IBucket Interface
Properties
bucketDomainNamestringbucket_domain_namestrbucketDomainNameStringBucketDomainNamestringBucketDomainName*string#bucketDualStackDomainNamestringbucket_dual_stack_domain_namestrbucketDualStackDomainNameStringBucketDualStackDomainNamestringBucketDualStackDomainName*string#bucketRefBucketReferencebucket_refBucketReferencebucketRefBucketReferenceBucketRefBucketReferenceBucketRefBucketReference#bucketRegionalDomainNamestringbucket_regional_domain_namestrbucketRegionalDomainNameStringBucketRegionalDomainNamestringBucketRegionalDomainName*string#bucketWebsiteDomainNamestringbucket_website_domain_namestrbucketWebsiteDomainNameStringBucketWebsiteDomainNamestringBucketWebsiteDomainName*string#bucketWebsiteUrlstringbucket_website_urlstrbucketWebsiteUrlStringBucketWebsiteUrlstringBucketWebsiteUrl*string#encryptionKeymay be undefinedIKeyencryption_keymay be undefinedIKeyencryptionKeymay be undefinedIKeyEncryptionKeymay be undefinedIKeyEncryptionKeymay be undefinedIKey#envResourceEnvironmentenvResourceEnvironmentenvResourceEnvironmentEnvResourceEnvironmentEnvResourceEnvironment#notes
For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.
For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.
isWebsitemay be undefinedbooleanis_websitemay be undefinedboolisWebsitemay be undefinedBooleanIsWebsitemay be undefinedboolIsWebsitemay be undefined*bool#policymay be undefinedBucketPolicypolicymay be undefinedBucketPolicypolicymay be undefinedBucketPolicyPolicymay be undefinedBucketPolicyPolicymay be undefinedBucketPolicy#If autoCreatePolicy is true, a BucketPolicy will be created upon the first call to addToResourcePolicy(s).
replicationRoleArnmay be undefinedstringreplication_role_arnmay be undefinedstrreplicationRoleArnmay be undefinedStringReplicationRoleArnmay be undefinedstringReplicationRoleArnmay be undefined*string#Methods
addEventNotification(event: EventType, dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_event_notification(self, event: EventType, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addEventNotification(EventType event, IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddEventNotification(EventType event, IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddEventNotification(Event EventType, Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#3 parameters · example
Parameters
eventeventeventeventEvent— The event to trigger the notification.destdestdestdestDest— The notification destination (Lambda, SNS Topic or SQS Queue).filtersfiltersfiltersfiltersFilters— S3 object key filter rules to determine which objects trigger this event.
declare const myLambda: lambda.Function;
const bucket = new s3.Bucket(this, 'MyBucket');
const filter: s3.NotificationKeyFilter = { prefix: 'home/myusername/*' };
bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.LambdaDestination(myLambda), filter);
addObjectCreatedNotification(dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_object_created_notification(self, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addObjectCreatedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddObjectCreatedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddObjectCreatedNotification(Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#This is identical to calling onEvent(s3.EventType.OBJECT_CREATED).
2 parameters
Parameters
destdestdestdestDest— The notification destination (see onEvent).filtersfiltersfiltersfiltersFilters— Filters (see onEvent).
addObjectRemovedNotification(dest: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): voiddef add_object_removed_notification(self, dest: IBucketNotificationDestination, filters: NotificationKeyFilter) -> Nonepublic void addObjectRemovedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)public void AddObjectRemovedNotification(IBucketNotificationDestination dest, NotificationKeyFilter filters)func AddObjectRemovedNotification(Dest IBucketNotificationDestination, Filters NotificationKeyFilter)#This is identical to calling onEvent(EventType.OBJECT_REMOVED).
2 parameters
Parameters
destdestdestdestDest— The notification destination (see onEvent).filtersfiltersfiltersfiltersFilters— Filters (see onEvent).
addReplicationPolicy(roleArn: string, accessControlTransition?: boolean, account?: string): voiddef add_replication_policy(self, role_arn: str, access_control_transition: typing.Optional[bool] = None, account: typing.Optional[str] = None) -> Nonepublic void addReplicationPolicy(String roleArn, Boolean accessControlTransition, String account)public void AddReplicationPolicy(string roleArn, bool? accessControlTransition = null, string? account = null)func AddReplicationPolicy(RoleArn *string, AccessControlTransition *bool, Account *string)#notes · 3 parameters
Call this method on the destination bucket. If the destination bucket is a referenced bucket, its policy cannot be modified by CDK and the permissions must be added in the destination account.
To change replica ownership to the destination bucket owner, set accessControlTransition to true and provide the source bucket owner's account ID.
Parameters
roleArnrole_arnroleArnroleArnRoleArn— The ARN of the source bucket's replication role.accessControlTransitionaccess_control_transitionaccessControlTransitionaccessControlTransitionAccessControlTransition— Whether to change replica ownership to the destination bucket owner.accountaccountaccountaccountAccount— The source bucket owner's AWS account ID.
addToResourcePolicy(permission: PolicyStatement): AddToResourcePolicyResultdef add_to_resource_policy(self, permission: PolicyStatement) -> AddToResourcePolicyResultpublic AddToResourcePolicyResult addToResourcePolicy(PolicyStatement permission)public AddToResourcePolicyResult AddToResourcePolicy(PolicyStatement permission)func AddToResourcePolicy(Permission PolicyStatement) AddToResourcePolicyResult#notes · 1 parameter · returns
Note that the policy statement may or may not be added to the policy. For example, when an IBucket is created from an existing bucket, it's not possible to tell whether the bucket already has a policy attached, let alone to re-use that policy to add more statements to it. So it's safest to do nothing in these cases.
Parameters
permissionpermissionpermissionpermissionPermission— the policy statement to be added to the bucket's policy.
Returns: metadata about the execution of this method. If the policy was not added, the value of statementAdded will be false. You should always check this value to make sure that the operation was actually carried out. Otherwise, synthesis and deploy will terminate silently, which may be confusing.
applyRemovalPolicy(policy: RemovalPolicy): voiddef apply_removal_policy(self, policy: RemovalPolicy) -> Nonepublic void applyRemovalPolicy(RemovalPolicy policy)public void ApplyRemovalPolicy(RemovalPolicy policy)func ApplyRemovalPolicy(Policy RemovalPolicy)#notes
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.
The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).
arnForObjects(keyPattern: string): stringdef arn_for_objects(self, key_pattern: str) -> strpublic String arnForObjects(String keyPattern)public string ArnForObjects(string keyPattern)func ArnForObjects(KeyPattern *string) *string#To represent all keys, specify "*".
enableEventBridgeNotification(): voiddef enable_event_bridge_notification(self, ) -> Nonepublic void enableEventBridgeNotification()public void EnableEventBridgeNotification()func EnableEventBridgeNotification()#notes
- Object Created
- Object Deleted (DeleteObject)
- Object Deleted (Lifecycle expiration)
- Object Restore Initiated
- Object Restore Completed
- Object Restore Expired
- Object Storage Class Changed
- Object Access Tier Changed
- Object ACL Updated
- Object Tags Added
- Object Tags Deleted
grantDelete(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_delete(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantDelete(IGrantable identity, Object objectsKeyPattern)public Grant GrantDelete(IGrantable identity, object? objectsKeyPattern = null)func GrantDelete(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantPublicAccess(keyPrefix?: string, ...allowedActions: string[]): Grantdef grant_public_access(self, key_prefix: typing.Optional[str] = None, allowed_actions: str) -> Grantpublic Grant grantPublicAccess(String keyPrefix, String allowedActions)public Grant GrantPublicAccess(string? keyPrefix = null, string allowedActions)func GrantPublicAccess(KeyPrefix *string, AllowedActions *string) Grant#notes · 2 parameters · returns
IMPORTANT: This permission allows anyone to perform actions on S3 objects in this bucket, which is useful for when you configure your bucket as a website and want everyone to be able to read objects in the bucket without needing to authenticate.
Without arguments, this method will grant read ("s3:GetObject") access to all objects ("*") in the bucket.
The method returns the iam.Grant object, which can then be modified as needed. For example, you can add a condition that will restrict access only to an IPv4 range like this:
const grant = bucket.grantPublicAccess();
grant.resourceStatement!.addCondition(‘IpAddress’, { “aws:SourceIp”: “54.240.143.0/24” });
Parameters
keyPrefixkey_prefixkeyPrefixkeyPrefixKeyPrefix— the prefix of S3 object keys (e.g.home/*). Default is "*".allowedActionsallowed_actionsallowedActionsallowedActionsAllowedActions— the set of S3 actions to allow.
Returns: The iam.PolicyStatement object, which can be used to apply e.g. conditions.
grantPut(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_put(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantPut(IGrantable identity, Object objectsKeyPattern)public Grant GrantPut(IGrantable identity, object? objectsKeyPattern = null)func GrantPut(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantPutAcl(identity: IGrantable, objectsKeyPattern?: string): Grantdef grant_put_acl(self, identity: IGrantable, objects_key_pattern: typing.Optional[str] = None) -> Grantpublic Grant grantPutAcl(IGrantable identity, String objectsKeyPattern)public Grant GrantPutAcl(IGrantable identity, string? objectsKeyPattern = null)func GrantPutAcl(Identity IGrantable, ObjectsKeyPattern *string) Grant#notes · 2 parameters
If your application has the '@aws-cdk/aws-s3:grantWriteWithoutAcl' feature flag set, calling grantWrite or grantReadWrite no longer grants permissions to modify the ACLs of the objects; in this case, if you need to modify object ACLs, call this method explicitly.
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantRead(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_read(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantRead(IGrantable identity, Object objectsKeyPattern)public Grant GrantRead(IGrantable identity, object? objectsKeyPattern = null)func GrantRead(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.
2 parameters
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantReadWrite(identity: IGrantable, objectsKeyPattern?: any): Grantdef grant_read_write(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None) -> Grantpublic Grant grantReadWrite(IGrantable identity, Object objectsKeyPattern)public Grant GrantReadWrite(IGrantable identity, object? objectsKeyPattern = null)func GrantReadWrite(Identity IGrantable, ObjectsKeyPattern interface{}) Grant#notes · 2 parameters
If an encryption key is used, permission to use the key for encrypt/decrypt will also be granted.
Before CDK version 1.85.0, this method granted the s3:PutObject* permission that included s3:PutObjectAcl, which could be used to grant read/write object access to IAM principals in other accounts. If you want to get rid of that behavior, update your CDK version to 1.85.0 or later, and make sure the @aws-cdk/aws-s3:grantWriteWithoutAcl feature flag is set to true in the context key of your cdk.json file. If you've already updated, but still need the principal to have permissions to modify the ACLs, use the grantPutAcl method.
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').
grantReplicationPermission(identity: IGrantable, props: GrantReplicationPermissionProps): Grantdef grant_replication_permission(self, identity: IGrantable, props: GrantReplicationPermissionProps) -> Grantpublic Grant grantReplicationPermission(IGrantable identity, GrantReplicationPermissionProps props)public Grant GrantReplicationPermission(IGrantable identity, GrantReplicationPermissionProps props)func GrantReplicationPermission(Identity IGrantable, Props GrantReplicationPermissionProps) Grant#If an encryption key is used, permission to use the key for encrypt/decrypt will also be granted.
2 parameters · returns
Parameters
identityidentityidentityidentityIdentity— The principal.propspropspropspropsProps— The properties of the replication source and destination buckets.
Returns: The iam.Grant object, which represents the grant of permissions.
grantWrite(identity: IGrantable, objectsKeyPattern?: any, allowedActionPatterns?: string[]): Grantdef grant_write(self, identity: IGrantable, objects_key_pattern: typing.Optional[Any] = None, allowed_action_patterns: typing.Optional[typing.List[str]] = None) -> Grantpublic Grant grantWrite(IGrantable identity, Object objectsKeyPattern, List<String> allowedActionPatterns)public Grant GrantWrite(IGrantable identity, object? objectsKeyPattern = null, string[]? allowedActionPatterns = null)func GrantWrite(Identity IGrantable, ObjectsKeyPattern interface{}, AllowedActionPatterns *[]*string) Grant#notes · 3 parameters
If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.
Before CDK version 1.85.0, this method granted the s3:PutObject* permission that included s3:PutObjectAcl, which could be used to grant read/write object access to IAM principals in other accounts. If you want to get rid of that behavior, update your CDK version to 1.85.0 or later, and make sure the @aws-cdk/aws-s3:grantWriteWithoutAcl feature flag is set to true in the context key of your cdk.json file. If you've already updated, but still need the principal to have permissions to modify the ACLs, use the grantPutAcl method.
Parameters
identityidentityidentityidentityIdentity— The principal.objectsKeyPatternobjects_key_patternobjectsKeyPatternobjectsKeyPatternObjectsKeyPattern— Restrict the permission to a certain key pattern (default '*').allowedActionPatternsallowed_action_patternsallowedActionPatternsallowedActionPatternsAllowedActionPatterns— Restrict the permissions to certain list of action patterns.
onCloudTrailEvent(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_event(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailEvent(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailEvent(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailEvent(Id *string, Options OnCloudTrailBucketEventOptions) Rule#Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
2 parameters
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
onCloudTrailPutObject(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_put_object(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailPutObject(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailPutObject(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailPutObject(Id *string, Options OnCloudTrailBucketEventOptions) Rule#notes · 2 parameters
Note that some tools like aws s3 cp will automatically use either PutObject or the multipart upload API depending on the file size, so using onCloudTrailWriteObject may be preferable.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
onCloudTrailWriteObject(id: string, options?: OnCloudTrailBucketEventOptions): Ruledef on_cloud_trail_write_object(self, id: str, options: typing.Optional[OnCloudTrailBucketEventOptions] = None) -> Rulepublic Rule onCloudTrailWriteObject(String id, OnCloudTrailBucketEventOptions options)public Rule OnCloudTrailWriteObject(string id, OnCloudTrailBucketEventOptions? options = null)func OnCloudTrailWriteObject(Id *string, Options OnCloudTrailBucketEventOptions) Rule#notes · 2 parameters
This includes the events PutObject, CopyObject, and CompleteMultipartUpload.
Note that some tools like aws s3 cp will automatically use either PutObject or the multipart upload API depending on the file size, so using this method may be preferable to onCloudTrailPutObject.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
Parameters
ididididId— The id of the rule.optionsoptionsoptionsoptionsOptions— Options for adding the rule.
s3UrlForObject(key?: string): stringdef s3_url_for_object(self, key: typing.Optional[str] = None) -> strpublic String s3UrlForObject(String key)public string S3UrlForObject(string? key = null)func S3UrlForObject(Key *string) *string#For example:
s3://onlybuckets3://bucket/key
1 parameter · returns
Parameters
keykeykeykeyKey— The S3 key of the object.
Returns: an ObjectS3Url token
transferAccelerationUrlForObject(key?: string, options?: TransferAccelerationUrlOptions): stringdef transfer_acceleration_url_for_object(self, key: typing.Optional[str] = None, options: typing.Optional[TransferAccelerationUrlOptions] = None) -> strpublic String transferAccelerationUrlForObject(String key, TransferAccelerationUrlOptions options)public string TransferAccelerationUrlForObject(string? key = null, TransferAccelerationUrlOptions? options = null)func TransferAccelerationUrlForObject(Key *string, Options TransferAccelerationUrlOptions) *string#Specify dualStack: true at the options for dual-stack endpoint (connect to the bucket over IPv6). For example:
https://bucket---s3-accelerate.amazonaws.com.rproxy.govskope.cahttps://bucket.s3-accelerate.amazonaws.com/key
2 parameters · returns
Parameters
keykeykeykeyKey— The S3 key of the object.optionsoptionsoptionsoptionsOptions— Options for generating URL.
Returns: an TransferAccelerationUrl token
urlForObject(key?: string): stringdef url_for_object(self, key: typing.Optional[str] = None) -> strpublic String urlForObject(String key)public string UrlForObject(string? key = null)func UrlForObject(Key *string) *string#https://s3.us-west-1.amazonaws.com/onlybuckethttps://s3.us-west-1.amazonaws.com/bucket/keyhttps://s3---cn-north-1.amazonaws.com.rproxy.govskope.ca.cn/china-bucket/mykey
1 parameter · returns
Parameters
keykeykeykeyKey— The S3 key of the object.
Returns: an ObjectS3Url token
virtualHostedUrlForObject(key?: string, options?: VirtualHostedStyleUrlOptions): stringdef virtual_hosted_url_for_object(self, key: typing.Optional[str] = None, options: typing.Optional[VirtualHostedStyleUrlOptions] = None) -> strpublic String virtualHostedUrlForObject(String key, VirtualHostedStyleUrlOptions options)public string VirtualHostedUrlForObject(string? key = null, VirtualHostedStyleUrlOptions? options = null)func VirtualHostedUrlForObject(Key *string, Options VirtualHostedStyleUrlOptions) *string#https://only-bucket---s3---us-west-1.amazonaws.com.rproxy.govskope.cahttps://bucket.s3.us-west-1.amazonaws.com/keyhttps://bucket.s3.amazonaws.com/keyhttps://china-bucket---s3---cn-north-1.amazonaws.com.rproxy.govskope.ca.cn/mykey
2 parameters · returns
Parameters
keykeykeykeyKey— The S3 key of the object.optionsoptionsoptionsoptionsOptions— Options for generating URL.
Returns: an ObjectS3Url token
with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited.
1 parameter · returns
Parameters
mixinsmixinsmixinsmixinsMixins— The mixins to apply.
Returns: This construct for chaining