Security News
The Unpaid Backbone of Open Source: Solo Maintainers Face Increasing Security Demands
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
@aws-cdk/aws-s3
Advanced tools
@aws-cdk/aws-s3 is an AWS Cloud Development Kit (CDK) library that allows you to define Amazon S3 buckets and related resources using code. This package provides a high-level, object-oriented abstraction to create and manage S3 buckets, configure bucket policies, set up event notifications, and more.
Create an S3 Bucket
This code sample demonstrates how to create a versioned S3 bucket with a removal policy that destroys the bucket when the stack is deleted.
const s3 = require('@aws-cdk/aws-s3');
const cdk = require('@aws-cdk/core');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
new s3.Bucket(this, 'MyFirstBucket', {
versioned: true,
removalPolicy: cdk.RemovalPolicy.DESTROY,
});
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
Add Bucket Policy
This code sample shows how to add a bucket policy to an S3 bucket, allowing any principal to perform the 's3:GetObject' action on all objects in the bucket.
const s3 = require('@aws-cdk/aws-s3');
const cdk = require('@aws-cdk/core');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
const bucket = new s3.Bucket(this, 'MyBucket');
bucket.addToResourcePolicy(new cdk.aws_iam.PolicyStatement({
actions: ['s3:GetObject'],
resources: [bucket.arnForObjects('*')],
principals: [new cdk.aws_iam.AnyPrincipal()],
}));
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
Enable Event Notifications
This code sample demonstrates how to enable event notifications for an S3 bucket. It sets up a notification to an SNS topic whenever an object is created in the bucket.
const s3 = require('@aws-cdk/aws-s3');
const cdk = require('@aws-cdk/core');
const sns = require('@aws-cdk/aws-sns');
const s3n = require('@aws-cdk/aws-s3-notifications');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
const bucket = new s3.Bucket(this, 'MyBucket');
const topic = new sns.Topic(this, 'MyTopic');
bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.SnsDestination(topic));
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
The aws-sdk package is the official AWS SDK for JavaScript, which provides low-level APIs for interacting with AWS services, including S3. Unlike @aws-cdk/aws-s3, which is used for defining infrastructure as code, aws-sdk is used for making API calls to AWS services at runtime.
The serverless package is a framework for building and deploying serverless applications on AWS and other cloud providers. It allows you to define S3 buckets and other resources in a serverless.yml configuration file. While it provides similar functionalities, it is more focused on serverless architectures and deployments.
Terraform is an open-source infrastructure as code software tool that provides a consistent CLI workflow to manage hundreds of cloud services. It allows you to define S3 buckets and other AWS resources using HashiCorp Configuration Language (HCL). Terraform is cloud-agnostic and can manage resources across multiple cloud providers.
Define an unencrypted S3 bucket.
new Bucket(this, 'MyFirstBucket');
Bucket
constructs expose the following deploy-time attributes:
bucketArn
- the ARN of the bucket (i.e. arn:aws:s3:::bucket_name
)bucketName
- the name of the bucket (i.e. bucket_name
)bucketUrl
- the URL of the bucket (i.e.
https://s3.us-west-1.amazonaws.com/onlybucket
)arnForObjects(...pattern)
- the ARN of an object or objects within the
bucket (i.e.
arn:aws:s3:::my_corporate_bucket/exampleobject.png
or
arn:aws:s3:::my_corporate_bucket/Development/*
)urlForObject(key)
- the URL of an object within the bucket (i.e.
https://s3.cn-north-1.amazonaws.com.cn/china-bucket/mykey
)Define a KMS-encrypted bucket:
const bucket = new Bucket(this, 'MyUnencryptedBucket', {
encryption: BucketEncryption.Kms
});
// you can access the encryption key:
assert(bucket.encryptionKey instanceof kms.Key);
You can also supply your own key:
const myKmsKey = new kms.EncryptionKey(this, 'MyKey');
const bucket = new Bucket(this, 'MyEncryptedBucket', {
encryption: BucketEncryption.Kms,
encryptionKey: myKmsKey
});
assert(bucket.encryptionKey === myKmsKey);
Use BucketEncryption.ManagedKms
to use the S3 master KMS key:
const bucket = new Bucket(this, 'Buck', {
encryption: BucketEncryption.ManagedKms
});
assert(bucket.encryptionKey == null);
A bucket policy will be automatically created for the bucket upon the first call to
addToResourcePolicy(statement)
:
const bucket = new Bucket(this, 'MyBucket');
bucket.addToResourcePolicy(new iam.PolicyStatement()
.addActions('s3:GetObject')
.addResources(bucket.arnForObjects('file.txt'))
.addAccountRootPrincipal());
Most of the time, you won't have to manipulate the bucket policy directly. Instead, buckets have "grant" methods called to give prepackaged sets of permissions to other resources. For example:
const lambda = new lambda.Function(this, 'Lambda', { /* ... */ });
const bucket = new Bucket(this, 'MyBucket');
bucket.grantReadWrite(lambda.role);
Will give the Lambda's execution role permissions to read and write from the bucket.
To use a bucket in a different stack in the same CDK application, pass the object to the other stack:
To import an existing bucket into your CDK application, use the Bucket.import
factory method. This method accepts a
BucketImportProps
which describes the properties of the already existing bucket:
const bucket = Bucket.import(this, {
bucketArn: 'arn:aws:s3:::my-bucket'
});
// now you can just call methods on the bucket
bucket.grantReadWrite(user);
The Amazon S3 notification feature enables you to receive notifications when certain events happen in your bucket as described under S3 Bucket Notifications of the S3 Developer Guide.
To subscribe for bucket notifications, use the bucket.onEvent
method. The
bucket.onObjectCreated
and bucket.onObjectRemoved
can also be used for these
common use cases.
The following example will subscribe an SNS topic to be notified of all ``s3:ObjectCreated:*` events:
const myTopic = new sns.Topic(this, 'MyTopic');
bucket.onEvent(s3.EventType.ObjectCreated, myTopic);
This call will also ensure that the topic policy can accept notifications for this specific bucket.
The following destinations are currently supported:
sns.Topic
sqs.Queue
lambda.Function
It is also possible to specify S3 object key filters when subscribing. The
following example will notify myQueue
when objects prefixed with foo/
and
have the .jpg
suffix are removed from the bucket.
bucket.onEvent(s3.EventType.ObjectRemoved, myQueue, { prefix: 'foo/', suffix: '.jpg' });
Use blockPublicAccess
to specify block public access settings on the bucket.
Enable all block public access settings:
const bucket = new Bucket(this, 'MyBlockedBucket', {
blockPublicAccess: BlockPublicAccess.BlockAll
});
Block and ignore public ACLs:
const bucket = new Bucket(this, 'MyBlockedBucket', {
blockPublicAccess: BlockPublicAccess.BlockAcls
});
Alternatively, specify the settings manually:
const bucket = new Bucket(this, 'MyBlockedBucket', {
blockPublicAccess: new BlockPublicAccess({ blockPublicPolicy: true })
});
When blockPublicPolicy
is set to true
, grantPublicRead()
throws an error.
0.32.0 (2019-05-24)
@aws-cdk/aws-route53-targets
package.IBucket.arnForObject
method no longer
concatenates path fragments on your behalf. Pass the /
-concatenated
key pattern instead.export
methods from all AWS resources have been removed. CloudFormation Exports are now automatically created when attributes are referenced across stacks within the same app. To export resources manually, you can explicitly define a CfnOutput
.kms.EncryptionKey
renamed to kms.Key
ec2.VpcNetwork
renamed to ec2.Vpc
ec2.VpcSubnet
renamed to ec2.Subnet
cloudtrail.CloudTrail
renamed to
cloudtrail.Trail`XxxAttribute
and XxxImportProps
interfaces which were no longer in used after their corresponding export
method was deleted and there was no use for them in imports.ecs.ClusterAttributes
now accepts IVpc
and ISecurityGroup
instead of attributes. You can use their
corresponding fromXxx
methods to import them as needed.servicediscovery.CnameInstance.instanceCname
renamed to cname
.glue.IDatabase.locationUrl
is now only in glue.Database
(not on the interface)ec2.TcpPortFromAttribute
and UdpPortFromAttribute
removed. Use TcpPort
and UdpPort
with new Token(x).toNumber
instead.ec2.VpcNetwork.importFromContext
renamed to ec2.Vpc.fromLookup
iam.IRole.roleId
has been removed from the interface, but Role.roleId
is still available for owned resources.loadBalancer
property in ServerDeploymentGroupProps has been changed.apigateway.ResourceBase.trackChild
is now internal.cloudfront.S3OriginConfig.originAccessIdentity
is now originAccessIdentityId
codedeploy.LambdaDeploymentGroup.alarms
is now cloudwatch.IAlarm[]
(previously cloudwatch.Alarm[]
)codepipeline.crossRegionScaffoldingStacks
renamed to crossRegionScaffolding
codepipeline.CrossRegionScaffoldingStack
renamed to codepipeline.CrossRegionScaffolding
and cannot be instantiated (abstract)ec2.VpcSubnet.addDefaultRouteToNAT
renamed to addDefaultNatRoute
and made publicec2.VpcSubnet.addDefaultRouteToIGW
renamed to addDefaultInternetRoute
, made public and first argument is the gateway ID (string) and not the CFN L1 classecs.Ec2EventRuleTarget.taskDefinition
is now ITaskDefinition
(previously TaskDefinition
)lambda.IEventSource.bind
now accepts IFunction
instead of FunctionBase
. Use IFunction.addEventSourceMapping
to add an event source mapping under the function.lambda.Layer.grantUsage
renamed to lambda.layer.addPermission
and returns voidstepfunctions.StateMachine.role
is now iam.IRole
(previously iam.Role
)onXxx()
CloudWatch Event methods now have the signature:
resource.onEvent('SomeId', {
target: new SomeTarget(...),
// options
});
onAlarm
was renamed to addAlarmAction
onOk
was renamed to addOkAction
onInsufficientData
was renamed to addInsufficientDataAction
onLifecycleTransition
was renamed to addLifecycleHook
onPreHook
was renamed to addPreHook
onPostHook
was renamed to addPostHook
onXxx
were renamed to addXxxTrigger
onImagePushed
was renamed to onCloudTrailImagePushed
onEvent
was renamed to addEventNotification
onObjectCreated
was renamed to addObjectCreatedNotification
onObjectRemoved
was renamed to addObjectRemovedNotification
onPutObject
was renamed to onCloudTrailPutObject
FAQs
The CDK Construct Library for AWS::S3
The npm package @aws-cdk/aws-s3 receives a total of 114,777 weekly downloads. As such, @aws-cdk/aws-s3 popularity was classified as popular.
We found that @aws-cdk/aws-s3 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
Security News
License exceptions modify the terms of open source licenses, impacting how software can be used, modified, and distributed. Developers should be aware of the legal implications of these exceptions.
Security News
A developer is accusing Tencent of violating the GPL by modifying a Python utility and changing its license to BSD, highlighting the importance of copyleft compliance.