import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
new SecureCloudFrontOriginBucket(scope: Construct, id: string, props: SecureCloudFrontOriginBucketProps)
Name | Type | Description |
---|---|---|
scope |
constructs.Construct |
No description. |
id |
string |
No description. |
props |
SecureCloudFrontOriginBucketProps |
No description. |
- Type: constructs.Construct
- Type: string
Name | Description |
---|---|
toString |
Returns a string representation of this construct. |
applyRemovalPolicy |
Apply the given removal policy to this resource. |
addEventNotification |
Adds a bucket notification event destination. |
addObjectCreatedNotification |
Subscribes a destination to receive notifications when an object is created in the bucket. |
addObjectRemovedNotification |
Subscribes a destination to receive notifications when an object is removed from the bucket. |
addToResourcePolicy |
Adds a statement to the resource policy for a principal (i.e. account/role/service) to perform actions on this bucket and/or its contents. Use bucketArn and arnForObjects(keys) to obtain ARNs for this bucket or objects. |
arnForObjects |
Returns an ARN that represents all objects within the bucket that match the key pattern specified. |
enableEventBridgeNotification |
Enables event bridge notification, causing all events below to be sent to EventBridge:. |
grantDelete |
Grants s3:DeleteObject* permission to an IAM principal for objects in this bucket. |
grantPublicAccess |
Allows unrestricted access to objects from this bucket. |
grantPut |
Grants s3:PutObject* and s3:Abort* permissions for this bucket to an IAM principal. |
grantPutAcl |
Grant the given IAM identity permissions to modify the ACLs of objects in the given Bucket. |
grantRead |
Grant read permissions for this bucket and it's contents to an IAM principal (Role/Group/User). |
grantReadWrite |
Grants read/write permissions for this bucket and it's contents to an IAM principal (Role/Group/User). |
grantWrite |
Grant write permissions to this bucket to an IAM principal. |
onCloudTrailEvent |
Define a CloudWatch event that triggers when something happens to this repository. |
onCloudTrailPutObject |
Defines an AWS CloudWatch event that triggers when an object is uploaded to the specified paths (keys) in this bucket using the PutObject API call. |
onCloudTrailWriteObject |
Defines an AWS CloudWatch event that triggers when an object at the specified paths (keys) in this bucket are written to. |
s3UrlForObject |
The S3 URL of an S3 object. For example:. |
transferAccelerationUrlForObject |
The https Transfer Acceleration URL of an S3 object. |
urlForObject |
The https URL of an S3 object. Specify regional: false at the options for non-regional URLs. For example:. |
virtualHostedUrlForObject |
The virtual hosted-style URL of an S3 object. Specify regional: false at the options for non-regional URL. For example:. |
addCorsRule |
Adds a cross-origin access configuration for objects in an Amazon S3 bucket. |
addInventory |
Add an inventory configuration. |
addLifecycleRule |
Add a lifecycle rule to the bucket. |
addMetric |
Adds a metrics configuration for the CloudWatch request metrics from the bucket. |
public toString(): string
Returns a string representation of this construct.
public applyRemovalPolicy(policy: RemovalPolicy): void
Apply the given removal policy to this resource.
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.
The resource can be deleted (RemovalPolicy.DESTROY
), or left in your AWS
account for data recovery and cleanup later (RemovalPolicy.RETAIN
).
- Type: aws-cdk-lib.RemovalPolicy
public addEventNotification(event: EventType, dest: IBucketNotificationDestination, filters: NotificationKeyFilter): void
Adds a bucket notification event destination.
https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html
Example
declare const myLambda: lambda.Function;
const bucket = new s3.Bucket(this, 'MyBucket');
bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.LambdaDestination(myLambda), {prefix: 'home/myusername/*'});
- Type: aws-cdk-lib.aws_s3.EventType
The event to trigger the notification.
- Type: aws-cdk-lib.aws_s3.IBucketNotificationDestination
The notification destination (Lambda, SNS Topic or SQS Queue).
- Type: aws-cdk-lib.aws_s3.NotificationKeyFilter
S3 object key filter rules to determine which objects trigger this event.
Each filter must include a prefix
and/or suffix
that will be matched against the s3 object key. Refer to the S3 Developer Guide
for details about allowed filter rules.
public addObjectCreatedNotification(dest: IBucketNotificationDestination, filters: NotificationKeyFilter): void
Subscribes a destination to receive notifications when an object is created in the bucket.
This is identical to calling
onEvent(EventType.OBJECT_CREATED)
.
- Type: aws-cdk-lib.aws_s3.IBucketNotificationDestination
The notification destination (see onEvent).
- Type: aws-cdk-lib.aws_s3.NotificationKeyFilter
Filters (see onEvent).
public addObjectRemovedNotification(dest: IBucketNotificationDestination, filters: NotificationKeyFilter): void
Subscribes a destination to receive notifications when an object is removed from the bucket.
This is identical to calling
onEvent(EventType.OBJECT_REMOVED)
.
- Type: aws-cdk-lib.aws_s3.IBucketNotificationDestination
The notification destination (see onEvent).
- Type: aws-cdk-lib.aws_s3.NotificationKeyFilter
Filters (see onEvent).
public addToResourcePolicy(permission: PolicyStatement): AddToResourcePolicyResult
Adds a statement to the resource policy for a principal (i.e. account/role/service) to perform actions on this bucket and/or its contents. Use bucketArn
and arnForObjects(keys)
to obtain ARNs for this bucket or objects.
Note that the policy statement may or may not be added to the policy.
For example, when an IBucket
is created from an existing bucket,
it's not possible to tell whether the bucket already has a policy
attached, let alone to re-use that policy to add more statements to it.
So it's safest to do nothing in these cases.
- Type: aws-cdk-lib.aws_iam.PolicyStatement
the policy statement to be added to the bucket's policy.
public arnForObjects(keyPattern: string): string
Returns an ARN that represents all objects within the bucket that match the key pattern specified.
To represent all keys, specify "*"
.
If you need to specify a keyPattern with multiple components, concatenate them into a single string, e.g.:
arnForObjects(home/${team}/${user}/*
)
- Type: string
public enableEventBridgeNotification(): void
Enables event bridge notification, causing all events below to be sent to EventBridge:.
Object Deleted (DeleteObject)
- Object Deleted (Lifecycle expiration)
- Object Restore Initiated
- Object Restore Completed
- Object Restore Expired
- Object Storage Class Changed
- Object Access Tier Changed
- Object ACL Updated
- Object Tags Added
- Object Tags Deleted
public grantDelete(identity: IGrantable, objectsKeyPattern?: any): Grant
Grants s3:DeleteObject* permission to an IAM principal for objects in this bucket.
- Type: aws-cdk-lib.aws_iam.IGrantable
The principal.
- Type: any
Restrict the permission to a certain key pattern (default '*').
public grantPublicAccess(allowedActions: string, keyPrefix?: string): Grant
Allows unrestricted access to objects from this bucket.
IMPORTANT: This permission allows anyone to perform actions on S3 objects in this bucket, which is useful for when you configure your bucket as a website and want everyone to be able to read objects in the bucket without needing to authenticate.
Without arguments, this method will grant read ("s3:GetObject") access to all objects ("*") in the bucket.
The method returns the iam.Grant
object, which can then be modified
as needed. For example, you can add a condition that will restrict access only
to an IPv4 range like this:
const grant = bucket.grantPublicAccess();
grant.resourceStatement!.addCondition(‘IpAddress’, { “aws:SourceIp”: “54.240.143.0/24” });
Note that if this IBucket
refers to an existing bucket, possibly not
managed by CloudFormation, this method will have no effect, since it's
impossible to modify the policy of an existing bucket.
- Type: string
the set of S3 actions to allow.
Default is "s3:GetObject".
- Type: string
the prefix of S3 object keys (e.g. home/*
). Default is "*".
public grantPut(identity: IGrantable, objectsKeyPattern?: any): Grant
Grants s3:PutObject* and s3:Abort* permissions for this bucket to an IAM principal.
If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.
- Type: aws-cdk-lib.aws_iam.IGrantable
The principal.
- Type: any
Restrict the permission to a certain key pattern (default '*').
public grantPutAcl(identity: IGrantable, objectsKeyPattern?: string): Grant
Grant the given IAM identity permissions to modify the ACLs of objects in the given Bucket.
If your application has the '@aws-cdk/aws-s3:grantWriteWithoutAcl' feature flag set,
calling grantWrite
or grantReadWrite
no longer grants permissions to modify the ACLs of the objects;
in this case, if you need to modify object ACLs, call this method explicitly.
- Type: aws-cdk-lib.aws_iam.IGrantable
- Type: string
public grantRead(identity: IGrantable, objectsKeyPattern?: any): Grant
Grant read permissions for this bucket and it's contents to an IAM principal (Role/Group/User).
If encryption is used, permission to use the key to decrypt the contents of the bucket will also be granted to the same principal.
- Type: aws-cdk-lib.aws_iam.IGrantable
The principal.
- Type: any
Restrict the permission to a certain key pattern (default '*').
public grantReadWrite(identity: IGrantable, objectsKeyPattern?: any): Grant
Grants read/write permissions for this bucket and it's contents to an IAM principal (Role/Group/User).
If an encryption key is used, permission to use the key for encrypt/decrypt will also be granted.
Before CDK version 1.85.0, this method granted the s3:PutObject*
permission that included s3:PutObjectAcl
,
which could be used to grant read/write object access to IAM principals in other accounts.
If you want to get rid of that behavior, update your CDK version to 1.85.0 or later,
and make sure the @aws-cdk/aws-s3:grantWriteWithoutAcl
feature flag is set to true
in the context
key of your cdk.json file.
If you've already updated, but still need the principal to have permissions to modify the ACLs,
use the grantPutAcl
method.
- Type: aws-cdk-lib.aws_iam.IGrantable
- Type: any
public grantWrite(identity: IGrantable, objectsKeyPattern?: any): Grant
Grant write permissions to this bucket to an IAM principal.
If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.
Before CDK version 1.85.0, this method granted the s3:PutObject*
permission that included s3:PutObjectAcl
,
which could be used to grant read/write object access to IAM principals in other accounts.
If you want to get rid of that behavior, update your CDK version to 1.85.0 or later,
and make sure the @aws-cdk/aws-s3:grantWriteWithoutAcl
feature flag is set to true
in the context
key of your cdk.json file.
If you've already updated, but still need the principal to have permissions to modify the ACLs,
use the grantPutAcl
method.
- Type: aws-cdk-lib.aws_iam.IGrantable
- Type: any
public onCloudTrailEvent(id: string, options?: OnCloudTrailBucketEventOptions): Rule
Define a CloudWatch event that triggers when something happens to this repository.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
- Type: string
The id of the rule.
- Type: aws-cdk-lib.aws_s3.OnCloudTrailBucketEventOptions
Options for adding the rule.
public onCloudTrailPutObject(id: string, options?: OnCloudTrailBucketEventOptions): Rule
Defines an AWS CloudWatch event that triggers when an object is uploaded to the specified paths (keys) in this bucket using the PutObject API call.
Note that some tools like aws s3 cp
will automatically use either
PutObject or the multipart upload API depending on the file size,
so using onCloudTrailWriteObject
may be preferable.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
- Type: string
The id of the rule.
- Type: aws-cdk-lib.aws_s3.OnCloudTrailBucketEventOptions
Options for adding the rule.
public onCloudTrailWriteObject(id: string, options?: OnCloudTrailBucketEventOptions): Rule
Defines an AWS CloudWatch event that triggers when an object at the specified paths (keys) in this bucket are written to.
This includes the events PutObject, CopyObject, and CompleteMultipartUpload.
Note that some tools like aws s3 cp
will automatically use either
PutObject or the multipart upload API depending on the file size,
so using this method may be preferable to onCloudTrailPutObject
.
Requires that there exists at least one CloudTrail Trail in your account that captures the event. This method will not create the Trail.
- Type: string
The id of the rule.
- Type: aws-cdk-lib.aws_s3.OnCloudTrailBucketEventOptions
Options for adding the rule.
public s3UrlForObject(key?: string): string
The S3 URL of an S3 object. For example:.
s3://onlybucket
s3://bucket/key
- Type: string
The S3 key of the object.
If not specified, the S3 URL of the bucket is returned.
public transferAccelerationUrlForObject(key?: string, options?: TransferAccelerationUrlOptions): string
The https Transfer Acceleration URL of an S3 object.
Specify dualStack: true
at the options
for dual-stack endpoint (connect to the bucket over IPv6). For example:
https://bucket.s3-accelerate.amazonaws.com
https://bucket.s3-accelerate.amazonaws.com/key
- Type: string
The S3 key of the object.
If not specified, the URL of the bucket is returned.
- Type: aws-cdk-lib.aws_s3.TransferAccelerationUrlOptions
Options for generating URL.
public urlForObject(key?: string): string
The https URL of an S3 object. Specify regional: false
at the options for non-regional URLs. For example:.
https://s3.us-west-1.amazonaws.com/onlybucket
https://s3.us-west-1.amazonaws.com/bucket/key
https://s3.cn-north-1.amazonaws.com.cn/china-bucket/mykey
- Type: string
The S3 key of the object.
If not specified, the URL of the bucket is returned.
public virtualHostedUrlForObject(key?: string, options?: VirtualHostedStyleUrlOptions): string
The virtual hosted-style URL of an S3 object. Specify regional: false
at the options for non-regional URL. For example:.
https://only-bucket.s3.us-west-1.amazonaws.com
https://bucket.s3.us-west-1.amazonaws.com/key
https://bucket.s3.amazonaws.com/key
https://china-bucket.s3.cn-north-1.amazonaws.com.cn/mykey
- Type: string
The S3 key of the object.
If not specified, the URL of the bucket is returned.
- Type: aws-cdk-lib.aws_s3.VirtualHostedStyleUrlOptions
Options for generating URL.
public addCorsRule(rule: CorsRule): void
Adds a cross-origin access configuration for objects in an Amazon S3 bucket.
- Type: aws-cdk-lib.aws_s3.CorsRule
The CORS configuration rule to add.
public addInventory(inventory: Inventory): void
Add an inventory configuration.
- Type: aws-cdk-lib.aws_s3.Inventory
configuration to add.
public addLifecycleRule(rule: LifecycleRule): void
Add a lifecycle rule to the bucket.
- Type: aws-cdk-lib.aws_s3.LifecycleRule
The rule to add.
public addMetric(metric: BucketMetrics): void
Adds a metrics configuration for the CloudWatch request metrics from the bucket.
- Type: aws-cdk-lib.aws_s3.BucketMetrics
The metric configuration to add.
Name | Description |
---|---|
isConstruct |
Checks if x is a construct. |
isOwnedResource |
Returns true if the construct was created by CDK, and false otherwise. |
isResource |
Check whether the given construct is a Resource. |
fromBucketArn |
No description. |
fromBucketAttributes |
Creates a Bucket construct that represents an external bucket. |
fromBucketName |
No description. |
fromCfnBucket |
Create a mutable IBucket based on a low-level CfnBucket . |
validateBucketName |
Thrown an exception if the given bucket name is not valid. |
import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
SecureCloudFrontOriginBucket.isConstruct(x: any)
Checks if x
is a construct.
- Type: any
Any object.
import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
SecureCloudFrontOriginBucket.isOwnedResource(construct: IConstruct)
Returns true if the construct was created by CDK, and false otherwise.
- Type: constructs.IConstruct
import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
SecureCloudFrontOriginBucket.isResource(construct: IConstruct)
Check whether the given construct is a Resource.
- Type: constructs.IConstruct
import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
SecureCloudFrontOriginBucket.fromBucketArn(scope: Construct, id: string, bucketArn: string)
- Type: constructs.Construct
- Type: string
- Type: string
import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
SecureCloudFrontOriginBucket.fromBucketAttributes(scope: Construct, id: string, attrs: BucketAttributes)
Creates a Bucket construct that represents an external bucket.
- Type: constructs.Construct
The parent creating construct (usually this
).
- Type: string
The construct's name.
- Type: aws-cdk-lib.aws_s3.BucketAttributes
A BucketAttributes
object.
Can be obtained from a call to
bucket.export()
or manually created.
import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
SecureCloudFrontOriginBucket.fromBucketName(scope: Construct, id: string, bucketName: string)
- Type: constructs.Construct
- Type: string
- Type: string
import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
SecureCloudFrontOriginBucket.fromCfnBucket(cfnBucket: CfnBucket)
Create a mutable IBucket
based on a low-level CfnBucket
.
- Type: aws-cdk-lib.aws_s3.CfnBucket
import { SecureCloudFrontOriginBucket } from '@yicr/secure-cloudfront-origin-bucket'
SecureCloudFrontOriginBucket.validateBucketName(physicalName: string)
Thrown an exception if the given bucket name is not valid.
- Type: string
name of the bucket.
Name | Type | Description |
---|---|---|
node |
constructs.Node |
The tree node. |
env |
aws-cdk-lib.ResourceEnvironment |
The environment this resource belongs to. |
stack |
aws-cdk-lib.Stack |
The stack in which this resource is defined. |
bucketArn |
string |
The ARN of the bucket. |
bucketDomainName |
string |
The IPv4 DNS name of the specified bucket. |
bucketDualStackDomainName |
string |
The IPv6 DNS name of the specified bucket. |
bucketName |
string |
The name of the bucket. |
bucketRegionalDomainName |
string |
The regional domain name of the specified bucket. |
bucketWebsiteDomainName |
string |
The Domain name of the static website. |
bucketWebsiteUrl |
string |
The URL of the static website. |
encryptionKey |
aws-cdk-lib.aws_kms.IKey |
Optional KMS encryption key associated with this bucket. |
isWebsite |
boolean |
If this bucket has been configured for static website hosting. |
policy |
aws-cdk-lib.aws_s3.BucketPolicy |
The resource policy associated with this bucket. |
public readonly node: Node;
- Type: constructs.Node
The tree node.
public readonly env: ResourceEnvironment;
- Type: aws-cdk-lib.ResourceEnvironment
The environment this resource belongs to.
For resources that are created and managed by the CDK (generally, those created by creating new class instances like Role, Bucket, etc.), this is always the same as the environment of the stack they belong to; however, for imported resources (those obtained from static methods like fromRoleArn, fromBucketName, etc.), that might be different than the stack they were imported into.
public readonly stack: Stack;
- Type: aws-cdk-lib.Stack
The stack in which this resource is defined.
public readonly bucketArn: string;
- Type: string
The ARN of the bucket.
public readonly bucketDomainName: string;
- Type: string
The IPv4 DNS name of the specified bucket.
public readonly bucketDualStackDomainName: string;
- Type: string
The IPv6 DNS name of the specified bucket.
public readonly bucketName: string;
- Type: string
The name of the bucket.
public readonly bucketRegionalDomainName: string;
- Type: string
The regional domain name of the specified bucket.
public readonly bucketWebsiteDomainName: string;
- Type: string
The Domain name of the static website.
public readonly bucketWebsiteUrl: string;
- Type: string
The URL of the static website.
public readonly encryptionKey: IKey;
- Type: aws-cdk-lib.aws_kms.IKey
Optional KMS encryption key associated with this bucket.
public readonly isWebsite: boolean;
- Type: boolean
If this bucket has been configured for static website hosting.
public readonly policy: BucketPolicy;
- Type: aws-cdk-lib.aws_s3.BucketPolicy
The resource policy associated with this bucket.
If autoCreatePolicy
is true, a BucketPolicy
will be created upon the
first call to addToResourcePolicy(s).
import { SecureCloudFrontOriginBucketProps } from '@yicr/secure-cloudfront-origin-bucket'
const secureCloudFrontOriginBucketProps: SecureCloudFrontOriginBucketProps = { ... }
Name | Type | Description |
---|---|---|
cloudFrontOriginAccessIdentityS3CanonicalUserId |
string |
No description. |
bucketName |
string |
No description. |
public readonly cloudFrontOriginAccessIdentityS3CanonicalUserId: string;
- Type: string
public readonly bucketName: string;
- Type: string