogsBucket,
serverAccessLogsPrefix: 'logs',
});
Properties
abacStatusoptionalbooleanabac_statusoptionalboolabacStatusoptionalBooleanAbacStatusoptionalboolAbacStatusoptional*bool#Default: The ABAC status is not set
Set to true to enable ABAC, false to explicitly disable it.
accessControloptionalBucketAccessControlaccess_controloptionalBucketAccessControlaccessControloptionalBucketAccessControlAccessControloptionalBucketAccessControlAccessControloptionalBucketAccessControl= BucketAccessControl.PRIVATE#autoDeleteObjectsoptionalbooleanauto_delete_objectsoptionalboolautoDeleteObjectsoptionalBooleanAutoDeleteObjectsoptionalboolAutoDeleteObjectsoptional*bool= false#notes
Requires the removalPolicy to be set to RemovalPolicy.DESTROY.
Warning if you have deployed a bucket with autoDeleteObjects: true, switching this to false in a CDK version before 1.126.0 will lead to all objects in the bucket being deleted. Be sure to update your bucket resources by deploying with CDK version 1.126.0 or later before switching this value to false.
Setting autoDeleteObjects to true on a bucket will add s3:PutBucketPolicy to the bucket policy. This is because during bucket deletion, the custom resource provider needs to update the bucket policy by adding a deny policy for s3:PutObject to prevent race conditions with external bucket writers.
blockedEncryptionTypesoptionalBlockedEncryptionType[]blocked_encryption_typesoptionaltyping.List[BlockedEncryptionType]blockedEncryptionTypesoptionalList<BlockedEncryptionType>BlockedEncryptionTypesoptionalBlockedEncryptionType[]BlockedEncryptionTypesoptional*[]BlockedEncryptionType#Default: Amazon S3 determines which encryption types to block.
At least one BlockedEncryptionType must be given. If NONE is given, it must be the only BlockedEncryptionType in the list.
blockPublicAccessoptionalBlockPublicAccessblock_public_accessoptionalBlockPublicAccessblockPublicAccessoptionalBlockPublicAccessBlockPublicAccessoptionalBlockPublicAccessBlockPublicAccessoptionalBlockPublicAccess#Default: CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
bucketKeyEnabledoptionalbooleanbucket_key_enabledoptionalboolbucketKeyEnabledoptionalBooleanBucketKeyEnabledoptionalboolBucketKeyEnabledoptional*bool= false#notes
Only relevant when using KMS for encryption.
- If not enabled, every object GET and PUT will cause an API call to KMS (with the attendant cost implications of that).
- If enabled, S3 will use its own time-limited key instead.
Only relevant, when Encryption is not set to BucketEncryption.UNENCRYPTED.
bucketNameoptionalstringbucket_nameoptionalstrbucketNameoptionalStringBucketNameoptionalstringBucketNameoptional*string#Default: Assigned by CloudFormation (recommended).
Cannot be used together with bucketNamePrefix or bucketNamespace.
bucketNamePrefixoptionalstringbucket_name_prefixoptionalstrbucketNamePrefixoptionalStringBucketNamePrefixoptionalstringBucketNamePrefixoptional*string#Default: No prefix.
notes
Requires bucketNamespace to be set to ACCOUNT_REGIONAL. Cannot be used together with bucketName.
CloudFormation appends -<accountId>-<region>-an to form the full name. For example, my-app becomes my-app-123456789012-us-east-1-an.
Must contain only lowercase letters, numbers, and hyphens. Must start and end with a lowercase letter or number.
bucketNamespaceoptionalBucketNamespacebucket_namespaceoptionalBucketNamespacebucketNamespaceoptionalBucketNamespaceBucketNamespaceoptionalBucketNamespaceBucketNamespaceoptionalBucketNamespace#Default: Global namespace.
notes
AWS recommends ACCOUNT_REGIONAL for improved security, as bucket names are scoped to your account and cannot be claimed by other accounts. When set to ACCOUNT_REGIONAL, bucketNamePrefix is required. When set to GLOBAL, it can be used standalone to explicitly specify the default namespace.
corsoptionalCorsRule[]corsoptionaltyping.List[CorsRule]corsoptionalList<CorsRule>CorsoptionalCorsRule[]Corsoptional*[]CorsRule#Default: No CORS configuration.
encryptionoptionalBucketEncryptionencryptionoptionalBucketEncryptionencryptionoptionalBucketEncryptionEncryptionoptionalBucketEncryptionEncryptionoptionalBucketEncryption#Default: KMS if encryptionKey is specified, or S3_MANAGED otherwise.
If you choose KMS, you can specify a KMS key via encryptionKey. If encryption key is not specified, a key will automatically be created.
encryptionKeyoptionalIKeyencryption_keyoptionalIKeyencryptionKeyoptionalIKeyEncryptionKeyoptionalIKeyEncryptionKeyoptionalIKey#Default: If encryption is set to KMS and this property is undefined, a new KMS key will be created and associated with this bucket.
The encryption property must be either not specified or set to KMS or DSSE. An error will be emitted if encryption is set to UNENCRYPTED or S3_MANAGED.
enforceSSLoptionalbooleanenforce_ssloptionalboolenforceSSLoptionalBooleanEnforceSSLoptionalboolEnforceSSLoptional*bool= false#S3.5 of the AWS Foundational Security Best Practices Regarding S3.
eventBridgeEnabledoptionalbooleanevent_bridge_enabledoptionalbooleventBridgeEnabledoptionalBooleanEventBridgeEnabledoptionalboolEventBridgeEnabledoptional*bool= false#intelligentTieringConfigurationsoptionalIntelligentTieringConfiguration[]intelligent_tiering_configurationsoptionaltyping.List[IntelligentTieringConfiguration]intelligentTieringConfigurationsoptionalList<IntelligentTieringConfiguration>IntelligentTieringConfigurationsoptionalIntelligentTieringConfiguration[]IntelligentTieringConfigurationsoptional*[]IntelligentTieringConfiguration#Default: No Intelligent Tiering Configurations.
inventoriesoptionalInventory[]inventoriesoptionaltyping.List[Inventory]inventoriesoptionalList<Inventory>InventoriesoptionalInventory[]Inventoriesoptional*[]Inventory#Default: No inventory configuration
lifecycleRulesoptionalLifecycleRule[]lifecycle_rulesoptionaltyping.List[LifecycleRule]lifecycleRulesoptionalList<LifecycleRule>LifecycleRulesoptionalLifecycleRule[]LifecycleRulesoptional*[]LifecycleRule#Default: No lifecycle rules.
metricsoptionalBucketMetrics[]metricsoptionaltyping.List[BucketMetrics]metricsoptionalList<BucketMetrics>MetricsoptionalBucketMetrics[]Metricsoptional*[]BucketMetrics#Default: No metrics configuration.
minimumTLSVersionoptionalnumberminimum_tls_versionoptionalint | floatminimumTLSVersionoptionalNumberMinimumTLSVersionoptionaldoubleMinimumTLSVersionoptional*float64#Default: No minimum TLS version is enforced.
Requires enforceSSL to be enabled.
notificationsHandlerRoleoptionalIRolenotifications_handler_roleoptionalIRolenotificationsHandlerRoleoptionalIRoleNotificationsHandlerRoleoptionalIRoleNotificationsHandlerRoleoptionalIRole#Default: a new role will be created.
notificationsSkipDestinationValidationoptionalbooleannotifications_skip_destination_validationoptionalboolnotificationsSkipDestinationValidationoptionalBooleanNotificationsSkipDestinationValidationoptionalboolNotificationsSkipDestinationValidationoptional*bool= false#objectLockDefaultRetentionoptionalObjectLockRetentionobject_lock_default_retentionoptionalObjectLockRetentionobjectLockDefaultRetentionoptionalObjectLockRetentionObjectLockDefaultRetentionoptionalObjectLockRetentionObjectLockDefaultRetentionoptionalObjectLockRetention#Default: no default retention period
Default retention can be configured after a bucket is created if the bucket already has object lock enabled. Enabling object lock for existing buckets is not supported.
objectLockEnabledoptionalbooleanobject_lock_enabledoptionalboolobjectLockEnabledoptionalBooleanObjectLockEnabledoptionalboolObjectLockEnabledoptional*bool#Default: false, unless objectLockDefaultRetention is set (then, true)
Enabling object lock for existing buckets is not supported. Object lock must be enabled when the bucket is created.
objectOwnershipoptionalObjectOwnershipobject_ownershipoptionalObjectOwnershipobjectOwnershipoptionalObjectOwnershipObjectOwnershipoptionalObjectOwnershipObjectOwnershipoptionalObjectOwnership#Default: No ObjectOwnership configuration. By default, Amazon S3 sets Object Ownership to Bucket owner enforced. This means ACLs are disabled and the bucket owner will own every object.
publicReadAccessoptionalbooleanpublic_read_accessoptionalboolpublicReadAccessoptionalBooleanPublicReadAccessoptionalboolPublicReadAccessoptional*bool= false#Similar to calling bucket.grantPublicAccess()
removalPolicyoptionalRemovalPolicyremoval_policyoptionalRemovalPolicyremovalPolicyoptionalRemovalPolicyRemovalPolicyoptionalRemovalPolicyRemovalPolicyoptionalRemovalPolicy#Default: The bucket will be orphaned.
replicationRoleoptionalIRolereplication_roleoptionalIRolereplicationRoleoptionalIRoleReplicationRoleoptionalIRoleReplicationRoleoptionalIRole#Default: a new role will be created.
When setting this property, you must also set replicationRules.
replicationRulesoptionalReplicationRule[]replication_rulesoptionaltyping.List[ReplicationRule]replicationRulesoptionalList<ReplicationRule>ReplicationRulesoptionalReplicationRule[]ReplicationRulesoptional*[]ReplicationRule#Default: No replication
serverAccessLogsBucketoptionalIBucketserver_access_logs_bucketoptionalIBucketserverAccessLogsBucketoptionalIBucketServerAccessLogsBucketoptionalIBucketServerAccessLogsBucketoptionalIBucket#Default: If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
serverAccessLogsPrefixoptionalstringserver_access_logs_prefixoptionalstrserverAccessLogsPrefixoptionalStringServerAccessLogsPrefixoptionalstringServerAccessLogsPrefixoptional*string#Default: No log file prefix
If defined without "serverAccessLogsBucket", enables access logs to current bucket with this prefix.
targetObjectKeyFormatoptionalTargetObjectKeyFormattarget_object_key_formatoptionalTargetObjectKeyFormattargetObjectKeyFormatoptionalTargetObjectKeyFormatTargetObjectKeyFormatoptionalTargetObjectKeyFormatTargetObjectKeyFormatoptionalTargetObjectKeyFormat#Default: the default key format is: [DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
transferAccelerationoptionalbooleantransfer_accelerationoptionalbooltransferAccelerationoptionalBooleanTransferAccelerationoptionalboolTransferAccelerationoptional*bool= false#transitionDefaultMinimumObjectSizeoptionalTransitionDefaultMinimumObjectSizetransition_default_minimum_object_sizeoptionalTransitionDefaultMinimumObjectSizetransitionDefaultMinimumObjectSizeoptionalTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeoptionalTransitionDefaultMinimumObjectSizeTransitionDefaultMinimumObjectSizeoptionalTransitionDefaultMinimumObjectSize#Default: TransitionDefaultMinimumObjectSize.VARIES_BY_STORAGE_CLASS before September 2024, otherwise TransitionDefaultMinimumObjectSize.ALL_STORAGE_CLASSES_128_K.
notes
To customize the minimum object size for any transition you can add a filter that specifies a custom objectSizeGreaterThan or objectSizeLessThan for lifecycleRules property. Custom filters always take precedence over the default transition behavior.
versionedoptionalbooleanversionedoptionalboolversionedoptionalBooleanVersionedoptionalboolVersionedoptional*bool#Default: false (unless object lock is enabled, then true)
websiteErrorDocumentoptionalstringwebsite_error_documentoptionalstrwebsiteErrorDocumentoptionalStringWebsiteErrorDocumentoptionalstringWebsiteErrorDocumentoptional*string#Default: No error document.
websiteIndexDocumentoptionalstringwebsite_index_documentoptionalstrwebsiteIndexDocumentoptionalStringWebsiteIndexDocumentoptionalstringWebsiteIndexDocumentoptional*string#Default: No index document.
websiteRedirectoptionalRedirectTargetwebsite_redirectoptionalRedirectTargetwebsiteRedirectoptionalRedirectTargetWebsiteRedirectoptionalRedirectTargetWebsiteRedirectoptionalRedirectTarget#Default: No redirection.
If you specify this property, you can't specify "websiteIndexDocument", "websiteErrorDocument" nor , "websiteRoutingRules".
websiteRoutingRulesoptionalRoutingRule[]website_routing_rulesoptionaltyping.List[RoutingRule]websiteRoutingRulesoptionalList<RoutingRule>WebsiteRoutingRulesoptionalRoutingRule[]WebsiteRoutingRulesoptional*[]RoutingRule#Default: No redirection rules.