interface GuS3BucketProps {
    accessControl?: BucketAccessControl;
    app: string;
    autoDeleteObjects?: boolean;
    blockPublicAccess?: BlockPublicAccess;
    bucketKeyEnabled?: boolean;
    bucketName?: string;
    cors?: CorsRule[];
    encryption?: BucketEncryption;
    encryptionKey?: IKey;
    enforceSSL?: boolean;
    eventBridgeEnabled?: boolean;
    intelligentTieringConfigurations?: IntelligentTieringConfiguration[];
    inventories?: Inventory[];
    lifecycleRules?: LifecycleRule[];
    metrics?: BucketMetrics[];
    minimumTLSVersion?: number;
    notificationsHandlerRole?: IRole;
    objectLockDefaultRetention?: ObjectLockRetention;
    objectLockEnabled?: boolean;
    objectOwnership?: ObjectOwnership;
    publicReadAccess?: boolean;
    serverAccessLogsBucket?: IBucket;
    serverAccessLogsPrefix?: string;
    targetObjectKeyFormat?: TargetObjectKeyFormat;
    transferAcceleration?: boolean;
    versioned?: boolean;
    websiteErrorDocument?: string;
    websiteIndexDocument?: string;
    websiteRedirect?: RedirectTarget;
    websiteRoutingRules?: RoutingRule[];

Hierarchy (view full)

  • Omit<BucketProps, "removalPolicy">
  • AppIdentity
    • GuS3BucketProps


accessControl?: BucketAccessControl

Specifies a canned ACL that grants predefined permissions to the bucket.


app: string
autoDeleteObjects?: boolean

Whether all objects should be automatically deleted when the bucket is removed from the stack or when the stack is deleted.

Requires the removalPolicy to be set to RemovalPolicy.DESTROY.

Warning if you have deployed a bucket with autoDeleteObjects: true, switching this to false in a CDK version before 1.126.0 will lead to all objects in the bucket being deleted. Be sure to update your bucket resources by deploying with CDK version 1.126.0 or later before switching this value to false.


blockPublicAccess?: BlockPublicAccess

The block public access configuration of this bucket.



- CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
bucketKeyEnabled?: boolean

Whether Amazon S3 should use its own intermediary key to generate data keys.

Only relevant when using KMS for encryption.

  • If not enabled, every object GET and PUT will cause an API call to KMS (with the attendant cost implications of that).
  • If enabled, S3 will use its own time-limited key instead.

Only relevant, when Encryption is set to BucketEncryption.KMS or BucketEncryption.KMS_MANAGED.


- false
bucketName?: string

Physical name of this bucket.


- Assigned by CloudFormation (recommended).
cors?: CorsRule[]

The CORS configuration of this bucket.

encryption?: BucketEncryption

The kind of server-side encryption to apply to this bucket.

If you choose KMS, you can specify a KMS key via encryptionKey. If encryption key is not specified, a key will automatically be created.


  • KMS if encryptionKey is specified, or UNENCRYPTED otherwise. But if UNENCRYPTED is specified, the bucket will be encrypted as S3_MANAGED automatically.
encryptionKey?: IKey

External KMS key to use for bucket encryption.

The encryption property must be either not specified or set to KMS or DSSE. An error will be emitted if encryption is set to UNENCRYPTED or S3_MANAGED.


  • If encryption is set to KMS and this property is undefined, a new KMS key will be created and associated with this bucket.
enforceSSL?: boolean

Enforces SSL for requests. S3.5 of the AWS Foundational Security Best Practices Regarding S3.

eventBridgeEnabled?: boolean

Whether this bucket should send notifications to Amazon EventBridge or not.


intelligentTieringConfigurations?: IntelligentTieringConfiguration[]

Inteligent Tiering Configurations



No Intelligent Tiiering Configurations.
inventories?: Inventory[]

The inventory configuration of the bucket.

lifecycleRules?: LifecycleRule[]

Rules that define how Amazon S3 manages objects during their lifetime.


- No lifecycle rules.
metrics?: BucketMetrics[]

The metrics configuration of this bucket.

minimumTLSVersion?: number

Enforces minimum TLS version for requests.

Requires enforceSSL to be enabled.

notificationsHandlerRole?: IRole

The role to be used by the notifications handler


- a new role will be created.
objectLockDefaultRetention?: ObjectLockRetention

The default retention mode and rules for S3 Object Lock.

Default retention can be configured after a bucket is created if the bucket already has object lock enabled. Enabling object lock for existing buckets is not supported.

objectLockEnabled?: boolean

Enable object lock on the bucket.

Enabling object lock for existing buckets is not supported. Object lock must be enabled when the bucket is created.



false, unless objectLockDefaultRetention is set (then, true)
objectOwnership?: ObjectOwnership

The objectOwnership of the bucket.



- No ObjectOwnership configuration, uploading account will own the object.
publicReadAccess?: boolean

Grants public read access to all objects in the bucket. Similar to calling bucket.grantPublicAccess()


serverAccessLogsBucket?: IBucket

Destination bucket for the server access logs.


- If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
serverAccessLogsPrefix?: string

Optional log file prefix to use for the bucket's access logs. If defined without "serverAccessLogsBucket", enables access logs to current bucket with this prefix.


- No log file prefix
targetObjectKeyFormat?: TargetObjectKeyFormat

Optional key format for log objects.


- the default key format is: [DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
transferAcceleration?: boolean

Whether this bucket should have transfer acceleration turned on or not.


versioned?: boolean

Whether this bucket should have versioning turned on or not.


false (unless object lock is enabled, then true)
websiteErrorDocument?: string

The name of the error document (e.g. "404.html") for the website. websiteIndexDocument must also be set if this is set.


- No error document.
websiteIndexDocument?: string

The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket.


- No index document.
websiteRedirect?: RedirectTarget

Specifies the redirect behavior of all requests to a website endpoint of a bucket.

If you specify this property, you can't specify "websiteIndexDocument", "websiteErrorDocument" nor , "websiteRoutingRules".


- No redirection.
websiteRoutingRules?: RoutingRule[]

Rules that define when a redirect is applied and the redirect behavior


- No redirection rules.