CfnDirectoryBucketPropsMixin

class aws_cdk.mixins_preview.aws_s3express.mixins.CfnDirectoryBucketPropsMixin(props, *, strategy=None)

Bases: Mixin

The AWS::S3Express::DirectoryBucket resource defines an Amazon S3 directory bucket in the same AWS Region where you create the AWS CloudFormation stack.

To control how AWS CloudFormation handles the bucket when the stack is deleted, you can set a deletion policy for your bucket. You can choose to retain the bucket or to delete the bucket. For more information, see DeletionPolicy attribute . .. epigraph:

You can only delete empty buckets. Deletion fails for buckets that have contents.

Permissions - The required permissions for CloudFormation to use are based on the operations that are performed on the stack.
Create
s3express:CreateBucket
s3express:ListAllMyDirectoryBuckets
Read
s3express:ListAllMyDirectoryBuckets
ec2:DescribeAvailabilityZones
Delete
s3express:DeleteBucket
s3express:ListAllMyDirectoryBuckets
List
s3express:ListAllMyDirectoryBuckets
PutBucketEncryption
s3express:PutEncryptionConfiguration
To set a directory bucket default encryption with SSE-KMS, you must also have the kms:GenerateDataKey and kms:Decrypt permissions in IAM identity-based policies and AWS KMS key policies for the target AWS KMS key.
GetBucketEncryption
s3express:GetBucketEncryption
DeleteBucketEncryption
s3express:PutEncryptionConfiguration

The following operations are related to AWS::S3Express::DirectoryBucket :

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-s3express-directorybucket.html
CloudformationResource:: AWS::S3Express::DirectoryBucket
Mixin:: true
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview import mixins
from aws_cdk.mixins_preview.aws_s3express import mixins as s3express_mixins

cfn_directory_bucket_props_mixin = s3express_mixins.CfnDirectoryBucketPropsMixin(s3express_mixins.CfnDirectoryBucketMixinProps(
    bucket_encryption=s3express_mixins.CfnDirectoryBucketPropsMixin.BucketEncryptionProperty(
        server_side_encryption_configuration=[s3express_mixins.CfnDirectoryBucketPropsMixin.ServerSideEncryptionRuleProperty(
            bucket_key_enabled=False,
            server_side_encryption_by_default=s3express_mixins.CfnDirectoryBucketPropsMixin.ServerSideEncryptionByDefaultProperty(
                kms_master_key_id="kmsMasterKeyId",
                sse_algorithm="sseAlgorithm"
            )
        )]
    ),
    bucket_name="bucketName",
    data_redundancy="dataRedundancy",
    lifecycle_configuration=s3express_mixins.CfnDirectoryBucketPropsMixin.LifecycleConfigurationProperty(
        rules=[s3express_mixins.CfnDirectoryBucketPropsMixin.RuleProperty(
            abort_incomplete_multipart_upload=s3express_mixins.CfnDirectoryBucketPropsMixin.AbortIncompleteMultipartUploadProperty(
                days_after_initiation=123
            ),
            expiration_in_days=123,
            id="id",
            object_size_greater_than="objectSizeGreaterThan",
            object_size_less_than="objectSizeLessThan",
            prefix="prefix",
            status="status"
        )]
    ),
    location_name="locationName",
    tags=[CfnTag(
        key="key",
        value="value"
    )]
),
    strategy=mixins.PropertyMergeStrategy.OVERRIDE
)

Create a mixin to apply properties to AWS::S3Express::DirectoryBucket.

Parameters:

props (Union[CfnDirectoryBucketMixinProps, Dict[str, Any]]) – L1 properties to apply.
strategy (Optional[PropertyMergeStrategy]) – (experimental) Strategy for merging nested properties. Default: - PropertyMergeStrategy.MERGE

Methods

apply_to(construct)

Apply the mixin properties to the construct.

Parameters:: construct (IConstruct)
Return type:: IConstruct

supports(construct)

Check if this mixin supports the given construct.

Parameters:: construct (IConstruct)
Return type:: bool

Attributes

CFN_PROPERTY_KEYS = ['bucketEncryption', 'bucketName', 'dataRedundancy', 'lifecycleConfiguration', 'locationName', 'tags']

Static Methods

classmethod is_mixin(x)

(experimental) Checks if x is a Mixin.

Parameters:: x (Any) – Any object.
Return type:: bool
Returns:: true if x is an object created from a class which extends Mixin.
Stability:: experimental

AbortIncompleteMultipartUploadProperty

class CfnDirectoryBucketPropsMixin.AbortIncompleteMultipartUploadProperty(*, days_after_initiation=None)

Bases: object

Specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload.

For more information, see Aborting Incomplete Multipart Uploads Using a Bucket Lifecycle Configuration in the Amazon S3 User Guide .

Parameters:: days_after_initiation (Union[int, float, None]) – Specifies the number of days after which Amazon S3 aborts an incomplete multipart upload.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-abortincompletemultipartupload.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_s3express import mixins as s3express_mixins

abort_incomplete_multipart_upload_property = s3express_mixins.CfnDirectoryBucketPropsMixin.AbortIncompleteMultipartUploadProperty(
    days_after_initiation=123
)

Attributes

days_after_initiation

Specifies the number of days after which Amazon S3 aborts an incomplete multipart upload.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-abortincompletemultipartupload.html#cfn-s3express-directorybucket-abortincompletemultipartupload-daysafterinitiation

BucketEncryptionProperty

class CfnDirectoryBucketPropsMixin.BucketEncryptionProperty(*, server_side_encryption_configuration=None)

Bases: object

Specifies default encryption for a bucket using server-side encryption with Amazon S3 managed keys (SSE-S3) or AWS KMS keys (SSE-KMS).

For information about default encryption for directory buckets, see Setting and monitoring default encryption for directory buckets in the Amazon S3 User Guide .

Parameters:: server_side_encryption_configuration (Union[IResolvable, Sequence[Union[IResolvable, ServerSideEncryptionRuleProperty, Dict[str, Any]]], None]) – Specifies the default server-side-encryption configuration.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-bucketencryption.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_s3express import mixins as s3express_mixins

bucket_encryption_property = s3express_mixins.CfnDirectoryBucketPropsMixin.BucketEncryptionProperty(
    server_side_encryption_configuration=[s3express_mixins.CfnDirectoryBucketPropsMixin.ServerSideEncryptionRuleProperty(
        bucket_key_enabled=False,
        server_side_encryption_by_default=s3express_mixins.CfnDirectoryBucketPropsMixin.ServerSideEncryptionByDefaultProperty(
            kms_master_key_id="kmsMasterKeyId",
            sse_algorithm="sseAlgorithm"
        )
    )]
)

Attributes

server_side_encryption_configuration

Specifies the default server-side-encryption configuration.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-bucketencryption.html#cfn-s3express-directorybucket-bucketencryption-serversideencryptionconfiguration

LifecycleConfigurationProperty

class CfnDirectoryBucketPropsMixin.LifecycleConfigurationProperty(*, rules=None)

Bases: object

Container for lifecycle rules. You can add as many as 1000 rules.

For more information see, Creating and managing a lifecycle configuration for directory buckets in the Amazon S3 User Guide .

Parameters:: rules (Union[IResolvable, Sequence[Union[IResolvable, RuleProperty, Dict[str, Any]]], None]) – A lifecycle rule for individual objects in an Amazon S3 Express bucket.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-lifecycleconfiguration.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_s3express import mixins as s3express_mixins

lifecycle_configuration_property = s3express_mixins.CfnDirectoryBucketPropsMixin.LifecycleConfigurationProperty(
    rules=[s3express_mixins.CfnDirectoryBucketPropsMixin.RuleProperty(
        abort_incomplete_multipart_upload=s3express_mixins.CfnDirectoryBucketPropsMixin.AbortIncompleteMultipartUploadProperty(
            days_after_initiation=123
        ),
        expiration_in_days=123,
        id="id",
        object_size_greater_than="objectSizeGreaterThan",
        object_size_less_than="objectSizeLessThan",
        prefix="prefix",
        status="status"
    )]
)

Attributes

rules

A lifecycle rule for individual objects in an Amazon S3 Express bucket.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-lifecycleconfiguration.html#cfn-s3express-directorybucket-lifecycleconfiguration-rules

RuleProperty

class CfnDirectoryBucketPropsMixin.RuleProperty(*, abort_incomplete_multipart_upload=None, expiration_in_days=None, id=None, object_size_greater_than=None, object_size_less_than=None, prefix=None, status=None)

Bases: object

Specifies lifecycle rules for an Amazon S3 bucket.

For more information, see Put Bucket Lifecycle Configuration in the Amazon S3 API Reference . For examples, see Put Bucket Lifecycle Configuration Examples .

You must specify at least one of the following properties: AbortIncompleteMultipartUpload , or ExpirationInDays .

Parameters:

abort_incomplete_multipart_upload (Union[IResolvable, AbortIncompleteMultipartUploadProperty, Dict[str, Any], None]) – Specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload.
expiration_in_days (Union[int, float, None]) – Indicates the number of days after creation when objects are deleted from Amazon S3 and Amazon S3 Glacier. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time.
id (Optional[str]) – Unique identifier for the rule. The value can’t be longer than 255 characters.
object_size_greater_than (Optional[str]) – Specifies the minimum object size in bytes for this rule to apply to. Objects must be larger than this value in bytes. For more information about size based rules, see Lifecycle configuration using size-based rules in the Amazon S3 User Guide .
object_size_less_than (Optional[str]) –
Specifies the maximum object size in bytes for this rule to apply to. Objects must be smaller than this value in bytes. For more information about sized based rules, see Lifecycle configuration using size-based rules in the Amazon S3 User Guide .
prefix (Optional[str]) – Object key prefix that identifies one or more objects to which this rule applies. .. epigraph:: Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see XML related object key constraints .
status (Optional[str]) – If Enabled , the rule is currently being applied. If Disabled , the rule is not currently being applied.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-rule.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_s3express import mixins as s3express_mixins

rule_property = s3express_mixins.CfnDirectoryBucketPropsMixin.RuleProperty(
    abort_incomplete_multipart_upload=s3express_mixins.CfnDirectoryBucketPropsMixin.AbortIncompleteMultipartUploadProperty(
        days_after_initiation=123
    ),
    expiration_in_days=123,
    id="id",
    object_size_greater_than="objectSizeGreaterThan",
    object_size_less_than="objectSizeLessThan",
    prefix="prefix",
    status="status"
)

Attributes

abort_incomplete_multipart_upload

Specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-rule.html#cfn-s3express-directorybucket-rule-abortincompletemultipartupload

expiration_in_days

Indicates the number of days after creation when objects are deleted from Amazon S3 and Amazon S3 Glacier.

If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-rule.html#cfn-s3express-directorybucket-rule-expirationindays

id

Unique identifier for the rule.

The value can’t be longer than 255 characters.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-rule.html#cfn-s3express-directorybucket-rule-id

object_size_greater_than

Specifies the minimum object size in bytes for this rule to apply to.

Objects must be larger than this value in bytes. For more information about size based rules, see Lifecycle configuration using size-based rules in the Amazon S3 User Guide .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-rule.html#cfn-s3express-directorybucket-rule-objectsizegreaterthan

object_size_less_than

Specifies the maximum object size in bytes for this rule to apply to.

Objects must be smaller than this value in bytes. For more information about sized based rules, see Lifecycle configuration using size-based rules in the Amazon S3 User Guide .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-rule.html#cfn-s3express-directorybucket-rule-objectsizelessthan

prefix

Object key prefix that identifies one or more objects to which this rule applies.

Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see XML related object key constraints .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-rule.html#cfn-s3express-directorybucket-rule-prefix

status

If Enabled , the rule is currently being applied.

If Disabled , the rule is not currently being applied.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-rule.html#cfn-s3express-directorybucket-rule-status

ServerSideEncryptionByDefaultProperty

class CfnDirectoryBucketPropsMixin.ServerSideEncryptionByDefaultProperty(*, kms_master_key_id=None, sse_algorithm=None)

Bases: object

Describes the default server-side encryption to apply to new objects in the bucket.

If a PUT Object request doesn’t specify any server-side encryption, this default encryption will be applied. For more information, see PutBucketEncryption in the Amazon S3 API Reference .

Parameters:

kms_master_key_id (Optional[str]) – AWS Key Management Service (KMS) customer managed key ID to use for the default encryption. This parameter is allowed only if SSEAlgorithm is set to aws:kms . You can specify this parameter with the key ID or the Amazon Resource Name (ARN) of the KMS key. You can’t use the key alias of the KMS key. - Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab - Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab If you are using encryption with cross-account or AWS service operations, you must use a fully qualified KMS key ARN. For more information, see Using encryption for cross-account operations . .. epigraph:: Your SSE-KMS configuration can only support 1 customer managed key per directory bucket for the lifetime of the bucket. AWS managed key ( aws/s3 ) isn’t supported. Also, after you specify a customer managed key for SSE-KMS and upload objects with this configuration, you can’t override the customer managed key for your SSE-KMS configuration. To use a new customer manager key for your data, we recommend copying your existing objects to a new directory bucket with a new customer managed key. > Amazon S3 only supports symmetric encryption KMS keys. For more information, see Asymmetric keys in AWS KMS in the AWS Key Management Service Developer Guide .
sse_algorithm (Optional[str]) – Server-side encryption algorithm to use for the default encryption. .. epigraph:: For directory buckets, there are only two supported values for server-side encryption: AES256 and aws:kms .

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-serversideencryptionbydefault.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_s3express import mixins as s3express_mixins

server_side_encryption_by_default_property = s3express_mixins.CfnDirectoryBucketPropsMixin.ServerSideEncryptionByDefaultProperty(
    kms_master_key_id="kmsMasterKeyId",
    sse_algorithm="sseAlgorithm"
)

Attributes

kms_master_key_id

AWS Key Management Service (KMS) customer managed key ID to use for the default encryption.

This parameter is allowed only if SSEAlgorithm is set to aws:kms .

You can specify this parameter with the key ID or the Amazon Resource Name (ARN) of the KMS key. You can’t use the key alias of the KMS key.

Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

If you are using encryption with cross-account or AWS service operations, you must use a fully qualified KMS key ARN. For more information, see Using encryption for cross-account operations . .. epigraph:

Your SSE-KMS configuration can only support 1 `customer managed key <https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk>`_ per directory bucket for the lifetime of the bucket. `AWS managed key <https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk>`_ ( ``aws/s3`` ) isn't supported. Also, after you specify a customer managed key for SSE-KMS and upload objects with this configuration, you can't override the customer managed key for your SSE-KMS configuration. To use a new customer manager key for your data, we recommend copying your existing objects to a new directory bucket with a new customer managed key. > Amazon S3 only supports symmetric encryption KMS keys. For more information, see `Asymmetric keys in AWS KMS <https://docs.aws.amazon.com//kms/latest/developerguide/symmetric-asymmetric.html>`_ in the *AWS Key Management Service Developer Guide* .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-serversideencryptionbydefault.html#cfn-s3express-directorybucket-serversideencryptionbydefault-kmsmasterkeyid

sse_algorithm

Server-side encryption algorithm to use for the default encryption.

For directory buckets, there are only two supported values for server-side encryption: AES256 and aws:kms .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-serversideencryptionbydefault.html#cfn-s3express-directorybucket-serversideencryptionbydefault-ssealgorithm

ServerSideEncryptionRuleProperty

class CfnDirectoryBucketPropsMixin.ServerSideEncryptionRuleProperty(*, bucket_key_enabled=None, server_side_encryption_by_default=None)

Bases: object

Specifies the default server-side encryption configuration.

Parameters:

bucket_key_enabled (Union[bool, IResolvable, None]) – Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket. S3 Bucket Keys are always enabled for GET and PUT operations on a directory bucket and can’t be disabled. It’s only allowed to set the BucketKeyEnabled element to true . S3 Bucket Keys aren’t supported, when you copy SSE-KMS encrypted objects from general purpose buckets to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through CopyObject , UploadPartCopy , the Copy operation in Batch Operations , or the import jobs . In this case, Amazon S3 makes a call to AWS KMS every time a copy request is made for a KMS-encrypted object. For more information, see Amazon S3 Bucket Keys in the Amazon S3 User Guide .
server_side_encryption_by_default (Union[IResolvable, ServerSideEncryptionByDefaultProperty, Dict[str, Any], None]) – Specifies the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn’t specify any server-side encryption, this default encryption will be applied.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-serversideencryptionrule.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_s3express import mixins as s3express_mixins

server_side_encryption_rule_property = s3express_mixins.CfnDirectoryBucketPropsMixin.ServerSideEncryptionRuleProperty(
    bucket_key_enabled=False,
    server_side_encryption_by_default=s3express_mixins.CfnDirectoryBucketPropsMixin.ServerSideEncryptionByDefaultProperty(
        kms_master_key_id="kmsMasterKeyId",
        sse_algorithm="sseAlgorithm"
    )
)

Attributes

bucket_key_enabled

Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket.

S3 Bucket Keys are always enabled for GET and PUT operations on a directory bucket and can’t be disabled. It’s only allowed to set the BucketKeyEnabled element to true .

S3 Bucket Keys aren’t supported, when you copy SSE-KMS encrypted objects from general purpose buckets to directory buckets, from directory buckets to general purpose buckets, or between directory buckets, through CopyObject , UploadPartCopy , the Copy operation in Batch Operations , or the import jobs . In this case, Amazon S3 makes a call to AWS KMS every time a copy request is made for a KMS-encrypted object.

For more information, see Amazon S3 Bucket Keys in the Amazon S3 User Guide .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-serversideencryptionrule.html#cfn-s3express-directorybucket-serversideencryptionrule-bucketkeyenabled

server_side_encryption_by_default

Specifies the default server-side encryption to apply to new objects in the bucket.

If a PUT Object request doesn’t specify any server-side encryption, this default encryption will be applied.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3express-directorybucket-serversideencryptionrule.html#cfn-s3express-directorybucket-serversideencryptionrule-serversideencryptionbydefault