BucketGrants

class aws_cdk.aws_s3.BucketGrants(*args: Any, **kwargs)

Bases: object

Collection of grant methods for a Bucket.

Methods

delete(grantee, objects_key_pattern=None)

Grants s3:DeleteObject* permission to an IAM principal for objects in this bucket.

Parameters:

  • grantee (IGrantable) – The principal.

  • objects_key_pattern (Any) – Restrict the permission to a certain key pattern (default ‘*’). Parameter type is any but string should be passed in.

Return type:

Grant

public_access(key_prefix=None, *allowed_actions)

Allows unrestricted access to objects from this bucket.

IMPORTANT: This permission allows anyone to perform actions on S3 objects in this bucket, which is useful for when you configure your bucket as a website and want everyone to be able to read objects in the bucket without needing to authenticate.

Without arguments, this method will grant read (“s3:GetObject”) access to all objects (“*”) in the bucket.

The method returns the iam.Grant object, which can then be modified as needed. For example, you can add a condition that will restrict access only to an IPv4 range like this:

const grant = bucket.grantPublicAccess();
grant.resourceStatement!.addCondition(‘IpAddress’, { “aws:SourceIp”: “54.240.143.0/24” });

Note that if this IBucket refers to an existing bucket, possibly not managed by CloudFormation, this method will have no effect, since it’s impossible to modify the policy of an existing bucket.

Parameters:

  • key_prefix (Optional[str]) – the prefix of S3 object keys (e.g. home/*). Default is “*”.

  • allowed_actions (str) – the set of S3 actions to allow. Default is “s3:GetObject”.

Return type:

Grant

put(identity, objects_key_pattern=None)

Grants s3:PutObject* and s3:Abort* permissions for this bucket to an IAM principal.

If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.

Parameters:

  • identity (IGrantable) – The principal.

  • objects_key_pattern (Any) – Restrict the permission to a certain key pattern (default ‘*’). Parameter type is any but string should be passed in.

Return type:

Grant

put_acl(identity, objects_key_pattern=None)

Grants s3:PutObjectAcl and s3:PutObjectVersionAcl permissions for this bucket to an IAM principal.

If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.

Parameters:

  • identity (IGrantable) – The principal.

  • objects_key_pattern (Optional[str]) – Restrict the permission to a certain key pattern (default ‘*’). Parameter type is any but string should be passed in.

Return type:

Grant

read(identity, objects_key_pattern=None)

Grant read permissions for this bucket and it’s contents to an IAM principal (Role/Group/User).

If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.

Parameters:

  • identity (IGrantable) – The principal.

  • objects_key_pattern (Any) – Restrict the permission to a certain key pattern (default ‘*’). Parameter type is any but string should be passed in.

Return type:

Grant

read_write(identity, objects_key_pattern=None)

Grant read and write permissions for this bucket and it’s contents to an IAM principal (Role/Group/User).

If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.

Parameters:

  • identity (IGrantable) – The principal.

  • objects_key_pattern (Any) – Restrict the permission to a certain key pattern (default ‘*’). Parameter type is any but string should be passed in.

Return type:

Grant

replication_permission(identity, *, destinations, source_decryption_key=None)

Grant replication permission to a principal. This method allows the principal to perform replication operations on this bucket.

Note that when calling this function for source or destination buckets that support KMS encryption, you need to specify the KMS key for encryption and the KMS key for decryption, respectively.

Parameters:

  • identity (IGrantable) – The principal to grant replication permission to.

  • destinations (Sequence[Union[GrantReplicationPermissionDestinationProps, Dict[str, Any]]]) – The destination buckets for replication. Specify the KMS key to use for encryption if a destination bucket needs to be encrypted with a customer-managed KMS key. One or more destination buckets are required if replication configuration is enabled (i.e., replicationRole is specified). Default: - empty array (valid only if the replicationRole property is NOT specified)

  • source_decryption_key (Optional[IKey]) – The KMS key used to decrypt objects in the source bucket for replication. Required if the source bucket is encrypted with a customer-managed KMS key. Default: - it’s assumed the source bucket is not encrypted with a customer-managed KMS key.

Return type:

Grant

write(identity, objects_key_pattern=None, allowed_action_patterns=None)

Grant write permissions for this bucket and it’s contents to an IAM principal (Role/Group/User).

If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.

Parameters:

  • identity (IGrantable) – The principal.

  • objects_key_pattern (Any) – Restrict the permission to a certain key pattern (default ‘*’). Parameter type is any but string should be passed in.

  • allowed_action_patterns (Optional[Sequence[str]])

Return type:

Grant