@aws-cdk/aws-s3

What is @aws-cdk/aws-s3?

@aws-cdk/aws-s3 is an AWS Cloud Development Kit (CDK) library that allows you to define Amazon S3 buckets and related resources using code. This package provides a high-level, object-oriented abstraction to create and manage S3 buckets, configure bucket policies, set up event notifications, and more.

What are @aws-cdk/aws-s3's main functionalities?

Create an S3 Bucket

This code sample demonstrates how to create a versioned S3 bucket with a removal policy that destroys the bucket when the stack is deleted.

const s3 = require('@aws-cdk/aws-s3');
const cdk = require('@aws-cdk/core');

class MyStack extends cdk.Stack {
  constructor(scope, id, props) {
    super(scope, id, props);

    new s3.Bucket(this, 'MyFirstBucket', {
      versioned: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
  }
}

const app = new cdk.App();
new MyStack(app, 'MyStack');

Add Bucket Policy

This code sample shows how to add a bucket policy to an S3 bucket, allowing any principal to perform the 's3:GetObject' action on all objects in the bucket.

const s3 = require('@aws-cdk/aws-s3');
const cdk = require('@aws-cdk/core');

class MyStack extends cdk.Stack {
  constructor(scope, id, props) {
    super(scope, id, props);

    const bucket = new s3.Bucket(this, 'MyBucket');

    bucket.addToResourcePolicy(new cdk.aws_iam.PolicyStatement({
      actions: ['s3:GetObject'],
      resources: [bucket.arnForObjects('*')],
      principals: [new cdk.aws_iam.AnyPrincipal()],
    }));
  }
}

const app = new cdk.App();
new MyStack(app, 'MyStack');

Enable Event Notifications

This code sample demonstrates how to enable event notifications for an S3 bucket. It sets up a notification to an SNS topic whenever an object is created in the bucket.

const s3 = require('@aws-cdk/aws-s3');
const cdk = require('@aws-cdk/core');
const sns = require('@aws-cdk/aws-sns');
const s3n = require('@aws-cdk/aws-s3-notifications');

class MyStack extends cdk.Stack {
  constructor(scope, id, props) {
    super(scope, id, props);

    const bucket = new s3.Bucket(this, 'MyBucket');
    const topic = new sns.Topic(this, 'MyTopic');

    bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.SnsDestination(topic));
  }
}

const app = new cdk.App();
new MyStack(app, 'MyStack');

Other packages similar to @aws-cdk/aws-s3

aws-sdk

The aws-sdk package is the official AWS SDK for JavaScript, which provides low-level APIs for interacting with AWS services, including S3. Unlike @aws-cdk/aws-s3, which is used for defining infrastructure as code, aws-sdk is used for making API calls to AWS services at runtime.

serverless

The serverless package is a framework for building and deploying serverless applications on AWS and other cloud providers. It allows you to define S3 buckets and other resources in a serverless.yml configuration file. While it provides similar functionalities, it is more focused on serverless architectures and deployments.

terraform

Terraform is an open-source infrastructure as code software tool that provides a consistent CLI workflow to manage hundreds of cloud services. It allows you to define S3 buckets and other AWS resources using HashiCorp Configuration Language (HCL). Terraform is cloud-agnostic and can manage resources across multiple cloud providers.

README

AWS S3 Construct Library

Define an unencrypted S3 bucket.

new Bucket(this, 'MyFirstBucket');

Bucket constructs expose the following deploy-time attributes:

• bucketArn - the ARN of the bucket (i.e. arn:aws:s3:::bucket_name)
• bucketName - the name of the bucket (i.e. bucket_name)
• bucketUrl - the URL of the bucket (i.e. https://s3.us-west-1.amazonaws.com/onlybucket)
• arnForObjects(...pattern) - the ARN of an object or objects within the bucket (i.e. arn:aws:s3:::my_corporate_bucket/exampleobject.png or arn:aws:s3:::my_corporate_bucket/Development/*)
• urlForObject(key) - the URL of an object within the bucket (i.e. https://s3.cn-north-1.amazonaws.com.cn/china-bucket/mykey)

Encryption

Define a KMS-encrypted bucket:

const bucket = new Bucket(this, 'MyUnencryptedBucket', {
    encryption: BucketEncryption.Kms
});

// you can access the encryption key:
assert(bucket.encryptionKey instanceof kms.EncryptionKey);

You can also supply your own key:

const myKmsKey = new kms.EncryptionKey(this, 'MyKey');

const bucket = new Bucket(this, 'MyEncryptedBucket', {
    encryption: BucketEncryption.Kms,
    encryptionKey: myKmsKey
});

assert(bucket.encryptionKey === myKmsKey);

Use BucketEncryption.ManagedKms to use the S3 master KMS key:

const bucket = new Bucket(this, 'Buck', {
    encryption: BucketEncryption.ManagedKms
});

assert(bucket.encryptionKey == null);

Permissions

A bucket policy will be automatically created for the bucket upon the first call to addToResourcePolicy(statement):

const bucket = new Bucket(this, 'MyBucket');
bucket.addToResourcePolicy(new iam.PolicyStatement()
  .addActions('s3:GetObject')
  .addResources(bucket.arnForObjects('file.txt'))
  .addAccountRootPrincipal());

Most of the time, you won't have to manipulate the bucket policy directly. Instead, buckets have "grant" methods called to give prepackaged sets of permissions to other resources. For example:

const lambda = new lambda.Function(this, 'Lambda', { /* ... */ });

const bucket = new Bucket(this, 'MyBucket');
bucket.grantReadWrite(lambda.role);

Will give the Lambda's execution role permissions to read and write from the bucket.

Buckets as sources in CodePipeline

This package also defines an Action that allows you to use a Bucket as a source in CodePipeline:

import codepipeline = require('@aws-cdk/aws-codepipeline');
import s3 = require('@aws-cdk/aws-s3');

const sourceBucket = new s3.Bucket(this, 'MyBucket', {
  versioned: true, // a Bucket used as a source in CodePipeline must be versioned
});

const pipeline = new codepipeline.Pipeline(this, 'MyPipeline');
const sourceAction = new s3.PipelineSourceAction({
  actionName: 'S3Source',
  bucket: sourceBucket,
  bucketKey: 'path/to/file.zip',
});
pipeline.addStage({
  name: 'Source',
  actions: [sourceAction],
});

You can also create the action from the Bucket directly:

// equivalent to the code above:
const sourceAction = sourceBucket.toCodePipelineSourceAction({
  actionName: 'S3Source',
  bucketKey: 'path/to/file.zip',
});

By default, the Pipeline will poll the Bucket to detect changes. You can change that behavior to use CloudWatch Events by setting the pollForSourceChanges property to false (it's true by default). If you do that, make sure the source Bucket is part of an AWS CloudTrail Trail - otherwise, the CloudWatch Events will not be emitted, and your Pipeline will not react to changes in the Bucket. You can do it through the CDK:

import cloudtrail = require('@aws-cdk/aws-cloudtrail');

const key = 'some/key.zip';
const trail = new cloudtrail.CloudTrail(this, 'CloudTrail');
trail.addS3EventSelector([sourceBucket.arnForObjects(key)], cloudtrail.ReadWriteType.WriteOnly);
const sourceAction = sourceBucket.toCodePipelineSourceAction({
  actionName: 'S3Source',
  bucketKey: key,
  pollForSourceChanges: false, // default: true
});

Buckets as deploy targets in CodePipeline

This package also defines an Action that allows you to use a Bucket as a deployment target in CodePipeline:

import codepipeline = require('@aws-cdk/aws-codepipeline');
import s3 = require('@aws-cdk/aws-s3');

const targetBucket = new s3.Bucket(this, 'MyBucket', {});

const pipeline = new codepipeline.Pipeline(this, 'MyPipeline');
const deployAction = new s3.PipelineDeployAction({
  actionName: 'S3Deploy',
  stage: deployStage,
  bucket: targetBucket,
  inputArtifact: sourceAction.outputArtifact,
});
const deployStage = pipeline.addStage({
  name: 'Deploy',
  actions: [deployAction],
});

You can also create the action from the Bucket directly:

// equivalent to the code above:
const deployAction = targetBucket.toCodePipelineDeployAction({
  actionName: 'S3Deploy',
  extract: false, // default: true
  objectKey: 'path/in/bucket', // required if extract is false
  inputArtifact: sourceAction.outputArtifact,
});

Sharing buckets between stacks

To use a bucket in a different stack in the same CDK application, pass the object to the other stack:

sharing bucket between stacks

Importing existing buckets

To import an existing bucket into your CDK application, use the Bucket.import factory method. This method accepts a BucketImportProps which describes the properties of the already existing bucket:

const bucket = Bucket.import(this, {
    bucketArn: 'arn:aws:s3:::my-bucket'
});

// now you can just call methods on the bucket
bucket.grantReadWrite(user);

Bucket Notifications

The Amazon S3 notification feature enables you to receive notifications when certain events happen in your bucket as described under S3 Bucket Notifications of the S3 Developer Guide.

To subscribe for bucket notifications, use the bucket.onEvent method. The bucket.onObjectCreated and bucket.onObjectRemoved can also be used for these common use cases.

The following example will subscribe an SNS topic to be notified of all ``s3:ObjectCreated:*` events:

const myTopic = new sns.Topic(this, 'MyTopic');
bucket.onEvent(s3.EventType.ObjectCreated, myTopic);

This call will also ensure that the topic policy can accept notifications for this specific bucket.

The following destinations are currently supported:

• sns.Topic
• sqs.Queue
• lambda.Function

It is also possible to specify S3 object key filters when subscribing. The following example will notify myQueue when objects prefixed with foo/ and have the .jpg suffix are removed from the bucket.

bucket.onEvent(s3.EventType.ObjectRemoved, myQueue, { prefix: 'foo/', suffix: '.jpg' });

Block Public Access

Use blockPublicAccess to specify block public access settings on the bucket.

Enable all block public access settings:

const bucket = new Bucket(this, 'MyBlockedBucket', {
    blockPublicAccess: BlockPublicAccess.BlockAll
});

Block and ignore public ACLs:

const bucket = new Bucket(this, 'MyBlockedBucket', {
    blockPublicAccess: BlockPublicAccess.BlockAcls
});

Alternatively, specify the settings manually:

const bucket = new Bucket(this, 'MyBlockedBucket', {
    blockPublicAccess: new BlockPublicAccess({ blockPublicPolicy: true })
});

When blockPublicPolicy is set to true, grantPublicRead() throws an error.

Changelog

0.26.0 (2019-03-20)

Bug Fixes

• aws-cdk: fix VpcNetwork.importFromContext() (#2008) (e1a1a7b), closes #1998
• aws-cdk: update F# template to latest CDK version (#2006) (bda12f2)
• cdk: merge cloudFormation tags with aspect tags (#1762) (bfb14b6), closes #1725
• cfn2ts: properly de-Tokenize L1 string-arrays (#2033) (1e50383), closes #2030
• core: allow embedding condition expression as strings (#2007) (6afa87f), closes #1984
• ecs: make TaskDefinition accept IRoles (#2034) (f32431a), closes #1925
• lambda: expose underlying function's role on the alias (#2024) (de296de)
• stepfunctions: Actually perform rendering of NotCondition (06b59d9)
• toolkit: 'cdk deploy' support updates to Outputs (#2029) (23509ae), closes #778
• toolkit: increase number of retries (#2053) (133dc98), closes #1647
• rename core classes adding a Cfn prefix (#1960) (5886bf6), closes #1462 #288

Code Refactoring

• name "toCloudFormation" internal (renamed to _toCloudFormation) (#2047) (515868b), closes #2044 #2016

Features

• aws-cdk: support fixed repository name for DockerImageAsset (#2032) (942f938)
• aws-rds: ability to add an existing security group to RDS cluster (#2021) (1f24336)
• cfn2ts: make cfn2ts output TSDoc-compatible docblocks (#2000) (c6c66e9)
• cfnspec: update to version 2.28.0 (#2035) (6a671f2)
• cloudformation: allow specifying additional inputs for deploy Actions (#2020) (2d463be), closes #1247
• core: can use Constructs to model applications (#1940) (32c2377), closes #1479
• ecs: support private registry authentication (#1737) (11ed691), closes #1698
• glue: add L2 resources for Database and Table (#1988) (3117cd3)
• region-info: Model region-specific information (#1839) (946b444), closes #1282
• servicediscovery: AWS Cloud Map construct library (#1804) (1187366)
• ses: add constructs for email receiving (#1971) (3790858)
• add more directories excluded and treated as source in the JetBrains script. (#1961) (a1df717)

BREAKING CHANGES TO EXPERIMENTAL FEATURES

• “toCloudFormation” is now internal and should not be called directly. Instead use “app.synthesizeStack”
• ecs: ContainerImage.fromDockerHub has been renamed to ContainerImage.fromRegistry.
• rename Condition to CfnCondition.
• rename StackElement to CfnElement.
• rename Parameter to CfnParameter.
• rename Resource to CfnResource.
• rename Output to CfnOutput.
• rename Mapping to CfnMapping.
• rename Referenceable to CfnRefElement.
• rename IConditionExpression to ICfnConditionExpression.
• rename CfnReference to Reference.
• rename Rule to CfnRule.